The target’s balance sheet shows Rs 30 crore of IT assets. The management presentation mentions “robust technology infrastructure.” The IT team describes the environment as “stable and adequate.”
What the balance sheet does not show, what the management presentation does not mention, and what the IT team may not fully acknowledge, is the accumulated technology debt: the cost of deferred upgrades, unsupported software, aging infrastructure, cybersecurity gaps, manual workarounds and integration requirements that the buyer must fund in the 12 to 36 months after close.
Technology debt is not a balance-sheet liability. It is a hidden cost of ownership. The buyer pays the agreed purchase price and then discovers, during integration, that the technology environment requires Rs 20 crore to Rs 80 crore of additional investment that was not visible in the financial statements, not disclosed in the management presentation and not factored into the purchase price.
The Technology Debt Test identifies, quantifies and categorises these hidden costs before signing, so the board can see the total cost of ownership, not just the acquisition cost.
Where Technology Debt Accumulates
Legacy systems (estimated remediation: Rs 5 to 50 crore)
Applications built on technology that is no longer supported by the vendor, no longer updated with security patches and no longer compatible with modern integration standards. The system functions today. It will fail in a manner that cannot be quickly repaired, because the expertise to maintain it is declining and the vendor has moved on.
The forensic question: for every significant application, when was it last updated? Is it on the vendor’s current support roadmap? What happens when the next operating system update breaks compatibility? How many people in the organisation (or in the market) can maintain it?
A system that is five years beyond its vendor’s end-of-support date is not “stable.” It is a failure waiting for a trigger.
ERP limitations (Rs 10 to 100 crore)
An ERP implemented for a smaller, simpler version of the business, stretched through years of customisation, add-on modules and workarounds to accommodate growth. The system technically operates. It produces financial statements. It processes transactions.
But it cannot produce management information at the speed and granularity the buyer requires. It cannot integrate with the buyer’s systems without middleware or replacement. Its customisations have created a version so far from the standard product that upgrades are impossible without a reimplementation. The data it contains is structured in ways that make migration to the buyer’s platform a multi-quarter project.
Cybersecurity gaps (Rs 2 to 10 crore remediation, Rs 1 to 3 crore annual recurring)
Unpatched systems. Default passwords on administrative accounts. No multi-factor authentication. No endpoint detection and response. No formal incident-response plan. No regular penetration testing. No data classification framework. No security awareness training.
The target has not experienced a material breach. The absence of a detected breach is not evidence of security. It may be evidence that the target lacks the monitoring capability to detect one.
Post-close, the buyer assumes responsibility for the target’s data, its customers’ data and its regulatory compliance. A cybersecurity remediation programme is not optional. It is a cost the buyer will incur regardless of whether it was budgeted.
Data quality (Rs 1 to 5 crore)
Customer databases with 30% duplicate records. Vendor masters with inconsistent naming. Financial data that requires manual reconciliation because two systems do not share a common identifier. Operational data that exists in personal spreadsheets rather than enterprise systems.
Data quality affects every post-close activity: customer communication, financial consolidation, regulatory reporting, management information and operational integration. Poor data quality extends integration timelines, increases error rates and consumes management attention.
Integration requirements (Rs 5 to 30 crore)
The buyer’s ERP must connect to the target’s. Or replace it. The buyer’s financial reporting must consolidate the target’s data. The buyer’s CRM must absorb the target’s customer records. The buyer’s HR system must onboard the target’s employees.
Each integration requires technical work (data mapping, middleware, APIs), process work (harmonising procedures, retraining users) and management work (coordinating timelines, resolving conflicts, managing change). The cost depends on the complexity of both environments and the degree of harmonisation required.
Software licences (Rs 1 to 5 crore)
Duplicate licences (both buyer and target use the same software, requiring consolidation). Vendor contracts with unfavourable terms (minimum commitments, early-termination penalties). Licences that do not transfer on change of control (requiring new procurement). Open-source software used without licence compliance (creating legal exposure).
The Quantification Framework
In Northrop Management Private Limited’s technology diligence assessments, every finding is translated into financial terms using a structured framework.
Technology issue → remediation scope → implementation timeline → resource requirement → estimated cost → one-time vs recurring → confidence level → scenario (base/downside/severe)
The output: a technology investment schedule categorised by urgency.
Must-do (legal, regulatory or operational necessity): Cybersecurity remediation. Licence compliance. End-of-support system replacement. Regulatory-mandated data protection. These costs will be incurred regardless of preference. They are hidden purchase price.
Should-do (significant risk reduction or efficiency gain within 12 months): ERP upgrade or integration. Data quality remediation. Integration programme. IT talent gaps. These costs are commercially necessary for the acquisition to deliver its projected returns.
Nice-to-do (desirable but deferrable beyond 12 months): Technology modernisation. Cloud migration. Advanced analytics. Process automation. These costs can be sequenced after the must-do and should-do items are addressed.
The must-do total is the minimum hidden cost. The must-do plus should-do total is the realistic hidden cost. The full total is the maximum technology investment the acquisition requires.
The three-scenario estimate
Base case (50% probability): Integration proceeds as planned. Must-do: Rs 12 crore. Should-do: Rs 18 crore. Total: Rs 30 crore.
Downside (35% probability): Data quality is worse than assessed. Legacy systems require replacement rather than upgrade. Vendor contracts have unfavourable termination terms. Total: Rs 45 crore.
Severe downside (15% probability): ERP must be replaced rather than integrated. A cybersecurity incident occurs during integration. Key IT personnel depart. Total: Rs 65 crore.
Probability-weighted expected cost: (0.50 x 30) + (0.35 x 45) + (0.15 x 65) = Rs 15 + Rs 15.75 + Rs 9.75 = Rs 40.5 crore.
The Rs 40.5 crore expected technology cost should be presented to the investment committee alongside the purchase price. The board should see: “The purchase price is Rs 1,200 crore. The expected technology and integration cost is Rs 40.5 crore. The total cost of ownership is Rs 1,240.5 crore.”
Ashish Chaudhary, Founder and Managing Director of Northrop Management Private Limited, frames the estimation discipline directly: “Do not stop at identifying a technology problem. Estimate what it will cost to fix, how long it will take and who will bear that cost. A technology diligence that identifies ‘legacy ERP’ without estimating the Rs 30 crore replacement cost has identified a finding without quantifying its financial consequence. The board needs the number, not the label.”
Questions for the Boardroom
- What is the estimated technology and integration cost the buyer will incur in the 12 to 36 months after close, and has this been presented alongside the purchase price?
- Which technology costs are must-do (the buyer has no choice) versus should-do (commercially necessary) versus nice-to-do (deferrable)?
- Has the target’s cybersecurity posture been independently assessed, and what is the estimated remediation cost?
- Can the target’s ERP integrate with the buyer’s systems, or will it require replacement, and at what cost?
- Under the downside technology scenario, does the acquisition still generate returns above the buyer’s cost of capital?
Practical Checklist
Assess: Age, support status and upgrade path of every significant system. Cybersecurity posture against a recognised framework (NIST, ISO 27001). Data quality across critical databases. Integration requirements and complexity. Licence compliance and transferability.
Quantify: Estimated cost by category (legacy, ERP, security, data, integration, licences, talent). One-time versus recurring. Three scenarios (base, downside, severe). Probability-weighted expected cost.
Categorise: Must-do, should-do, nice-to-do.
Present: Expected technology cost alongside the purchase price in the investment committee memo.
Negotiate: Must-do costs as a price adjustment. Specific warranties on system functionality and licence compliance. Technology-related indemnities for undisclosed issues.
Closing Implication
The purchase price is what the buyer negotiates. The technology debt is what the buyer inherits. The two together are the total cost of ownership. A board that sees only the purchase price has approved half the cost. A board that sees both has approved the transaction with full information about what the acquisition will actually cost.