Should IA be involved in the M&A process?

A recent article in the Financial Times indicates that M&A deals have significantly increased in Europe and in the US since the beginning of 2024, after a rather low 2023. External growth is part of the corporate life and many internal auditors have been through a process of integration, merger, sale or split of some activities. How can the process of a M&A deal be summarized, and what can be the role of Internal Audit (IA) in this process – if any?

The process of a merger and acquisition (M&A)

Once an organization has a clear development strategy, identified possible targets, and engaged into non-binding conversations with a particular target, normally two key steps are taken:

·?????? Due diligence (DD). Before making an offer, thorough BB is conducted to assess the target company's financial performance, legal standings, operational efficiencies, technologies, etc. DD is critical to understand the risks and opportunities associated with the acquisition.

The DD is performed by different players. A “data room” is created for the Buyer advisors to review all relevant information. In most cases, confidentiality agreements are signed, and external parties are involved: external auditors for assets, liabilities and off-balance sheet items, legal advisors for key contracts, pending litigations, etc. A few internal representatives of the Buyer are more specifically involved for the assessment of intangible assets such as the customer base, technologies, key employees, etc., that can be the basis for “goodwill”. The CEO, CFO, the General Counsel as well as the internal M&A team (when there is one) are in the driving seat of this DD step.

·?????? Valuation and deal structuring. Based on the DD findings, the acquiring company will assess the value of the target company and structure the deal. This involves determining the price they are willing to pay and the method of payment (cash, stock, or a combination of both). That step directly involves the CFO, the finance team, the CEO together with advisors such as investment banks.

Once the deal structure is defined, the negotiation takes place, the financing is defined, and an agreement is hopefully signed. In Financial Services, a Regulatory approval is in most cases required.

After closing the deal, the integration of the target operations begins. Depending on the objectives of the acquisition and the ambition level in terms of synergy, the integration ranges from just financial (financial reporting: the target is expected to run autonomously) to a full combination of systems, processes, cultures, and teams.

Internal Audit and DD

I had over the years several conversations on the opportunity to involve IA in the M&A process and more specifically in the DD step. There would indeed be some benefits:

·?????? Risk identification. IA is a function that can help identifying potential risks associated with the target company: financial, operational, compliance, and strategic risks,

·?????? Controls assessment: ?IA can provide a first sense of the control weaknesses or deficiencies that may impact the acquisition and the subsequent integration process. IA recommendations for improvements in the Internal Control System can contribute to the assessment of the overall value of the acquisition. IA could also assess the Culture gaps between Buyer and Seller.

However, these “pros” are significantly outweighed by some major “cons”. Having seen quite a few operations in my long Allianz career, I can state that involving IA is neither practical nor realistic.

·?????? Most M&A take place under severe time constraints, and there is no time to conduct a serious internal audit.

·?????? Space and scope constraints: M&A involve a limited number of people, especially on the Seller side, for confidentiality purposes. A “data room”, physical or digital, means that a great deal of the DD work is based on documents reviews, a rather adverse environment for a proper audit work: no interviews, no access to premises, etc.

·?????? Resource constraints: involving IA in the due diligence process may require additional resources and time, diverting attention from other ongoing audit activities

·?????? IA teams may lack the specialized expertise or experience required for thorough DD in areas such as legal or tax.

The involvement of IA in DD also raises several fundamental objections:

·?????? Confidentiality. At DD step, no deal is done, and the projected transaction might not go through. Information is shared by the Seller, and both parties are in general more comfortable to have external advisors (auditors, lawyers, bankers) involved. Some Buyer representatives may access the data room, but with a focus on what is strategically relevant: technology and know-how, people and leadership, customer bases, in other words intangible assets. The value added by IA at this point is not clear (at least to me).

I would also note that it is always possible to request the inclusion in the data room of the Seller IA reports, which can be a basis to get a sense of the status of the ICS of the target.

·?????? Independence and liability. If involved in the DD step, there may be concerns about IA's independence, with IA having a reporting relationship to senior management or the Buyer’s board. If the transaction does go through, it usually comes with certain guaranties given by the Buyer. Involving a function like IA introduces a flaw: “we told you”, or “your guys saw this” etc. and it can turn into a problem if guaranties need to apply.

Each M&A transaction is unique, and the specific steps may vary based on the companies involved, the industry, and the transaction's size and complexity. But in all cases, it is probably better for IA to be involved ex post, once the transaction is completed, than ex ante.

https://www.ft.com/content/2cd43668-7d52-44a6-a8a0-58325736c727