IT support & break-fix shop due diligence

A shop with no contract book cannot be checked by reading contracts. The work is reconstruction: rebuilding who the clients are, what they pay and whether anyone but the owner can serve them, from records the shop already keeps. This guide is for a buyer under a signed letter of intent, when price and structure are agreed in principle and the aim is to confirm them. It lists what to ask for, what to search, and what a finding means when it turns up. The general process is covered in our due diligence entry, and this page covers what is specific to a break-fix shop, where the same finding can be harmless in one business and a reason to walk away from another.

Rebuild the client base from invoices and bank deposits

Start with invoice history by client for several years and tie it to the bank deposits that paid it. The aim is a table showing, for each client, the years in which they called, what they paid and which technician did the work. Clients who stopped calling matter as much as those who kept calling, since they show how long a relationship really lasts. Revenue that cannot be traced to an invoice and a deposit cannot be verified, and a buyer may have no basis to pay for earnings it cannot see. A client list that looks strong but proves to depend on a few accounts, or on work billed to the owner’s relatives and friends, is a finding that can bear on price.

Prove the handover works by trying it

Ask for the credential and documentation set, then have a technician who is not the seller use it to reach a sample of client environments while the seller watches. What fails is the finding. PIPEDA requires personal information to be protected by safeguards appropriate to its sensitivity and gives passwords and encryption as examples of technological measures, so it is also worth asking where credentials are stored, who else holds them and whether any former staff member can still log in. Remote-support and monitoring tools deserve the same test: confirm which account owns each tool, whether the licence can be moved to the buyer and whether logins have ever been shared. An owner who alone knows the passwords is a finding that may call for a closing condition or a price discussion rather than a footnote.

The shelf of other people’s devices

Break-fix shops hold customers’ property, so diligence should include walking the shelves. Count the devices, match each to a work order and note how long it has been there. In Ontario, the Repair and Storage Liens Act gives a repairer, absent a written agreement to the contrary, a lien against an article it has repaired for an amount tied to the repair, and lets the repairer keep the article until that amount is paid. A lien claimant with a right to sell must first give notice of its intention to sell. Whether a shop that sold or discarded unclaimed devices without that process, or that has no written drop-off terms, has exposed itself to a claim by the device’s owner is a question for a lawyer. The devices also hold data. PIPEDA’s retention principle says personal information no longer needed for its purposes should be destroyed, erased or made anonymous, so a shelf of forgotten drives is a privacy finding as well. The Act cited here is Ontario’s, and a buyer elsewhere confirms which rules govern in that province.

Registrations against the shop’s assets

Search for security interests registered against the seller and its trade names before settling what is being bought. Ontario’s Personal Property Security Act sets up a registration system for security interests in personal property and separates equipment from inventory: parts held for sale, and materials used or consumed in the business, are inventory, while bench machines and tools are equipment. A bank facility, an equipment lease or a supplier’s purchase-money security interest could all appear. In an asset purchase, it is worth settling before closing how each registration that covers assets being bought will be discharged or dealt with. Other provinces run their own personal property security regimes, so a buyer outside Ontario searches the registry that applies there.

Incident records, privacy and contractor status

Ask to see the shop’s record of breaches of security safeguards. The Office of the Privacy Commissioner says the law requires such records to be kept for two years, whether or not a breach posed a real risk of significant harm, and that it can ask for them. An empty record is consistent with a clean history and with a shop that never checked, so ask how the shop would have noticed a lost laptop or a compromised account. Where Quebec’s private-sector privacy law applies, the Commission d’accès à l’information says organizations must keep a register of confidentiality incidents and give it to the Commission on request. Then ask for the contractor agreements and look at how technicians are actually directed, because the CRA says all the facts of a working relationship decide employment status, not just the parties’ intention.

Findings that can end a deal

The findings below can make a buyer reconsider the deal rather than adjust the price.

• Revenue that does not reconcile to invoices and deposits.
• Credentials held by one person who will not or cannot hand them over, or that fail when tested.
• A seller unwilling to sign a non-compete or non-solicit when the clients are the main thing being bought.
• Incidents involving client data, recorded or not, with no sign that clients were told.
• A registered security interest over assets being bought that the secured creditor will not discharge at closing.