Before the Deal Closes: Seven Systems Questions That Predict Your Integration Bill

In merger and acquisition due diligence, financial and legal review are mature disciplines with established playbooks. Technical due diligence, by contrast, is frequently an afterthought — a two-week exercise that produces an application inventory and a network diagram, and calls it analysis. The result is predictable: post-close integration budgets that balloon, timelines that slip by quarters, and CIOs explaining variances to a board that was told this would be straightforward.

The gap between a clean-looking inventory and an accurate integration estimate comes down to the questions asked — or not asked — before the term sheet is signed. Seven questions, in our experience, separate realistic integration plans from optimistic ones.

1. How Many ERP Instances Are Actually in Production?

Almost every target will report a single ERP. Fewer will volunteer that "single ERP" means one core instance surrounded by regional instances, a legacy system still running payroll, and three shadow databases feeding departmental reporting.

Red flag answer: "We're mostly on the current version."

Why it matters: ERP consolidation is typically the single largest line item in an integration budget. Every additional instance adds months of data mapping, master data harmonization, and parallel-run coordination. If the answer surfaces more than two production instances, assume the integration estimate needs a floor of 18 months, not 9.

2. Where Does Identity Live — and How Many Places?

Identity management sprawl is the quiet tax on every integration. Ask how many directories, SSO providers, and local authentication stores are in active use, and whether service accounts are documented or tribal knowledge.

Red flag answer: "Active Directory, mostly" — followed by hesitation when asked about acquisitions of their own.

Why it matters: Day-one access, SSO federation, and M&A-era account cleanup are unglamorous but unforgiving. Every additional identity store extends the security integration timeline and expands the audit surface. Undocumented service accounts are a compliance finding waiting to be discovered by your auditor, not theirs.

3. What Percentage of Workloads Run in a Data Center the Target Owns?

On-premises footprint is not inherently a problem — but owned data centers with end-of-life hardware, expiring leases, and no documented refresh plan become the acquirer's capital problem at closing.

Red flag answer: A colocation contract with 14 months remaining and no renewal pricing, paired with hardware averaging five-plus years old.

Why it matters: This question converts directly into either a cloud migration program, a hardware refresh, or a colocation transition — three expensive paths. It shapes whether your post-close cloud strategy absorbs a forced migration on someone else's timeline.

4. Is the Network Architecture Designed for Integration or Isolation?

Ask about network segmentation between business units, third-party connections, and — critically — any standing connectivity to former parent companies, partners, or affiliates.

Red flag answer: Flat network segments shared with a former parent, or dedicated circuits to entities not named in the deal.

Why it matters: Untangling shared infrastructure is slow, politically sensitive, and security-critical. Standing connectivity to non-deal entities can delay network segregation for a year or more and creates exposure you inherit at closing.

5. How Is Data Actually Governed — Not How Is It Supposed to Be Governed?

Request the data dictionary, then ask who maintains it and when it was last updated. Ask where customer data physically resides, including backups, and whether any of it crosses state or international boundaries in ways that trigger regulatory obligations.

Red flag answer: "The data dictionary is in progress," or backups stored in a jurisdiction no one in the room can explain.

Why it matters: Data residency and governance gaps convert into compliance remediation programs. In US-regulated industries — healthcare, financial services, insurance — these are not line items; they are gating items.

6. What Does the IT Organization Actually Look Like Below the Leadership Layer?

The org chart shows a CTO and directors. The question is who holds the operational knowledge: how many system administrators, how many contractors, and how many systems with exactly one person who understands them.

Red flag answer: Heavy contractor dependency, or key systems maintained by individuals with no documentation and no retention agreement.

Why it matters: Retention risk is integration risk. If three people hold the knowledge to operate revenue-critical systems and none of them stay past the earn-out, your integration plan now includes reverse-engineering production environments under pressure.

7. When Was the Last Disaster Recovery Test — With Evidence?

Every target says they have a DR plan. Ask for the date of the last full failover test, the results, and who signed off.

Red flag answer: A plan last tested as a tabletop exercise three years ago, or backups never validated through restoration.

Why it matters: Untested DR is a discovered liability. Post-close, you will either fund a real DR program or accept the risk on your books — and acquirers rarely get to choose the timing of the outage that reveals which.

From Questions to Cost Model

Individually, these answers are informative. Collectively, they are a cost model. A target with two ERP instances, three identity stores, an owned data center, and untested DR is not a 9-month integration — it is a 24-month program with a security workstream running in parallel, and the diligence process should say so before the purchase price is finalized.

The most effective acquirers treat these questions not as a checklist but as a structured technical diligence workstream, run in parallel with financial review and weighted accordingly in valuation. Integration risk is acquisition risk. Pricing it at close — rather than discovering it in month four — is the difference between a deal that performs and a deal that gets explained.