Web development agency due diligence

Once a letter of intent is signed, due diligence on a web development agency is an exercise in turning claims into evidence. The seller says the agency controls its client accounts, owns its code, has recurring contracts and runs clean sites. Each of those can be tested, and each can fail in particular ways. This guide lists what to ask for, what to search and what a failure can mean for price, closing conditions or the decision to go on. It assumes you have already judged the opportunity as described in buying a web development agency in Canada. Your lawyer and accountant should run the formal process; this is a map of where agencies can break.

Test control of the accounts by using them

Ask for a written inventory of every domain, hosting, DNS, platform-partner, payment and code-repository account, then test it. Have the seller demonstrate a login to a sample, look up the registrant on each domain and check who the billing contact and card holder are. Where accounts sit in the name of the founder or a former employee, treat the fix as a closing condition: transfer before closing, or do not close. A credential held personally by someone who is leaving is the kind of finding that can end a deal outright, because it means the agency may not control the sites it is being paid to look after. Also confirm that no account sits behind a two-factor device that only one person owns.

Trace who wrote the code and who owns it

Request every employment agreement, contractor agreement and assignment that touches code, design or copy, plus a list of third-party themes, plugins, fonts and stock assets with their licence terms. Under the Copyright Act the author is generally the first owner of a work, an employer is first owner of what an author employed under a contract of service or apprenticeship makes in the course of that employment unless an agreement says otherwise, and an assignment is valid only if it is in writing and signed by the owner or the owner’s duly authorized agent. Moral rights cannot be assigned but may be waived. The chain of title is therefore only as good as its paperwork. If a contractor wrote the agency’s core templates with no signed assignment, the agency cannot sell what it does not own; possible remedies are obtaining assignments before closing, adjusting the price or carving the asset out. The answer on intellectual property due diligence covers the general method.

Test the retainer base against the contracts

Match every “recurring” client in the financials to a signed agreement and to payment history. Read the term, the notice period, the scope, any assignment or change-of-control wording and the termination rights. Three findings are possible. Retainers cancellable at will on short notice are recurring only in habit, and a buyer may value them closer to project income. Agreements that cannot be assigned without consent leave part of the price at risk until each client agrees. And revenue labelled maintenance that is really unbilled support or occasional project work will not survive a re-cut of the numbers. Ask for client-by-client revenue over several years rather than a summary, so that churn becomes visible.

Audit a sample of the portfolio, not the agency

The agency’s own books may not reveal technical debt, but the client sites can. Sample a cross-section and record, for each, the platform and its version, which plugins and themes are installed and whether they are updated, whether backups run and have ever been restored, and whether anyone has reviewed security. Then count the sites on unsupported versions, because remediation is a real cost that someone must carry. A few neglected sites can be a price adjustment. A pattern of them can mean the maintenance clients are paying for is not being delivered, which can raise liability questions as well as cost and is one to discuss with counsel.

Privacy and incident records

Ask for the agency’s privacy policy, its data-handling terms with clients, a list of the vendors that touch client data and its record of security incidents. The Office of the Privacy Commissioner says organizations must keep records of all breaches of security safeguards, whether or not they must be reported, and that the records must carry enough detail for the Commissioner to judge whether the risk was properly assessed. An agency with no records at all is not an agency with no incidents; it is one that cannot show it looked. PIPEDA also keeps an organization responsible for information it has transferred to a third party for processing, so ask what the agency’s hosting and email vendors are bound to do. For Quebec work, the Commission d’accès à l’information says organizations must keep a register of confidentiality incidents and give it to the Commission on request.

Searches, claims and status questions

• In Ontario, the Personal Property Security Act lets any person, on payment of the required fee, request a search of the business debtor name index and receive a certificate from the registrar. Search the agency and any former names. Outside Ontario, ask counsel which registry to search; in Quebec, the Civil Code provides for a register of personal and movable real rights.
• Ask whether the agency has claimed Scientific Research and Experimental Development incentives. The Canada Revenue Agency describes these as claims submitted with the income tax return, and its program page covers what happens when a claim needs a review. If credits form part of the seller’s earnings, ask to see the filings and any review correspondence.
• Read a sample of contractor agreements against how the work is actually done. The Canada Revenue Agency looks at all of the facts, not just the intention, when deciding whether a worker is an employee or self-employed.
• If the agency employs people in Quebec, check the Office québécois de la langue française business pages, which link to published lists of certified businesses and of businesses not compliant with the francisation process.
• Ask for the agency’s insurance policies, including any professional or cyber cover, and find out whether they can be assigned or must be replaced.

What a finding means

Not every finding ends a deal, and it helps to sort them. Some can be fixed before closing, such as moving accounts or collecting assignments, and belong in the closing conditions. Some can be priced, such as technical debt or informal discounts, and belong in the price or a holdback. A few change the question altogether, such as concealed incidents or retainers that turn out not to exist, and are a reason to reopen the business case with your advisors before going further.