Technology shapes the scope, strategy and tactics of due diligence.
By Jim Jeffries, Chairman of the M&A Leadership Council
What does the future of proper due diligence look like? In the past decade, M&A professionals have moved beyond checklists to take a more robust, strategic approach to due diligence. Meanwhile, technology has come to play an increasingly important role in due diligence, both in the form of tools for M&A practitioners and as a source for identifying potential risks and issues. While exposure to cyber breaches has become a critical issue, we cannot ignore social media or artificial intelligence.
Cybersecurity Takes Center Stage
U.S. Deputy Treasury Secretary Sarah Bloom Raskin called cybersecurity “the most pressing operational risk of our time.” Indeed, cyber attacks are no longer a distant fear for the future, but a real and constant threat. There are about 1.5 million cyber attacks per year, and Council partner BDO estimates that the global cost of breaches will reach $2.1 trillion by 2019. Yet the M&A community is still catching up in its approach to cybersecurity assessments.
The most common mistake: assuming that a conventional IT audit will uncover cybersecurity risks. While an IT audit provides useful insight on the quality of a Target company’s preexisting IT infrastructure, it offers little information about information exposures. This is where IT due diligence must reach far beyond the IT department to evaluate multiple factors:
- Existing and potential risks: It’s critical to first identify any current or past breaches. The next step is to scrutinize every technological component of the business environment for potential vulnerabilities. Identify the critical IT assets and the potential consequences if these assets are compromised.
- Culture of cybersecurity: According to a recent survey by Council partner Willis Towers Watson, employees can be the greatest source of cybersecurity risk. Cybersecurity is everyone’s responsibility, and employees should understand their critical role in protecting the company’s data. Evaluate the quality of the company’s cybersecurity training, along with its policy, procedures and reporting.
- Cybersecurity maturity: Companies with robust cybersecurity knowledge and protocols generally assume much less risk from a potential cyberattack. These companies usually conduct their own cybersecurity audits on a regular basis and can provide a recent audit conducted by an independent third party. If this doesn’t exist already, negotiate to have it done before moving beyond due diligence.
The due diligence team of the future will integrate these considerations into their process, along with rigorous documentation of cybersecurity risks. Using a formalized process will help ensure that nothing gets overlooked.
Social Media Stimulates Deal Sourcing
As a robust social media presence has become an indispensable marketing tool, it has also made its way into the due diligence process. M&A leaders have long been using social media to evaluate potential targets, gleaning information about market sentiment, employee satisfaction and even unauthorized use of a target’s intellectual property. Furthermore, a target’s social media policy, along with how that policy is enforced and monitored, can also provide key insights.
In addition to offering a useful source of due diligence information, social media platforms also provide deal sourcing information. According to a survey by Council partner Intralinks, 55% of dealmakers source deals online. Twitter and LinkedIn were named the most common online deal sourcing platforms. However, the emergence of specific online deal sourcing platforms promises to change that trend, and may even impact overall M&A deal activity.
- Improved deal capacity: Approximately 39% of Intralinks survey respondents noted that online deal sourcing has helped them close deals faster, paving the way for deal teams to complete more deals without additional resource requirements.
- More cross-border deals: Online deal sourcing platforms remove many of the barriers to identifying overseas targets, and many M&A experts predict that cross-border deal activity will pick up in the coming years.
- An uptick in smaller deals: Because online deal sourcing platforms are open to businesses of all sizes, there will likely be an increase in M&A deals among smaller companies that previously lacked their own “little black books” of M&A contacts.
Internal social media such as company intranets, along with social media-inspired technology like virtual data rooms, promise to further improve M&A productivity. These platforms also give M&A deal teams more opportunities to create transparency on both sides of every potential transaction, fostering greater trust and more effective integration. For example, deal sponsors and key leadership can post blog articles and other updates explaining the benefits of the deal to critical stakeholders.
Yet social media, like other technologies, comes with its own set of risks that M&A professionals must navigate and assess. Perhaps most pressing of these is the potential risk of breaching confidentiality. A few common causes of confidentiality breaches include the following:
- Employees see that a prospective acquirer has viewed their LinkedIn profiles. The easiest way to avoid this pitfall is to check target employees’ LinkedIn profiles while signed out of the platform.
- An employee under NDA carelessly posts something on his or her personal social media accounts, which is then seen by other employees
- A spike in website views or other analytics indicates a sudden new interest in the company. These data can often be paired with reverse IP address identification, giving the target’s analytics team an easy way to identify a prospective acquirer.
Moving forward, M&A professionals must incorporate social media into the diligence process as both a tool and a potential risk.
Artificial Intelligence Comes to Due Diligence
Technology also has the potential to vastly improve the due diligence process, and artificial intelligence (AI) is the perfect example of an emerging technology that promises to revolutionize M&A. AI technology is still nowhere near sophisticated enough to replace humans entirely, but it has already demonstrated immense value. Due diligence firms that have implemented AI report that the technology reduces due diligence time and cost by anywhere from 30% to 90%. From automatically gathering and analyzing legal documents, to redacting proprietary information and highly personal HR information, AI has a wide variety of due diligence applications.
Yet while artificial intelligence is hailed as a boon to due diligence professionals from virtually every discipline, it isn’t without its own set of risks:
- Technical shortcomings: An algorithm failure or insufficient machine learning could lead to errors and misinterpretations. This is especially true in situations where documents are not highly standardized and unambiguous.
- Security risks: Incorporating any new technology also means incorporating a new cybersecurity risk. When AI is used for due diligence, a cybersecurity breach could result in the exposure of highly sensitive or proprietary information secured in the virtual data room.
- Breaches of privilege: In some jurisdictions, the use of AI for the review of certain kinds of documents can qualify as a breach of attorney-client privilege. This is an especially important consideration in cross-border M&A deals.
This means that M&A teams will need to add AI to their IT due diligence list. Acquirers must evaluate the sophistication and security of any AI technology. That includes not only those implemented by the target company, but also the AI used by the target’s vendors, suppliers and sometimes even customers; because all these systems interact in the business ecosystem thanks to the Internet of Things (IoT), AI used anywhere in the supply chain can impact the target company, and in turn the acquirer.
To learn more about tools, trends and best practices in due diligence, please join us for The Art of M&A Due Diligence. In this unique workshop environment, you’ll learn from leading M&A experts and network with colleagues.