Technology Due Diligence: The Quality of Earnings Report Nobody Runs on IT
The short answer: Technology due diligence is a structured review of a target company’s IT environment, run after the LOI and alongside the quality of earnings work, that tells you who controls the systems, what they will cost to keep running, and what you will have to fix in your first year. Almost nobody runs it on a small business deal and it is one of the most reliable sources of post-close surprises.
I see this from both sides. I was a self-funded searcher before I became the owner of IT Total Care, a managed IT and cybersecurity firm in the San Francisco Bay Area. Today a good share of my conversations are with searchers under LOI and the pattern is consistent: buyers spend real money on a quality of earnings report, a legal review, and an insurance review, then treat the IT environment as something to sort out after close.
Chris Williams and the team at System Six have written some of the clearest material I have read on what a quality of earnings report is for. I want to borrow that frame, because technology due diligence does for the IT environment roughly what a QoE does for the income statement. It separates the version of the business the seller describes from the version that will actually hold up once you own it.
What a quality of earnings report will not tell you
A QoE normalizes earnings. It adjusts for owner compensation, one-time expenses, and revenue that will not recur, so you and your lender can underwrite a real number. What it is not designed to do is ask whether the business has been underinvesting in the systems that produce those earnings.
That underinvestment is common in the years before a sale. An owner planning an exit has little reason to replace aging laptops, move off an unsupported server, or pay for security tools that only show up as a cost. Every dollar not spent flatters the trailing numbers you are paying a multiple on. The bill arrives after close and you pay it out of cash flow that is already servicing an SBA loan.
That is what tech debt in an acquisition really is. It is not a line item on anyone’s balance sheet. It is deferred maintenance on the operating system of the business and the standard diligence stack is not built to find it.
What technology due diligence actually looks at
The example I know best is a home care, home health, or home hospice agency, which are increasingly showing up on searcher target lists. If you are buying a home care agency, IT matters more than usual. A typical agency has a small office team, dozens or hundreds of caregivers in the field, and a business that runs almost entirely on software. The eight areas below are the core of any IT due diligence checklist I would use.
1. Who owns the accounts
Start with control, not security. Who is the registered owner of the domain? Whose personal email is the administrator on the Microsoft 365 or Google Workspace tenant? Is the scheduling platform, whether that is AxisCare, WellSky Personal Care, or something else, contracted in the entity’s name or the owner’s? In small businesses these are often tied to the seller personally and nothing in the purchase agreement moves them automatically. Miss them and you can end up asking a departing seller for the keys to your own company.
2. Who still has access
Caregiver turnover in home care is high and offboarding is often informal. It is normal to find former caregivers and office staff with active logins, shared credentials passed around the office, and a single password protecting far too much. Every one of those is an open door into client data you are about to be responsible for.
3. What devices exist
Most agencies cannot produce an accurate device list. Office laptops were bought one at a time and caregivers often clock in for electronic visit verification (EVV) on their personal phones. You want to know how many devices touch client data, who owns them, how old they are, and whether any of them can be locked or wiped remotely.
4. Whether the data would survive a bad day
Ask when a backup was last restored, not whether backups exist. Ask who can export client and caregiver records from the scheduling and EVV platform if the vendor relationship ends. Platforms like WellSky, AxisCare, MatrixCare, and KanTime hold the most important data in the business, and the agency’s rights to that data are defined by a contract most owners have never read.
5. The compliance posture
If an agency bills Medicare, Medicaid, or insurance electronically, it is almost certainly a HIPAA covered entity, and so is its new owner. Ask for the most recent HIPAA security risk analysis. If there is not one, that is a finding in itself.
6. The contracts
Look for change of control clauses in software agreements, multi-year auto-renewals, and subscriptions billed to a personal credit card. None of these is dramatic on its own. Together they decide how smooth your first ninety days are.
7. Hardware age
Get a report on the age of the company’s hardware: computers, mobile devices, servers, and networking gear. This will give you the clearest picture of how much money will need to be spent in your first year to simply keep the business running.
8. Cybersecurity posture
Find out what cybersecurity tools are in place. In the home care, home health, and home hospice space this is critical because lack of certain tools can lead to a HIPAA violation. Even if your target company doesn’t have compliance requirements, understanding how much protection is in place for the purchase you’re going to be putting a personal guarantee on is critical.
How to put a number on tech debt before you sign
The goal is not a list of problems. It is a cost estimate you can negotiate with. I sort findings into three buckets:
- Fix at close: account ownership, administrator access, and removal of former staff. These are cheap and urgent, and ideally the seller cooperates on them as a closing condition.
- First ninety days: multi-factor authentication, tested backups, a real device inventory, and basic security controls. Budget these into your post-close plan.
- First year: hardware replacement, platform consolidation, and anything that needs a proper project.
Put a range against each bucket rather than a single number, then treat the total the way you would treat a working capital shortfall. Depending on the size, it can support a price adjustment, a holdback, a larger seller note, or simply a more honest first-year cash plan. The worst outcome is discovering it in month two, when it comes out of the cushion you built for everything else.
When to run it, and how
Run technology due diligence after the LOI, in parallel with the QoE and inside the same diligence window. It does not need to be disruptive. Most of what matters can be gathered through a short questionnaire and one conversation with whoever manages the seller’s IT, whether that is an outside provider, an office manager, or a relative of the owner who set up the network years ago. Some managed IT providers, IT Total Care included, offer a free or low-cost technology review for searchers. Feel free to contact IT Total Care if you’d like to learn more.
If you want a structure, the simplest one I know is to conduct a technology business review against the target. It is the same review a managed IT provider runs with an existing client, covering assets, security, backups, licensing, and budget, pointed at a company you do not own yet.
The takeaway
You would not close without a quality of earnings report. The IT environment deserves the same treatment for the same reason: the seller’s version of the business and the version you inherit are rarely identical, and the gap is far cheaper to find before you sign than after. Technology due diligence is how you find it.
About the author
Brendan Duebner is the President of IT Total Care, a veteran-owned managed IT and cybersecurity provider based in Foster City, California, serving businesses across the San Francisco Bay Area. A former self-funded searcher, he works with acquisition entrepreneurs on IT diligence before and after close.
