The owner of a Polish mid-sized company typically learns that "IT due diligence" exists at one specific moment: a week after signing the letter of intent, when a 40-page questionnaire about systems, licences and procedures arrives from the buyer. At that point it is too late to prepare anything. The only option left is to negotiate from a weaker position.
Over the last two years we have assisted on more than a dozen transactions — on both the seller and the buyer side. The pattern is predictable. The buyer is not looking for a perfect company. They are looking for risks that let them lower the price or add protective clauses to the contract. IT is fertile hunting ground, because almost no SME runs its technology with an external audit lens in mind.
This post is not about how to sell a company. It is about what, inside the IT infrastructure of a ten- or fifty-person business, the buyer actually examines — and what you can do six months earlier to avoid giving up 5–10% of the price just for being disorganised.
How IT due diligence differs from a routine audit
A routine IT audit (performed every two years by an internal team or an external consultant) answers the question "is our IT working well?". IT due diligence answers an entirely different question: "what in this company could unpleasantly surprise the buyer after the acquisition?". The perspective is adversarial. The goal is not to confirm that everything is green — the goal is to find anything that could break in the first year after the deal.
That is why the buyer does not take verbal assurances at face value. They want documentation, contracts, invoice copies, logs. If something is not documented, from their perspective it does not exist — or, worse, it is a risk. A company whose "backups work because the admin says so" lands in the "operational risk" column after due diligence.
What the buyer actually checks
In practice the questionnaire runs to 60–120 items, but it boils down to seven areas:
- Software legality. Are all Microsoft, Comarch Optima and CAD licences documented by invoices? Does the number of seats match the purchases?
- Vendor contracts. Which service providers do you work with? What are the SLAs? Can contracts be terminated without penalty? Is there a clause granting irrevocable access to source code for custom-built applications?
- Rights to in-house software. If the company owns a B2B portal or custom integrations, who built them — an employee on a labour contract (good) or an external freelancer with no transfer of IP rights (bad)?
- Personal data and GDPR. Processing activity register. Data processing agreements. Breach-handling procedure.
- Business continuity. When was the backup last tested? What happens if the single sysadmin wins the lottery? Is there a continuity plan on paper?
- Cybersecurity. MFA, network segmentation, password policy, laptop encryption, date of the last pentest or at least a vulnerability scan.
- Dependency on single people or vendors. Does anything critical rest on one external person to whom the company has no backup access?
The buyer rates each of these seven areas on a "green / yellow / red" scale. Red items go into the contract as conditions precedent or price reductions. Yellow items go into "representations and warranties" — if, after the transaction, the seller is found to have hidden something, there is money at stake.
Three areas where Polish SMEs look worst
On one project we assisted a 35-person distribution company in the construction supply sector, being sold to a private equity fund. The first due diligence report had 28 findings, nine of them flagged red. Three of them cost the owner real money in the negotiation.
Area one — licences. The company had been using 42 Microsoft 365 Business accounts for years but had documented purchases for only 30. "We bought the rest from the previous admin, who had a better price" — that sentence from the owner was enough for the buyer to flag it as a Microsoft audit risk with a potential fine of PLN 60–120k. They secured themselves with a holdback in the purchase price.
Area two — software rights. The B2B ordering portal — the heart of the company's revenue — had been written back in 2019 by a freelancer from Łódź. The contract was three pages long, with no clause transferring economic copyright. Formally the company was using a portal to which it had no rights. The buyer demanded that the contract be amended before closing — the freelancer, sensing the situation, asked for PLN 40k to sign the annex.
Area three — bus factor and documentation. The only person who knew how to restore the ERP database (an older version of Microsoft Dynamics AX) was an external IT contractor employed for 11 years on a task contract, with no written handover procedure. The buyer estimated the risk of 3–6 months of operational paralysis if he left — and that risk entered the contract as a requirement to retain him on a management contract for two years after the deal.
Together, those three findings reduced the proposed purchase price by roughly 7%. Each of them could have been cleaned up in six months, if someone had asked half a year earlier: "what are we going to do about this when the buyer walks in?".
How to prepare — six months out
You cannot prepare IT for due diligence in two weeks. You can in six months, without big spending, provided somebody runs the programme consistently.
- Month 1 — inventory. Catalogue every system, application, service account and integration. Who was paid for IT in the last 24 months, and for what. A list of service contracts with their expiry dates.
- Month 2 — licences. Reconciliation of purchased vs. used seats in Microsoft 365, Comarch Optima, CAD, Adobe. Paying for missing seats now costs less than a fine during due diligence.
- Month 3 — IP rights. Review every contract with external software suppliers. Where the IP transfer clause is missing — sign an annex now, from a normal negotiating position, not under deal pressure.
- Month 4 — continuity. A documented backup restore test (date, time, what was restored, how long it took). One sheet of paper worth, in due diligence, as much as a three-hour explanatory meeting.
- Month 5 — GDPR and documentation. Processing activity register. Processing agreements with key vendors (accounting, hosting, HR system). A security policy — not necessarily beautiful, but existing.
- Month 6 — bus factor. Write down who knows what. For every critical system — a second person or a written procedure that lets an outsider take over the system within a week.
You do not need to do everything at once; you do not need to hire consultants for a hundred thousand. Two deliberate days per month collecting documentation is enough — instead of discovering gaps during negotiation. Each hour spent on cleanup six months earlier is worth roughly ten times as much in the transaction price.
If you are planning to sell within a year or two, or if you have just received your first letter of intent and don't know what to expect on the IT side, it is worth running an internal mock audit first. Four to six days of work; the results show where the company stands before the buyer sees it.
The buyer is not looking for a perfect company — they are looking for risks that let them lower the price. IT due diligence is fertile hunting ground, because almost no SME runs its technology with an adversarial lens in mind.