An IT due diligence checklist helps you verify what technology you’re buying, who controls it and what it will cost to keep the business running after settlement. Start with the systems that keep staff working and customers served. Ask for evidence of ownership, administrator access, contract terms and successful restores before you commit to a handover date or integration budget.
This checklist is for Australian business buyers, directors and advisers. Use it alongside your financial and legal due diligence. The Australian Government’s guide to buying an existing business explains the broader review of assets, records and agreements.
What should an IT due diligence checklist cover?
Ask the seller for the evidence below. Record each item as verified, incomplete or unresolved, with a named owner and a date for the next action. A current system export, signed contract or witnessed test gives you a better basis for a decision than a verbal assurance.
| Area | What to request | What to establish |
|---|---|---|
| Microsoft 365 and identity | Tenant and domain inventory, administrator roles, licence report and identity dependencies. | Who controls access today and how authorised administrators will take over. |
| Domains, websites and phones | Registrar and DNS ownership, hosting and carrier agreements, and a list of main numbers. | Who can approve transfers or routing changes, and how email, web enquiries and calls will keep working. |
| Business applications | Application register, supplier agreements and a map of integrations for payroll, finance, sales and operations. | Which applications the buyer can keep using, which need vendor consent or replacement, and what depends on them. |
| Cyber security | Summary of known incidents, privileged access controls, endpoint protection coverage and open remediation items. | Which unresolved risks need action before handover or before connecting the acquired business to your network. |
| Backups and recovery | Backup scope, retention and the latest restore test evidence for critical workloads. | What was restored, how long it took and who can access the backups after settlement. |
| Hardware and infrastructure | Asset register, warranty and lease details, network diagrams and support expiry dates. | What you will own, what you will lease and what needs replacement or extra support. |
| Data and third parties | Locations of key records, third-party access lists, support contracts and a summary of any shared systems. | What the buyer needs access to, what must be separated, and which questions need legal or privacy review. |
Agree how information will be shared with your deal team. Start with redacted reports, contract summaries or a supervised walkthrough. Use an approved secure process for sensitive records and arrange administrator handover separately. Avoid exchanging passwords in a deal spreadsheet or by email.
IT due diligence checklist priorities before signing
Prioritise anything that could stop the business trading or materially change the cost of the purchase. A domain held in the seller’s personal registrar account, a payroll application tied to a shared licence, or a backup only the outgoing provider can restore can all affect the handover. Confirm who can fix the issue, how long it will take and what temporary arrangement is available. Give unresolved findings to your deal advisers so they can decide how to handle them.
For Microsoft 365, establish whether the tenant belongs solely to the target business or is shared with entities outside the purchase. Where a separation or consolidation is needed, scope email, SharePoint, OneDrive, Teams, devices and application sign-ins separately. Microsoft’s tenant-to-tenant migration planning guide covers identity mapping, workload dependencies and phased coexistence.
What needs to work on day one?
Build a short handover plan around what people actually need to do on the first business day after settlement. Ask nominated staff to test these workflows using the access they will have at handover:
- Sign in, complete multifactor authentication and get help if access fails.
- Send and receive email, answer the main phone line and receive website enquiries.
- Open shared files and use payroll, finance and other applications essential to trading.
- Confirm backups and security monitoring have an owner and that alerts reach the right team.
- Verify the buyer’s authorised administrator access, then remove outgoing access on the agreed schedule.
Assign a named owner, test time and fallback to each workflow. If the seller must keep providing access to a shared system, specify who supports it, when the arrangement ends and what replaces it. Schedule platform changes after settlement if the existing environment can keep operating safely during the transition.
What should you allow for in the IT budget?
Separate one-off project work from the recurring costs of running the acquired business. Quote migration tools, data separation, cutover and user support separately from licences, backups, monitoring and managed IT. Add near-term replacements for ageing equipment and price any overlap while both environments are running. For every estimate, record the scope, exclusions, dependencies and the assumptions that could change the price.
For example, imagine a 35-person accounting practice that uses a shared Microsoft 365 tenant and an application licensed by the seller’s group. Before signing, the buyer needs an agreed way to retain access to the application and recover the practice’s records. At settlement, staff need working email and client files. The budget then needs separate lines for Microsoft 365 migration, application relicensing and any temporary support. The example is illustrative.
What should an IT due diligence review deliver?
Ask for a prioritised risk register with evidence and gaps, a day-one handover plan and an indicative remediation and integration budget. Each finding should say who owns it and when it needs attention. The deal team should be able to see which issues require a decision before signing, which need an agreed handover step and which can go into the first 90 days of work.
Frequently asked questions
When should IT due diligence start?
Start once the seller has agreed to provide evidence and before the buyer commits to the final terms. Allow time for suppliers to confirm access, licensing and transfer arrangements.
Do we need to migrate Microsoft 365 at settlement?
That depends on tenant ownership, separation requirements and the agreed transition. If the existing tenant can remain available securely, a staged move can give the team time to test identities, data and applications before cutover.
What if the seller has no current IT documentation?
Request a supervised walkthrough with the seller’s IT team or provider. Record what you can verify and identify gaps that need a test, a supplier response or a budget allowance.
Does a backup report prove the business can recover?
A backup report shows the status of backup jobs. A restore test gives evidence of what can be recovered and how long it takes. Ask for results that cover the systems you need to keep trading.
Discuss an IT due diligence review before you sign
Buying a business or planning an integration? Stanfield IT can help scope the technology review and identify what needs to be verified before signing or settlement. Explore our IT consulting services and Microsoft 365 migration support, or talk to us about your acquisition.
