The first 100 days after acquisition: a technology checklist

In the first 100 days after an acquisition, the technology job is to find out what the business actually runs, who controls it, what it costs and what could go wrong, then agree what to fix first. Spend weeks 1–2 on facts (systems, suppliers, contracts, account ownership, security, data), weeks 3–10 on priorities and quick wins, and weeks 11–14 writing it up as an estate report and plan the board can act on. None of it needs a big team. It needs someone senior to ask the awkward questions and write the answers down.

This guide is the checklist I’d work through for a portfolio business that buys most of its technology: an online shop or website, a CRM, finance and operations software, and agencies or freelancers who look after them. If the business builds its own software product, you’ll also need technical due diligence from someone with engineering leadership experience.

What this covers, and what it doesn’t

This is operational: platforms, suppliers, delivery and the risks that sit in them. It is not financial or legal due diligence, investment advice, or formal security assurance. I don’t review accounts, value technology assets or give legal opinions on contracts. Where a finding needs a lawyer, an accountant or a penetration tester (a specialist paid to try to break into your systems), the checklist flags it and the right specialist picks it up.

That boundary matters. A delivery lead who starts offering opinions on contract law or valuation is doing the fund no favours.

Weeks 1–2: get the facts

Start with the operating partner and the leadership team: what the fund needs to see, what management is worried about, and which systems and suppliers are in scope. Then build the inventory.

Systems

Every platform the business relies on: website or shop, CRM, email, finance, stock, booking, customer service, reporting tools, and the spreadsheets that quietly hold it all together. For each, note what it does, who uses it, who looks after it, what it costs and when it renews. Note anything out of support: software with no more security updates is a risk you can usually date precisely.

Suppliers and contracts

Agencies, freelancers, hosting providers, software subscriptions. For each: what they’re contracted to do, the monthly or annual cost, notice periods, renewal dates, and whether there’s a written statement of work at all. Flag contracts that need legal review (change of control clauses, intellectual property, liability) rather than interpreting them yourself.

Ownership of accounts and domains

This is the item most likely to cause trouble later. Check who is the registrant (legal holder) of each domain name, whose name the hosting, app store, payment, analytics and advertising accounts are in, and who holds the admin logins. A domain registered to a former agency or a departed employee can be moved to the business, but it’s far easier to do while relationships are friendly. For .uk domains, changing the registrant is a defined process with a small fee.

Security and patching

Use the government’s baseline rather than inventing one. Cyber Essentials, the scheme the NCSC (the UK’s National Cyber Security Centre) describes as the minimum standard for organisations of all sizes, covers five controls: firewalls, secure configuration, security update management, user access control and malware protection. Its current requirements expect critical and high-risk updates within 14 days of release and multi-factor authentication on cloud services. Two quick questions tell you a lot: are the website and its plugins patched within 14 days, and does every admin account have multi-factor login switched on?

Check backups too: what’s backed up, where, how often, and when someone last tested a restore. And find out who would handle a personal data breach, because notifiable breaches must be reported to the ICO within 72 hours of the business becoming aware of them.

Data and reporting

Where do the numbers in the board pack come from? Trace two or three key figures (revenue by channel, orders, active customers) back to the systems that produce them. If two systems disagree, note it now; it will matter when the fund starts comparing months. Also note where customer personal data lives and which suppliers process it, since each should have data processing terms in their contract.

Weeks 3–10: priorities, quick wins and supplier accountability

Rank the risks

Turn the inventory into a short list ranked by likelihood and impact, each with a rough cost to address. “Unsupported shop platform, card payments affected if it fails” and “two staff share one admin login” are different sizes of problem; the list should make that obvious.

Take the quick wins

Some fixes are cheap and remove real risk in days: switching on multi-factor authentication, removing old staff and agency accounts, moving domains into the company’s name, consolidating duplicate subscriptions, setting renewal reminders, testing a backup restore. Do them early. They build trust with the management team and they show the fund progress in the first monthly report.

Put suppliers on written criteria

Many suppliers have never been managed against anything written. For each important one, agree what they’re responsible for, what “done” means for open work, how changes are priced and approved, and how they report. The aim isn’t to replace suppliers; often the incumbent is fine once expectations are clear. Where one isn’t, you’ll have the evidence to make the case. The guide to acceptance criteria covers how to define done.

Agree priorities with leadership

By week 10, leadership should have signed off a short list of what gets fixed or delivered first, each with an owner, a milestone cost and a test for done. Fewer, finished, beats many, started.

Weeks 11–14: the written estate report and plan

Everything above ends in one document. It should be readable by an operating partner in twenty minutes and specific enough for the management team to act on. Mine usually covers:

1. Summary: the five things the board should know, in plain language.
2. Estate map: systems, what each does, owner, supplier, cost, renewal, support status.
3. Supplier position: contracts, performance against written criteria, spend against plan.
4. Risks ranked: with cost to address and a recommended owner.
5. What’s been done: the quick wins, dated.
6. The plan: priorities for the next two to three quarters, with milestones and costs.
7. Reporting: the one page that goes into the board pack each month from here.

There’s a sample 100-day estate report on a fictional portfolio business among the sample documents, if you want to see the shape.

The checklist

Common findings

These are the things worth looking for, because they’re easy to miss and awkward to discover later:

• Domains and accounts in the wrong name. Registered by a founder, an ex-employee or an agency years ago.
• Patching that’s months behind. Especially on eCommerce platforms, where updates need testing and nobody owns that testing. As an agency Senior Delivery / Project Manager, I led a development team that reduced patching delays from months, through weeks and days, to within 24 hours of release. We mapped and scheduled patches with a clean staging environment for testing. The lesson is to give the work an owner, a schedule and the development capacity to deliver it.
• Retainers with no written scope. Paying monthly for “support” without a list of what’s included.
• Subscriptions nobody uses, still renewing on someone’s company card.
• Knowledge in one head. One person or one freelancer knows how the critical system works and none of it is written down.
• Numbers that don’t reconcile between the shop, the finance system and the board pack.
• Platforms near end of support, with a replatform nobody has costed. If that’s Magento, the guides to leaving Magento and Magento end of support are a sensible next read.

Where to start

If you’re inside the first 100 days, start with domains, admin accounts and patching: they’re cheap to check and the most painful to discover late. Then the supplier list. The report can wait until you’ve got facts worth writing down.

This is the work I do for portfolio businesses through private equity support, delivered as fractional delivery leadership from £3,600 a month for a day a week, minimum three months. It covers technology and delivery only; financial and legal due diligence stay with the specialists who do them.