IT due diligence for distribution acquisitions: ERP and data red flags

What should IT due diligence prove at a distribution target?#

IT due diligence at a distribution target should prove three things: the systems that run the business will keep running after close, the history in them is complete and readable, and the company controls the data it relies on. Most technology reviews cover the first point well and the other two lightly.

Distribution businesses make that gap costly. Pricing logic, customer-specific terms, rebate tracking and exception handling often live in ERP customizations, custom reports and side spreadsheets that a standard questionnaire never touches. Request evidence early in the data room rather than relying on management's description.

• 1System list with versions, hosting, support status and the vendor or reseller for each.
• 2Customization and integration map, including EDI connections, e-commerce storefronts and carrier links.
• 3Order and invoice counts by year and by entity, to show where history starts and stops.
• 4Evidence of a recent backup restore for any on-premises database.
• 5Administrator account list, including every outside party that holds credentials.
• 6Customer, supplier, rebate and software agreements that mention data, reporting or confidentiality.

ERP red flags and what to ask about each#

ERP red flags at a distributor fall into three groups: support, customization and extraction. Each one changes what the new owner can do with the system and its history after close.

Extraction deserves a direct test, because built-in exports are often partial. Oracle's NetSuite documentation, for example, says the Full CSV Export does not currently export all data, and lists other routes such as saved search exports, report exports, web services and SuiteAnalytics Connect, noting that ODBC access is an additional service with a fee. Ask the target to show how it would pull complete order, invoice and item history, not just that an export button exists. Have the reviewer open the sample in a way that keeps long IDs intact: the same NetSuite help warns that opening a CSV export directly in Excel loses precision on numbers longer than 16 digits.

How to test for missing order history#

Missing order history shows up as a cliff in record counts by year. Ask the target to run order and invoice counts by year and by entity straight from the ERP, then look for years that drop sharply or begin abruptly. A cliff almost always marks a migration, an acquisition or a purge.

For each cliff, ask where the older records went. The answers fall into a few patterns: migrated in summary form only, kept in an old system that still runs, kept as a database backup, or deleted. Only the second and third can be recovered, and a backup helps only if someone can restore and read it.

Check the help desk, CRM and EDI provider the same way. Service cases, quotes and EDI documents often carry their own retention settings, and an EDI provider may keep document history only for a limited window under its standard terms.

Data rights red flags specific to distribution#

Data rights red flags in distribution come from the many parties that touch an order. Manufacturers may receive point-of-sale or sell-through reports under rebate programs, buying groups may collect member purchasing data, and large customers may treat their order history as confidential information under supply agreements.

None of these arrangements is unusual, and none automatically blocks future use of the target's records. They do need to be listed, because they shape what the company can do with its history and because some may belong on the disclosure schedules of the purchase agreement.

Key-person and reseller dependence#

Key-person dependence is a data risk at most lower-middle-market distributors. One long-tenured controller or IT manager often knows how the custom reports work, what each exception code means and where the old system's backup sits. If that person leaves after close, the history may stay on disk but lose its meaning.

Reseller dependence works the same way. A value-added reseller that built the customizations may hold the only administrator account and the only documentation, and its contract may say nothing about handing either over.

• 1Name every person and outside firm with administrator access, and confirm who can revoke it.
• 2Ask who could explain custom fields and exception codes if the current administrator left.
• 3Check whether the reseller contract includes knowledge transfer and data export assistance.
• 4Plan retention or transition arrangements for the people who hold undocumented knowledge.

Illustrative: an industrial distributor with two ERPs#

Illustrative: a fictional sponsor evaluates an industrial distributor of fasteners and fittings. The company runs an on-premises Epicor instance customized by a single reseller, plus an Acumatica instance at a small add-on it bought several years earlier. Rebate claims to manufacturers are tracked in spreadsheets kept by the controller.

Order counts by year show a cliff at the main ERP's last upgrade; earlier orders exist only in a database backup that has never been restored. The largest customer's supply agreement treats order data as confidential, and the reseller holds the only system administrator account.

The sponsor does not walk away. It makes a restore test of the old backup and a transfer of admin credentials closing conditions, signs a knowledge-transfer agreement with the reseller, schedules the customer restriction for counsel, and puts the add-on's ERP history and the rebate spreadsheets into the 100-day data plan.

How to classify findings: deal issue, terms issue or 100-day item#

Findings from IT due diligence should be classified by what they change in the deal. A clear classification stops red flags from either derailing a sound acquisition or disappearing into an integration backlog.

Records that pass diligence also inform later options. Under the SourceX Enterprise Data Value Framework, rights, recency, data cleanliness and preparation cost all affect what operational records are worth, so the same diligence notes help a new owner decide whether exception and claims history merits a metadata-only fit check after close.