Cloud consulting practice due diligence

Due diligence on a cloud consulting practice has to reach parts of the business that sit in documents held by third parties and in the heads of named engineers. The work is verification: matching what the owner said to what the paper shows, and deciding what each mismatch means for price and for closing conditions. The sections below take the main areas in turn.

The partner file

Ask for the hyperscaler partner agreement and every amendment, the current tier or competency confirmation, the certification roster with names, dates and expiry, and the record of referrals, co-sell opportunities and marketplace transactions over several years. Reconcile the roster against payroll and contractor invoices: a certified engineer who is on the roster but left the firm is a finding. Then read the clauses on assignment, change of control, notice and termination. Where they leave the question open, a buyer can ask for a written position from the hyperscaler before closing, or for a closing condition tied to the tier.

Searches and registrations

Search for security interests registered against the seller. In Ontario, the Personal Property Security Registration system can be searched on Access Now for a lien filed against a debtor, and the Personal Property Security Act of Ontario governs how a security interest is perfected and how priority is determined between security interests. Other provinces run their own registries; British Columbia’s Personal Property Registry, for example, records security interests and liens against personal property belonging to businesses and individuals under that province’s Personal Property Security Act. The searches follow wherever the seller is located and holds assets. A registration the owner did not mention may point to a lender with a claim over the seller’s assets, which matters for the financing discussion and for what must be discharged at closing. Corporate, litigation and tax-account checks go through the buyer’s lawyer and accountant.

Privacy, incident and breach records

The Office of the Privacy Commissioner of Canada says PIPEDA requires organizations to report breaches of security safeguards that pose a real risk of significant harm to individuals, and to keep records of all breaches for two years, whether or not they present a real risk of significant harm. Unless otherwise prohibited by law, PIPEDA also requires the organization to notify the individual of a breach where it is reasonable in the circumstances to believe the breach creates such a risk. Ask for that record and compare it with the practice’s ticketing and incident history. A gap between the two is a finding about process even if no breach is ever proven. Check how client contracts allocate responsibility for personal information in client environments, because PIPEDA makes an organization responsible for personal information that has been transferred to a third party for processing, and requires it to use contractual or other means to provide a comparable level of protection while the information is being processed. If any client is in Québec, ask how the privacy impact assessment required before personal information is communicated outside Québec was handled, and whether the register of confidentiality incidents that Law 25 describes exists.

Work product and ownership

Request the author of each reusable library, template and script, and the agreement under which each person wrote it. The Copyright Act makes an employer the first owner of a work made by an employee in the course of employment unless an agreement says otherwise, and an assignment is valid only if it is in writing and signed by the owner of the right or the owner’s duly authorized agent, so contractor code without a signed IP assignment is a finding. Read client contracts as well, since some give the client ownership of whatever the firm builds. The finding to look for is a library the owner described as the firm’s own that a client or a former contractor can show is theirs.

Workers and tenure

Check how the bench is engaged. The CRA says that, generally, an employee works under the direction and control of the individual or business who hired them under a contract of service, and that a self-employed worker enters into a contract for services with the person they provide a service to, so engineers who invoice monthly but work under the firm’s direction deserve a closer look from the buyer’s accountant. If staff will transfer, Ontario’s Employment Standards Act, 2000 credits past service with the seller when the purchaser of a business hires them, unless the hiring comes more than 13 weeks after the earlier of the employee’s last day with the seller and the day of the sale, and other provinces have their own rules.

Findings that end deals, and what each one means

• The tier resets on a change of ownership. The margin, leads and marketplace position built into the price may not survive closing, so a buyer may seek a lower price, tie the price to keeping the tier, or withdraw.
• Certifications sit with the founder and no bench stands behind. The business then depends on one person’s qualifications, and a retention arrangement or an earn-out is one possible response.
• An undisclosed cost overrun or misconfiguration at a client. It is a contingent liability, so a buyer may ask for a specific indemnity or holdback and look at what the practice’s insurance covers.
• An incident record that does not match the practice’s own tickets. It points to a process problem worth understanding before any representation about privacy compliance is relied on.