IT due diligence should be able to change the price

Southeast Asian technology companies are growing by acquisition, and payroll and HR software is no exception. Since 2022 my company has bought businesses in Vietnam, Indonesia and Thailand, and we are considering a fourth. Each purchase has taught me something about integration. The most important lesson, though, concerns the weeks before a deal is signed, and it is one I learnt by arriving too late.

My argument is simple. The technology and security condition of a business being bought is part of what is being bought. If the buyer discovers it after the price is fixed, the cost of putting it right becomes an integration budget that the buyer pays alone. If the buyer discovers it before, the cost can be shared, deferred into an escrow or made a condition of closing. The CIO's findings should be able to change the price, and a board should ask whether they did.

Findings that arrive too late to matter

Our first acquisition was Vanthiro, a payroll bureau in Ho Chi Minh City with 240 staff. I was asked to plan the IT integration after the purchase agreement had been signed. My team found that its payroll engine ran on an unsupported server, that backups were incomplete and that several administrator accounts belonged to people who had left. None of this was concealed. Nobody had asked.

Putting it right cost S$1.9 million over the first year, none of it in the deal model. The integration plan absorbed it, other work was delayed, and the business case that the board had approved looked worse for reasons that had nothing to do with the company's commercial performance. I do not blame the deal team. It had followed the usual sequence, in which financial, legal and commercial diligence precede signing and technology arrives afterwards as a plan.

That sequence made sense when technology was a back-office cost. It makes less sense for a payroll business, in which the systems hold the salaries, identity documents and bank details of every client's employees. On the day of closing, all of that becomes the buyer's responsibility. A buyer who has not looked has accepted a risk without pricing it.

Turning a finding into a term

For our purchase of Siravanna in Bangkok in 2024, I asked to begin due diligence before the price was final, and the chief executive agreed. We had three weeks of access to systems lists, access reviews, backup records and incident history, and we interviewed the engineers who ran them.

The findings were serious but ordinary: a payroll engine on two office servers running an unsupported operating system, eleven shared administrator accounts, remote access protected only by passwords, backups never restored in a test and incomplete records of processing under Thailand's personal-data law. I graded each one by what it should do to the deal. Some belonged in the integration plan. Two should be conditions before closing: rotating every administrator credential and adding multi-factor authentication to remote access. The remainder, chiefly moving the payroll engine to a supported, hosted environment, I proposed to fund through a holdback released against milestones.

I asked for S$4.5 million. We agreed S$2.7 million, released against four milestones within twelve months. The two conditions were met before closing. Four months after closing, an attacker encrypted a file server in Siravanna's office that had not yet joined our network. Because the credentials had been rotated, the attack went no further, and we restored the server from backup within a day. The milestones were met in eleven months and the escrow was released in full.

The grading used four outcomes, and I now use them for every deal. A finding can change the price, because it describes value the buyer will have to spend to restore. It can become a condition before closing, because the risk is too immediate to inherit. It can be funded through an escrow, because the fix is clear but will take months. Or it can simply join the integration plan, because it is the ordinary cost of bringing any business onto our systems. Most findings belong in the last group. Saying so openly gives the others more weight, and it stops the deal team from hearing every technology concern as an objection to the deal itself.

I draw two conclusions. The first is that the grading matters more than the list. A long list of findings, presented without saying which should change the price, is easy for a deal team to file under integration. A short list, each item tied to a proposed term, is harder to ignore. The second is that pre-closing conditions are often worth more than money. Rotating credentials cost the sellers almost nothing and probably prevented the worst outcome we faced.

The cost of being the difficult voice

This approach has costs, and I should be honest about them. Our chief strategy officer, who led the Siravanna deal, believed a larger holdback would lose us the business to a competing bidder. He may have been right. The figure we agreed was smaller than the one I asked for, and I accepted it because the deal was worth doing. A CIO who treats every finding as a reason to walk away will soon stop being invited to diligence at all.

There is also a human cost. Remediation imposed on an acquired team, at a pace set by an escrow, is demanding. Two of Siravanna's three senior engineers left within six months, and we paid contractors S$380,000 to cover their work. Next time I would propose retention arrangements for the key engineers at signing, as part of the same paper.

Finally, early diligence asks something of the seller that not every seller will accept: access to systems and people before the deal is certain. Some will refuse. In that case I think the refusal is itself a finding, and the buyer should price the uncertainty rather than assume the best.

For directors, the questions are brief. Did technology and security diligence begin before the price was fixed? Which findings became terms, which became conditions, and which were left to integration? Who in the acquired business holds the knowledge the systems depend on, and what will keep them? A board that hears clear answers to those questions has bought a business. A board that hears only an integration budget has bought a project as well.