What Every Investment Committee Should Ask About Technology Risk

1. What are we inheriting, verified rather than represented?

Management representations and completed questionnaires describe what the target believes. Verification describes what exists. The gap between the two is where post-close surprises live, and it is widest in companies with no dedicated security function, where the person answering the questionnaire has no way to know.

A good answer distinguishes between what was independently validated, what was accepted on representation, and what could not be examined in the time available.

2. What will remediation actually cost, and whose model carries it?

Findings without economics are not decision inputs. Each material gap should carry an estimated cost, a duration, and a judgment about whether it belongs in the buyer's operating model, the purchase price, or a closing condition.

This is also where sequencing matters: work required before connection is fundamentally different in urgency and cost from work that can run across the first year.

3. What must be true before this environment connects to ours?

Every acquisition eventually reaches a connectivity decision. The committee should know, in advance, what the minimum control requirements are and who has authority to decide the environment has met them.

Absent that, the decision is made informally under schedule pressure, which is the origin of the most common Day-1 mistake.

4. If this company had an incident during the hold, what breaks?

A scenario question, not a probability exercise. If the target suffered a ransomware event six months post-close, what would it cost, what would it delay, which customers or contracts would be affected, and does the insurance in place respond?

Committees that ask this find the concentrated risks quickly: single points of failure, untested backups, regulated data in unexpected places, and customer contracts with security commitments nobody has read.

5. At exit, what will the next buyer's diligence find?

Whatever is not addressed during the hold period returns as a valuation argument from a buyer with every incentive to press it. Technology debt is one of the few risk categories where the cost of deferral is nearly certain to be higher than the cost of the fix.

Sponsors who work this question backward from exit tend to fund remediation earlier and more cheaply. See Portfolio Services and Sell-Side Readiness.