Due diligence before an investment or acquisition is thorough about some things. The accounts are tested, the contracts read, the intellectual property checked. How the business looks after its information is often left until after the deal, by which time it has become the buyer’s problem.
As a specialist contractor I was often brought into organisations at critical moments, including mergers, acquisitions and new investment, on both sides of the deal. In one case I was working with a larger organisation taking a stake in a smaller one. On paper, the smaller company looked good. Underneath, it was a different story.
Many basic procedures were not in place, and nothing stopped information leaving the business. Staff were using so many different file-sharing apps that nobody could say where the master copy of a document was, or which version was current.
That is common in a growing company, and it is rarely carelessness. The race is to build the business and get information to whoever needs it. Controls feel as if they slow that down, so they are left for later. But if part of a company’s value lies in its customer records, designs, contracts and know-how, then not knowing where they are affects what the business is worth.
You do not need to be technical to test this. Before investing, or in the first months after, these questions are worth asking.
Where does the important information live?
Ask for a simple list of the systems and apps in use, including the free ones staff signed up to themselves. If nobody can produce one, that is the answer.
Who can reach it, and who could take it?
When someone leaves, how quickly is their access removed, and would anyone know if files went with them? (See “The licence that outlived the employee”.)
Who holds the keys?
Administrator accounts, the domain name and key subscriptions are sometimes registered to a founder, a former employee or the IT supplier. Could the business carry on if that person or supplier were no longer there?
When were the backups last restored?
Running a backup and recovering from one are different tests. Only the second proves the backup works.
Is the security evidence about what is switched on, or what works?
A setting can be on and still cover only some of the people it should. (See “The security setting everyone thought was on”.)
None of this needs to stop a deal. Most of it is cheap to fix once it is known about. It costs far more when it is discovered after completion, usually at the worst possible moment.
Data is an asset. It deserves the same scrutiny as the balance sheet.
