However, it does help to have a plan for how IT due diligence should be undertaken. We split our plan into two complementary components; a process and a framework, The Process defines and drives the work as a series of activities and the framework structures the output of these activities.

We have found that a framework that takes as its focus the information/data that the organisation’s IT edifice is charged with maintaining offers the best perspective on which to build a strong IT due diligence report.

To this core we have added a set of interlocking views covering, process, people and technology that collectively provide complete coverage of the IT related issues, risks and opportunities. These views provide a different perspective into the IT world and allow cross-checking to be performed to highlight areas of disagreement.

Without a clear framework an IT due diligence activity becomes a random collection of interviews and ad-hoc investigations lacking clear rationale and the ability to cross-check information for completeness.