Home› Guides› IT Due Diligence Checklist
M&A · Due Diligence

The IT Due Diligence Checklist: What Buyers Actually Look At

Financial due diligence is table stakes in any deal. Technology due diligence in ASEAN mid-market transactions still gets rushed, skipped, or handed to whoever can spare a week, which is exactly where deals either overpay or blow up after close. This is what a proper review actually covers, written for the buyer doing the checking and for the seller about to be checked.

📅 Published September 2026 ⏱ 11 min read By Hitan Mehta
🔑
Key takeaways
  • Technology due diligence gets rushed more often than other parts of an ASEAN M&A deal, usually against a tight signing timeline.
  • Six areas, covering infrastructure, security and compliance exposure, are what buyers actually check in a technology review.
  • AI systems are the area most existing due diligence checklists still miss entirely.
  • ASEAN due diligence is not the same exercise as due diligence in a single-market deal, given the regulatory and infrastructure variation across the region.
  • A checklist tells you what to look at; it cannot tell you what to do about what you find.

Why technology due diligence gets rushed

A financial due diligence process on a mid-market ASEAN acquisition will run for weeks, involve external auditors, and produce a report nobody on the deal team would dream of skipping. The technology review, on the other hand, is often a data room folder, an afternoon with the target's IT manager, and a verbal "it looks fine." That gap does not close deals faster. It just moves the risk to after completion, where it is far more expensive to fix and there is no seller left to negotiate against.

This matters more in ASEAN mid-market transactions than the size of the deal would suggest. A business at this scale rarely has a CTO, rarely has documentation that matches reality, and almost always has more of its technical knowledge sitting inside one or two people's heads than anyone on the deal team has asked about. None of that shows up in a balance sheet. All of it shows up eighteen months into an integration.

The six areas buyers actually check

These are not exotic categories. They are the areas that consistently surface the findings that change a valuation, written here as questions a buyer should be asking, and as a preview of what a seller should expect to be asked.

01
Technology infrastructure: what exists versus what is documented

Start with the least glamorous question in the whole process: is there an actual, current inventory of hardware, cloud accounts, and software in use, or does "the list" live in one person's memory? A surprising number of mid-market businesses cannot produce this on request. From there, check how much of the stack is running on software or operating systems that are end-of-life or unsupported, whether the network and cloud architecture on paper matches what a technical walkthrough actually finds, and whether backups are tested on a schedule or simply assumed to work because nobody has needed one yet.

If you're buyingAsk for a walkthrough, not a diagram. Diagrams describe intent; walkthroughs describe reality, and the gap between the two is itself a finding.
If you're preparing to sellBuild the inventory before a buyer asks for it. Producing it on request, cleanly, is itself a credibility signal.
02
Security and compliance posture

Multi-factor authentication is either enforced across the business or it is enforced for the systems someone remembered to configure it on, and those are very different postures. Ask when the last penetration test happened, and more importantly whether its findings were actually closed out or filed away. Ask about the history of security incidents, however minor, and how they were handled. A target that has never had an incident is less interesting than a target that had one, reported it correctly, and fixed the underlying cause.

If you're buying"We're PDPA compliant" is a claim, not a finding. Ask for the evidence: the last data protection impact assessment, the breach register, the DPO appointment letter.
If you're preparing to sellCompliance claims a buyer cannot verify in an afternoon get treated as risk, not as reassurance. Have the paperwork ready.
03
Technical debt and architecture risk

Every business carries some technical debt. The question that matters is whether anyone has ever tried to size it. Deloitte's 2026 Global Technology Leadership study puts technical debt at 21 to 40 percent of a typical organisation's total IT spend, and Accenture's 2024 Digital Core research, surveying 1,500 technology executives across 19 industries, found that organisations with an advanced digital core and balanced technical debt achieved 60 percent higher revenue growth and 40 percent higher profits than the rest. Those are large-enterprise studies, but the direction holds at mid-market scale: unpriced technical debt is not a rounding error, it is a drag on growth that a buyer inherits the moment the deal closes. Look specifically for undocumented, bespoke systems with no coverage if the person who built them leaves, and workarounds that exist because "that's how it's always been done" rather than because anyone decided it was the right approach. See how to actually quantify a finding like this before it reaches the negotiating table.

If you're buyingA vague "some technical debt" answer is the finding. A specific, quantified answer, even an uncomfortable one, is a sign the target has actually looked.
If you're preparing to sellNaming your own technical debt before a buyer finds it changes the negotiation from "what else are they hiding" to "what's the plan."
04
Vendor and contract exposure

Change-of-control clauses are the single most overlooked line item in a technology contract, and acquisitions are exactly the event that triggers them. A key MSP, software, or licensing agreement that terminates or re-prices on a change of ownership can land squarely in the middle of an integration when continuity matters most. Check auto-renewal terms and cancellation notice windows, confirm Microsoft and Cisco licensing is actually compliant rather than assumed to be, and map how many critical services depend on a single vendor or reseller relationship with no realistic alternative.

If you're buyingRead the contracts, not the vendor list. A one-line change-of-control clause can be worth more to the negotiation than a page of financial adjustments.
If you're preparing to sellKnow your own change-of-control exposure before a buyer's lawyer finds it during a live deal. It is far easier to renegotiate a contract with time on your side.
05
People and capability: key-person dependency

This is consistently the most underestimated risk in ASEAN mid-market acquisitions, and the most fixable once it is named. Who holds the admin credentials, and is there a documented handover plan if that person leaves the day after close? How many systems does only one person actually understand? Confirm, separately, that employee and contractor IP assignment agreements were properly executed, because "we built it in-house" is not the same as "we can prove we own it," and that gap surfaces more often in smaller ASEAN businesses than most buyers expect.

If you're buyingAsk what happens to institutional knowledge if the two most senior technical people leave in the first month. If nobody has an answer, that is the risk, not a hypothetical.
If you're preparing to sellDocument what is currently only in someone's head. It protects the business regardless of whether a sale happens.
06
Scalability and value creation

The last area is the one buyers most often skip, because it looks forward rather than backward: can the current technology stack absorb two or three times the current volume without a rebuild, or does growth hit a wall that nobody has priced into the investment thesis? This is also where the more interesting upside sits. Licence optimisation, automation of manual processes, and platform consolidation are frequently available and unexploited in a target that has never had a technology-literate owner asking the question. A serious review quantifies both sides: what growth costs to support, and what is already sitting there unclaimed.

If you're buyingAsk what the technology roadmap would look like under new ownership with capital behind it, not just what is broken today.
If you're preparing to sellA credible growth story for the technology function is part of the pitch, not just the financials.

The one most checklists still miss: AI systems

Until recently, AI usage was not a line item on a technology due diligence checklist. In 2026, skipping it is a mistake, and it is also the area where a mid-market ASEAN target is least likely to have a good answer ready, which makes it worth checking specifically rather than folding into the sections above.

  • Training data provenance: if the business has built or fine-tuned any AI feature, where did the data actually come from, and can that be evidenced rather than assumed?
  • Third-party model dependencies: does any AI feature rely on a vendor or open-source model with licensing terms that scale with usage? An acquisition that pushes usage over a threshold can activate obligations nobody budgeted for.
  • Shadow AI: has anyone asked staff what AI tools they already use day to day, and what data goes into them? This is almost always larger and more informal than the target's official answer suggests. It is also the same starting question covered in more depth in Your AI Readiness Checklist.
  • Ownership and governance: if the product itself embeds AI, who owns the model and its outputs, and is there any documented process for checking its outputs for bias or error before they reach a customer?

Why ASEAN is not the same exercise

A due diligence checklist built for a London or Sydney transaction will miss things that matter in Singapore and Malaysia, because the regulatory detail is different and moves faster than a generic template gets updated.

Singapore

The PDPA specifically permits due diligence data transfers under Part 4 of the First Schedule, provided the transfer is limited to what the transaction actually requires, affected individuals are notified, and any data not relevant to the deal is returned or destroyed if it falls through. Two dated items are worth checking directly: private organisations must stop using NRIC numbers as an authentication credential by 31 December 2026, with enforcement starting the following January, and any target that has had a data breach should be able to show it met the requirement to notify the PDPC within three calendar days of assessing the breach as notifiable. The PDPC's own enforcement record shows this is not theoretical: its 2025 action against Marina Bay Sands resulted in a SGD315,000 penalty, the largest since the 2021 amendments, for security governance that existed on paper more than in practice.

Malaysia

The Personal Data Protection (Amendment) Act 2024 changed the compliance picture materially for anyone acquiring a Malaysian target. Data processors, not just controllers, now carry direct legal liability for the first time. Both controllers and processors have been required to appoint a Data Protection Officer since June 2025. The previous cross-border transfer whitelist has been replaced with a risk-based framework, which means a target's existing transfer arrangements may need a fresh assessment rather than a checkbox confirmation. Maximum fines have risen from RM300,000 to RM1,000,000. A target that has not appointed a DPO, or is still relying on the old transfer whitelist, carries a specific, dated, and quantifiable compliance gap.

ℹ️
The pattern worth remembering None of this is exotic. It is public regulatory fact. But a generalist due diligence process built for a different market will not think to ask about an NRIC authentication deadline or a Malaysian DPO mandate, and that is precisely where a mid-market ASEAN deal gets under-diligenced.

What a checklist cannot tell you

Working through the sections above will tell a buyer where to look, and it will tell a seller what is about to be asked. What it will not do is tell either side what a finding is actually worth. A change-of-control clause, an unappointed DPO, or a pile of undocumented custom code are all real findings, but "this is a risk" and "this is worth adjusting the price by a specific amount, or worth walking away over" are two different pieces of work. The first is a checklist. The second requires evidence collection, a consistent scoring method applied across every area, and enough M&A and technical experience to know what a finding actually costs to fix, on a timeline a live deal can survive.

That second piece, turning a red flag into a number both sides can negotiate against, is its own discipline, and it is the subject of a companion piece to this guide. For now, the practical next step if a checklist has already turned up more than a desk review can safely resolve is a structured, evidence-based assessment before signing an LOI, not after.

Frequently Asked Questions

What does a technology due diligence checklist cover in an M&A deal?

Six areas cover most of what buyers check: technology infrastructure (what actually exists versus what is documented), security and compliance posture, technical debt and architecture risk, vendor and contract exposure, key-person dependency, and scalability. In 2026, AI systems have become a seventh area worth checking separately, covering training data provenance, third-party model licensing terms, and shadow AI usage.

Does Singapore's PDPA affect technology due diligence in M&A deals?

Yes. The PDPA permits cross-border due diligence data transfers under Part 4 of the First Schedule, provided the transfer is limited to what the transaction requires and non-relevant data is returned or destroyed if the deal falls through. Separately, buyers should check whether a Singapore target still uses NRIC numbers for authentication, since private organisations must phase this out by 31 December 2026, and whether the target's breach notification process meets the three-calendar-day reporting requirement to the PDPC.

What changed under Malaysia's PDPA amendment that affects due diligence?

The Personal Data Protection (Amendment) Act 2024 introduced direct liability for data processors, not just data controllers, made Data Protection Officers mandatory for both from June 2025, replaced the previous cross-border transfer whitelist with a risk-based framework, and raised maximum fines from RM300,000 to RM1,000,000. A target that has not appointed a DPO or updated its cross-border transfer basis carries fresh, quantifiable compliance risk.

What can a checklist not tell a buyer during technology due diligence?

A checklist tells a buyer where to look. It does not tell them what a finding is worth in the purchase price, whether it is severe enough to walk away from the deal, or how to sequence a fix against a live deal timeline. Turning a red flag into a number that both sides can negotiate against is a separate, evidence-based exercise, typically the job of a structured technology assessment rather than a self-administered checklist.

Sources

Want the real answer before you sign an LOI?

The ScaleASEAN Technology Assessment Framework (STAF) turns exactly these six areas into an evidence-based, IC-ready answer, delivered at deal speed and calibrated for ASEAN mid-market transactions.

Explore STAF More Guides