--- titel: "IT due diligence in Switzerland for investors · SACOSI" url: https://sacosi.ch/en/investors seite: /en/investors stand: 2026-09-24 beschreibung: "IT due diligence and IT situation picture for investors and family offices in Switzerland and Germany: identify risks, protect value, resolve, hand over documented." --- > Knowledge version of the page https://sacosi.ch/en/investors. It contains the full text, including what is shortened or collapsible on the page itself. Publisher: SACOSI, Situational Awareness Consulting by Ivo Schönberner, Zürich. # IT situation picture and due diligence for investments. **Short answer:** When an investment has IT questions, you need someone who comes, clarifies the situation, resolves what is necessary and leaves again. I review the IT before the investment, produce a situation picture with measures after the investment, and take on technical leadership for a defined period if needed. At the level of a strategy consultancy, without its overhead, with a focus on Switzerland and Germany. ## When does an investment need an IT expert for a defined period? When IT affects the value of the investment and no one in the company has full oversight of the situation. ### Before the investment The IT due diligence shows which risks and costs you are buying into. ### After the investment The situation picture gives management a plan for the first months. ### During growth New markets, locations or customers bring requirements that the IT does not yet meet. ### Before the exit Evidence, documentation and architecture are prepared so that buyers can review them. An investment purchase is, for the target company, also a succession situation: the previous owner or managing director hands over responsibility, and the IT is no longer looked after by the same people as before. Where investment backlog, key-person dependencies or legacy licensing issues play a role, the same review applies as for a [business succession](https://sacosi.ch/en/succession). ## What does an IT due diligence examine? Whether the IT can support the business model and the growth plan, and what it costs if it cannot. - **Architecture and scalability:** does the technology support the planned growth, or does it break at the next order of magnitude? - **Security and access:** demonstrated rather than asserted, with roles, permissions and incidents. - **Costs:** current costs, costs under growth, contracts and terms. - **Dependencies:** on individual people, providers and legacy systems. - **Obligations:** data protection, industry regulations, standards and customer requirements by market. An overview is available under [Regulation](https://sacosi.ch/en/regulation). Here, the difference between conformant and certified matters: conformant means that procedures and evidence meet the substantive requirements of a standard such as ISO 27001, certified means that an external auditor has formally confirmed this. In due diligence reviews, supplier assessments and customers' security questionnaires, this difference accounts for a large part of the value. - **Documentation:** verifiable in a system, or only in people's heads. ## How do CAPEX or OPEX in IT affect the value of an investment? There is no fixed rule. The effect depends on the exit horizon of the investment, the valuation logic and the investor type. In a valuation based on EBITDA multiples, ongoing expenditure (OPEX) reduces EBITDA and therefore tends to reduce the multiple value, whereas capitalised investments (CAPEX) do not directly burden EBITDA. CAPEX, however, ties up liquidity, burdens free cash flow and creates assets with their own useful life that a buyer shortly before an exit often does not pay for in full, or discounts in due diligence. With a short exit horizon, it is therefore worth examining the investment's IT investments against exactly this question; with a long-term investment horizon, CAPEX for a platform that carries the business can make sense. This assessment belongs in the investment's IT situation picture, not in a blanket rule. More on this trade-off, from the CFO's perspective, under [Executive management](https://sacosi.ch/en/leadership#finanzierung). ## What do investors get at the end? A situation picture on one page and a list of measures, ordered by effect on value and by effort. - Findings classified by risk and urgency - Measures with effort, sequence and owners - a decision log that management and the advisory board continue to maintain - on request, implementation as [Fractional CTO](https://sacosi.ch/en/fractional-cto), until management takes over ## What does trusted partner mean for investors? Independent, at executive-management level, with no interest in a permanent engagement. - **Come, resolve, leave:** the engagement has a start, a goal and a handover. - **Vendor-independent:** the technology follows the business, not a partner status. - **Modern technology without legacy baggage:** built to scale, so that the next round does not start with a rebuild. - **Documented:** every decision versioned and approved, verifiable for auditors and buyers. Evidenced in practice: at Discover Airlines, IT am Main built the IT from zero starting in 2021 and carried it through growth to around 2’200 employees, with a prepared handover to the Lufthansa Group's corporate IT. ## Questions from investors. ### What is an IT due diligence? IT due diligence examines, before or after an investment, whether a company's IT can support the business model and the growth plan. It assesses architecture, security, costs, dependencies on people and providers, and regulatory obligations, and quantifies what is needed to resolve the findings. ### When is an IT situation picture worthwhile for an investment? Before the investment, when IT can be a value driver or a risk. In the first weeks after the investment, when management needs a plan. And whenever an investment grows, enters new markets or becomes regulated. ### What does "come, resolve, leave" mean? I take on a clearly defined engagement in the investment, clarify the situation, implement the key decisions and hand over, documented, to management or an internal team. No lasting dependency on the advisor is created. ### Does Ivo Schönberner also work for family offices? Yes. Family offices often hold investments across different industries and sizes. A situation picture per investment makes IT risks and costs comparable, without needing a large advisory team for every question. ### What documents does an IT due diligence need? Typical items are a system overview, contracts with IT providers, costs from recent years, roles and access rights, security concepts, incidents, certificates and audit reports. What is missing is itself a finding. ### How do CAPEX or OPEX in IT affect the value of an investment? That depends on the exit horizon and the valuation logic, not on a fixed rule. In a valuation based on EBITDA multiples, ongoing expenditure (OPEX) reduces EBITDA and therefore tends to reduce the multiple value, whereas capitalised investments (CAPEX) do not directly burden EBITDA but do tie up liquidity and free cash flow. Shortly before an exit, investments that a buyer will not pay for are usually avoided; with a long-term investment horizon, CAPEX for a platform that carries the business can make sense. The assessment belongs in the investment's IT situation picture. ### Does an investment need to be certified to ISO 27001, or is conformant work sufficient? Legally, conformant work that substantively meets the requirements of a standard, without being externally reviewed, is sufficient in most cases. In due diligence reviews, supplier assessments and customers' security questionnaires, a certificate still makes a big difference, because it creates trust without a review of your own and can shorten sales cycles. ## Does one of your investments have IT questions? Thirty minutes, no pitch. You describe the situation, I ask questions. After that, we both know whether a situation picture is worthwhile. CH +41 78 251 09 69 DE +49 152 27602667 ZRH 47.3769°N · FRA 50.1109°N · German, English