IT due diligence

Before you sign, find out who actually controls the IT you're buying.

The expensive surprises in an acquisition are rarely the servers. They are a domain in the seller's personal account, a tenant nobody can prove they control, a backup that has never been restored, or a contract that needs consent to transfer. Here is what to check, what to ask for, and a nine-point check to run now.

General information, not legal or tax advice. Checked 31 October 2026.

Discuss an acquisition review Run the check 07 3114 2808

Evidence to request
Red flags for the deal team
Nine-point check

Reviewed by Blake Bath, General Manager, on 31 October 2026.

Two people review a binder of documents together at a meeting table, with a laptop showing charts beside them. — **Control, not invoices**A subscription invoice does not prove who controls the account.

What changes deals

Four findings that change the price or the plan.

Each one needs an owner, an evidence request and a decision date.

Control can't be shown

The domain or tenant depends on a personal account, or no admin can demonstrate access.

Custody first
Named admins
Recorded IDs

Acquisition IT check

How ready is the IT for a sale?

Buyers: tick what the seller has shown you. Sellers: tick what you could show today. The gaps are your evidence requests.

Tick what has been shown, not what has been promised.

The domain is held by the business, not a personRegistrar account, DNS host and renewal in the company's name.
Named admins for Microsoft 365 or Google can be shownWho can sign in as admin today, with MFA, and the tenant ID recorded.
A restore has been witnessedA representative system brought back, with the time it took.
Devices and software reconcile to a registerSupport dates and licences checked, not just warranty dates.
Contracts list renewal and change-of-control termsIncluding software, telco, MSP and leases.
Incidents and open findings are disclosedTimelines, notifications made and anything still unresolved.
Personal information and retention duties are mappedWhere it lives, who controls it and what must be kept.
No critical task depends on one personDocumented handover and a named replacement owner.
Recurring and one-off IT costs are separatedEstimates labelled, supplier quotes attached.

Where you stand

0of 9 checks in place

9 gaps to close.

The domain is held by the business, not a personA domain in the seller's personal account can stop email and the website at settlement.
Named admins for Microsoft 365 or Google can be shownControl has to be demonstrated, not promised.
A restore has been witnessedA successful backup job is not a successful restore.
Devices and software reconcile to a registerUnsupported systems become a cost on day one.
Contracts list renewal and change-of-control termsSome agreements need consent to transfer or allow termination.
Incidents and open findings are disclosedAn unresolved incident can carry obligations with it.
Personal information and retention duties are mappedTransfer and retention are legal questions for your adviser.
No critical task depends on one personKnowledge that walks out at settlement is a hidden cost.
Recurring and one-off IT costs are separatedThe deal team needs numbers they can rely on.

Scope a review

Six areas

The evidence to request, and what to record.

Area	Request and check	Record in the report
Identity and control	Named admins, MFA coverage, guest access, app permissions, emergency access custody	Who can take control at settlement, and what access must change
Backup and recovery	Protected systems, retention, recovery targets, a witnessed restore	What restored, how long it took, missing dependencies
Hardware and software	Asset export reconciled to devices, versions, support dates and licences	Replacement needs and support exceptions
Security and incidents	Control evidence, monitoring, open findings, incident records, insurance	Verified gaps and unresolved incidents, with owners
Contracts and cost	Invoices, renewals, commitments, change-of-control and assignment terms	Recurring spend, consents needed and one-off costs
Operations and separation	Dependencies, provider responsibilities, documentation, seller-owned services	What must stay available and how temporary access ends

Missing evidence is an unresolved finding, not a pass.

Start outside

Public checks find questions. They don't approve the deal.

Domain security scanOur free scan checks public email authentication, DNS and website settings. A pass does not prove the tenant or backups are secure.
Email authentication resultsSPF and DMARC records show who is allowed to send as the domain, not whether a mailbox is compromised.
SMB1001 gap assessmentCollects control questions. Self-reported answers are not certification.

Get the owner's authority before any review, and never put credentials or deal details into public tools.

Control versus migration

Taking control of a tenant is not the same as migrating it.

Keep itTake over admin control and billing, and run it as is.
Run side by sideKeep both tenants and connect them while you decide.
Migrate itMove mail and files into your tenant. Cross-tenant mailbox migration has its own licence and limits for mailboxes on hold.
Check device supportWindows 10 Home and Pro support ended 14 October 2025. Check editions and any extended updates before budgeting replacements.

What may move

Check what data may be inspected and transferred.

Purpose and locationThe data needed to run the business, where it sits and who controls it, including archives.
Retention and holdsKeep what law, contract or a legal hold requires. Don't delete or move held data to tidy up.
Who approves transferA named decision maker and approved recipients. No customer records or passwords in an open data room.

Whether disclosure or transfer is allowed is a question for your legal adviser.

Our view

Settle custody first. Everything else can be priced.

Old devices, licence gaps and missing documentation are costs you can put a number on. Losing control of the domain or the tenant at settlement is not. So we confirm custody of the domain, the tenant and the backups before anything else.

Then we give the deal team a findings register: verified issues, unresolved questions, and cost estimates clearly separated from supplier quotes. The buyer, seller and advisers make the decisions.

How it works

Scope, inspect, decide and review the handover.

Step 1Call with the deal and deadline
We agree the written scope, permissions and fee.
Step 2Inspect the agreed evidence
Read-only access, limitations recorded, restore tests agreed.
Step 3Decide with a findings register
Evidenced findings, cost assumptions, proposed actions.
Step 4Hand over
Access moved, temporary access ended, owners named.
Step 5Review a month in
Access, recovery evidence, renewals and actions checked.

Related guides

After the deal. Risk, roadmap and recovery.

Turning findings into a plan.

Get help your way

Six ways to reach us. Pick whichever suits you.

Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.

Questions

What people ask about IT due diligence.

What is IT due diligence when buying a business?

A review of the systems, access, data, contracts and recovery arrangements behind the business. It produces evidenced risks, transfer conditions and costs that may affect the price or handover. It supports financial and legal due diligence; it does not replace either.

Can a free domain scan replace an acquisition review?

No. A public scan checks settings anyone can see. It cannot show permissions, backups, incident history or contract terms. Use it to ask better questions.

What should a seller prepare?

An asset and application register, contract and licence schedules, access owners, restore test records and known incident reports. Share them through an agreed data room, never with passwords or unrestricted personal information.

Does a Microsoft 365 tenant transfer with the business?

Do not assume it does. Confirm who controls the tenant and subscriptions, which domains belong to the acquired business, and whether a migration into another tenant is needed. Microsoft's cross-tenant mailbox migration has its own licence and restrictions for mailboxes on hold.

How much does an IT due diligence review cost?

It is quoted against the agreed systems, tests and deadline, separately from any ongoing support plan. Ask for scope exclusions and cost assumptions before commissioning it.

Does due diligence prove there has been no breach?

No. A review reports the evidence available within its scope and dates. Missing logs, unavailable systems or undisclosed incidents limit what can be concluded, and a good report says so plainly.

Next step

Bring the decision date, not the passwords.

Tell us whether you are buying or selling, the settlement target and the systems that must keep working. We scope the review with you and your advisers before asking for anything confidential.

Discuss an acquisition review 07 3114 2808