IT is considered to be one of the most challenging areas of integration (or separation) during a Merger or Acquisition transaction. Every business function, including human resources, finance, sales and marketing depends heavily upon systems, data and process automation that IT provides. Consequently, IT becomes a critical path for seamless integration or separation of organizations.

There are four steps to the IT due diligence process:

1. Assessment of the company’s governance standards, IT hardware and software inventory (see IT Asset Management “ITAM”), systems and vulnerabilities.
2. Assessment of all databases and applications in use.
3. Assessment of current IT support services and vendor operations.
4. Analysis of the company’s IT structure and how it enhances their core business activities.

The following reports will be generated

• Operating effectiveness of an entity’s controls over IT infrastructure and systems
• Entity’s compliance with industry standards for governance and cyber-security
• Suitability of the design of the entity’s controls over the system to achieve a sustainable IT infrastructure and effectively serve the core business over the long term

With a focus on

• Security. The system is protected against unauthorized access (both physical and technological).
• Availability. The system is available for operation and use as committed or agreed. With adequate redundancy, backup, disaster recovery system in place, regularly tested.
• Processing integrity. System processing is complete, accurate, timely, and authorized.
• Confidentiality. Information designated as confidential is protected as committed by corporate governance.
• Privacy. Personal information is collected, used, retained, disclosed, and destroyed in conformity with the commitments in the entity’s privacy notice.

Proper IT governance helps ensure that business systems deliver value and that the risks inherent in using technology are managed. IT infrastructure is continually being scrutinized in the light of changing business and regulatory requirements, such as Sarbanes-Oxley, International Financial Reporting Standards (IFRS), and Basel II, as well as the requirement for transparency to shareholders.

For more information, please contact us

ITAM should not be confused with IT Asset tracking – which is the tracking of the physical details of IT assets – hardware and software (e.g., name, model, location, status or licensor, serial number, version number, server location etc.), which are critical for the orderly management, control, planning and budgeting of IT assets required for daily IT operational functions. IT Asset tracking is a subset of IT Asset Management.
IT asset management deals with the financial and contractual details of IT assets supporting the IT business management functions: contract, license, vendor, information security, privacy and risk management and corporate governance of all deployed IT assets.

Main Drivers for ITAM:

• Cost reduction
  Avoid duplication of assets and applications. Business cases for IT Asset acquisition need to be approved by management team for compliance with company goals, operating plans and budgets. ROI calculations must be a part of the regular review process to ensure ongoing compliance after initial costs are approved to monitor upgrades, budgets and scope modifications.
• Asset Control
  Maintain a comprehensive registry of assets, with notifications for upgrades, renewal, cancellation
• Risk mitigation – minimize financial and legal exposure
  Ensure compliance with financial and legal aspects of vendor license and sales agreements, federal and state legislation, industry guidelines and company procedures, including environmental, privacy and information security requirements. Security, backup and disaster preparedness and recovery must be an integral part of the daily operations.

Companies need to establish a centralized, dedicated, and adequately staffed ITAM function, with the mandate and authority needed to meet the identified objectives – directly or by influencing other departments’ practices where necessary. Cross-functional teams, including legal, risk management, information security, privacy, finance, and other related departments, must all be involved in specific ITAM initiatives to ensure that all related key business issues are addressed.

ITAM, properly deployed, results in significant tangible benefits.
Organizations that have been successful in their ITAM initiatives reap remarkable financial, technological benefits and a resultant competitive advantage in their industries.
The key is to get started now – not later. Time is not your friend.

For more information, please contact us