IT for PE-backed companies: diligence, the first 100 days, and exit

Private equity firms are disciplined about financial diligence and operating plans. Technology often gets a lighter look, even though it touches every line of the value creation plan: security risk, systems that can or can't scale, vendor contracts, and the people who keep it all running.

This guide covers the three moments where IT matters most in the hold period: before close, the first 100 days, and the run-up to exit. It also covers how to structure a portfolio company's IT team so the gains stick.

Why technology diligence gets skipped

Accenture's research found that only one in four CEOs conduct technology due diligence on most of their deals. Yet 96% of CIOs say technology diligence has uncovered major issues or opportunities in their M&A deals.

That gap is where surprises come from. An unsupported ERP, a key-person dependency, or a security incident discovered after close doesn't just create work. It changes the math on the deal.

What to check before close

Technology due diligence should review security, infrastructure, key applications, IT people, vendor contracts, licensing, and technical debt, so risk is priced before close rather than discovered after.

1. Security posture: MFA coverage, tested backups, incident history, and cyber insurance terms.
2. Identity and access: Who holds admin rights, and how departing employees are offboarded.
3. Infrastructure: Age, end-of-life hardware and software, and single points of failure.
4. ERP and key applications: Version, level of customization, and vendor support status.
5. People: Key-person dependency and staffing gaps.
6. Vendors and contracts: MSP terms, auto-renewals, and change-of-control clauses.
7. Licensing: Compliance exposure and true-up risk.
8. Spend: IT spend against peers, and what it is actually buying.
9. Carve-out dependencies: Systems shared with a parent company that will need a transition services agreement.

For a lower middle market target, a focused review like this can often be completed in a few weeks. The goal isn't a perfect picture. It's knowing which findings change the price, which change the 100-day plan, and which can wait.

The first 100 days

The first 100 days should secure the environment, establish clear ownership, and align technology with the value creation plan. Stabilize first, then optimize.

Days 1 to 30: secure and stabilize

Take control of admin credentials, confirm MFA everywhere, gain visibility into every endpoint, validate that backups actually restore, and assign clear ownership of day-to-day support. Nothing strategic happens until you know who holds the keys.

Days 31 to 60: assess and decide

Evaluate the IT team, vendors, and spend. Decide what to keep, what to replace, and what to integrate. This is also when you find out whether the MSP is a partner or a dependency, and whether the internal IT lead can grow into the role the plan requires.

Days 61 to 100: execute and report

Deliver a few visible quick wins, launch the roadmap projects tied to the investment thesis, and set up monthly reporting the board can read in two minutes. Reporting matters as much as the work itself, because it is how the operating partners know technology is on track.

Structuring the portfolio company's IT team

For a company of 50 to 200 employees, the right structure usually combines a strategic leader, a small internal team, and an MSP for scale. The key decision is what to keep in-house and what to outsource.

• Fully outsourced (MSP plus fractional CIO): Fits a simple environment with few on-site needs.
• Hybrid (internal IT manager plus MSP plus fractional CIO): Fits companies with multiple sites, an ERP, or manufacturing systems.
• Internal (IT director plus internal staff): Fits larger scale, or companies where technology is central to operations.

A common mistake is promoting the best technician to IT manager without leadership support. Strong technicians don't automatically become strong managers, and both the person and the department suffer. A fractional CIO can mentor that person into the role, or help define the role and hire for it.

Preparing IT for exit

Buyers run the same diligence you did. Every unresolved IT finding becomes a negotiation point, an escrow, or a delay. Start 12 to 18 months before a planned exit.

• Document the network, systems, vendors, and contracts.
• Clean up licensing so there is no compliance exposure.
• Show security evidence: MFA, tested backups, written policies, and an incident response plan.
• Remove key-person dependency.
• Confirm contracts are assignable to a new owner.
• Benchmark and explain IT spend.
• Organize everything for the data room before a buyer asks.

None of this is glamorous. All of it shows up in the buyer's diligence report, and a clean report is one less reason to discount the price.

Where a fractional CIO fits

Most portfolio companies in the $20M to $100M range don't need a full-time CIO, but they do need someone who owns technology decisions across the hold period. A fractional CIO can run the pre-close review, lead the first 100 days, build the team and the roadmap, and prepare the company for exit, then hand off to a permanent leader if the business grows into one.

The operating partner gets one accountable owner for technology, reporting in financial terms, without adding a full executive salary to the portfolio company's cost base.

Source: Accenture, Mapping the DNA of M&A value (2022)