Sample Diligence Summary
The first two pages of a technology due diligence readout, as a buyer's deal team would receive them.
Illustrative sample. "Harbor Logistics Software" is a fictional company, and every finding and figure on this page is invented to show the format.
Summary
The platform is fundamentally sound and can support the growth plan with planned investment. The material risks are an open security backlog and key-person dependency in billing. Both are fixable, and we recommend addressing them through deal terms rather than price alone. Estimated one-time remediation over the first 18 months: $365K to $585K.
Scorecard
| Area | Rating | Why |
|---|---|---|
| Architecture and product | Amber | Sound core platform; two legacy modules need replacing within 18 months. |
| Infrastructure and operations | Green | Stable cloud hosting with tested backups and good uptime. |
| Security | Red | Open critical findings from the last penetration test; MFA gaps on admin accounts. |
| Data and privacy | Amber | Customer data well controlled; retention rules not enforced. |
| Vendors and contracts | Amber | One critical vendor with a change-of-control termination right. |
| Team and key people | Red | Two engineers hold most knowledge of the billing system. |
| Technology spend | Green | In line with peers; modest deferred maintenance. |
Key findings
Unremediated security findings
Three critical findings from a pen test nine months ago remain open, and 14 admin accounts lack MFA.
- Estimated cost
- $60K to $90K
- Timing
- Before close or within 30 days
Key-person risk in billing
Two engineers maintain the billing system with little documentation. Losing either would stall invoicing changes.
- Estimated cost
- $40K to $70K, plus retention terms
- Timing
- Retention agreements at signing
Vendor change-of-control clause
The payments vendor may terminate on change of control, with a 90-day notice period.
- Estimated cost
- Legal review; possible repricing
- Timing
- Confirm consent before close
Legacy reporting and import modules
Two modules run on an unsupported framework and limit the growth plan.
- Estimated cost
- $250K to $400K over 12 to 18 months
- Timing
- Plan in first 100 days
Data retention not enforced
Retention policy exists but old customer data is never deleted.
- Estimated cost
- $15K to $25K
- Timing
- Within 6 months
Deal considerations
- Make closing conditional on MFA for all admin accounts and a plan for the critical pen test findings
- Put retention agreements in place for the two billing engineers at signing
- Obtain the payments vendor's written consent to the change of control before close
- Hold back part of the purchase price or set up an escrow against the legacy module replacement
First 100 days
Want a Second Opinion?
Our diligence readouts start within days of LOI and typically arrive in two to three weeks, with a full report behind every finding.