How to Mitigate Common Commercial Risks to Prepare for a Major Transaction

Are you preparing for financing or M&A due diligence now or planning to in the future? If a third party started due diligence on your company today, would you be putting your best foot forward?

When you prepare for a major transaction, financing, or exit, an investor or an acquirer will perform due diligence on your business to determine the related risks and help them value your company. Knowing the issues that a buyer will see as a red flag and handling them proactively ahead of time can build credibility and prevent those issues from derailing a deal or giving the buyer leverage to renegotiate the deal with less favorable terms for the seller.

Whether a major transaction is right around the corner or seems like a long way off, there are practical and attainable steps you can take today to avoid common pitfalls arising from poor contract management, intellectual property (IP) ownership and usage oversights, and data privacy misses.

Good housekeeping and recordkeeping can reduce due diligence heartburn.

Much of the heartburn from due diligence is operational and administrative. In the early days of your business, a future exit may seem like a long way off and you may only have a few contracts in place which can be relatively straightforward to track. As the company grows and the team focuses on scaling, it is easy to lose sight of all the contracts your company has in place – customer, vendor, employee, partner, and more. Organizing these contracts on the front end will save significant time, effort, and frustration on the back end.

Depending on your business’s stage of maturity and what resources you have available, you could use something as simple as a spreadsheet that’s searchable for certain provisions or you could implement a robust contracts management system. Keep in mind that implementing a platform when you have fewer contracts in place is much easier than when you have hundreds of contracts in place.

With any system, prioritize creating a catalog or database of documents that will be translated into a schedule down the road.

Intellectual property can make or break your deal.

One of the most important and frequently challenging issues during due diligence is the evaluation of a company’s IP landscape, including what it owns, what it uses, and what it commercializes. When an acquirer buys your company and its underlying IP, they generally take on any associated IP risks. They look for ‘red flags’ related to ownership, license rights, and protection of the IP, assignability of the IP, and ability to integrate the IP into the acquirer’s company.

IP Ownership: IP rights owned and used by a company are often a key driver of the company’s value, so being able to show ownership (or the right to use) is important to preserve and capture that value. Sellers will need to be able to demonstrate that they own or have the clear right to use all IP, and that the IP is not under attack from third parties. This extends to all IP, whether registered or unregistered, whether used in the operation of the company or incorporated into a product or service. Be prepared to show an inventory of registered and unregistered IP used in the business and have a policy in place for obtaining third-party IP.

Common IP ownership issues for many companies include a founder who didn’t properly assign IP created by the founder prior to creating the entity, and  employees or contractors who haven’t signed the proper agreements to transfer ownership of created IP to the company. All employees, including founders, should sign Proprietary Information and Assignment Agreements (PIAAs) instead of relying on the statutory work for hire doctrine, both because work for hire is limited to copyright, and having the full transfer of rights is simply best practice. Contractors, freelancers, service firms, and consultants should all have appropriate agreements in place as well transferring IP to the company.

Correcting IP  ownership related mistakes can be costly and can significantly slow down a deal. consider a situation where a former employee did not properly assign key software the employee developed. In that case, the company will need to track down the person at issue and ask them to consent to assigning IP retroactively. At that stage the company is at risk of the former employee demanding further compensation for his or her cooperation.

Customer contracts: Certain types of contracts, like top customer contracts, are likely to get significant attention during due diligence. Ensure contracts with your customers properly retain your IP and do not inadvertently transfer ownership of background or new IP if that is not the intended business approach. Be prepared to inventory your customer agreements and highlight material deviations or irregular clauses that might come up in negotiations.

Third-party IP: Any third party that contributes or creates IP for the company should have a written agreement with the company transferring IP ownership. A buyer will want to know what third-party IP the company uses, and see a signed agreement confirming that the company has the clear right to use it as it is actually used. If there is a significant third-party technology, IP, or software on which the company’s services or products depend, ensure those licenses are assignable.

Often buyers will want to have an inventory of virtually all third-party IP that is used by the company.  Consider where licenses to 3rd party IP that may be immaterial can be found – co-marketing, partnerships, joint advertising, professional services and development work, partnership, referral, and reseller agreements, content and stock imagery on the website, website terms of use, and more. These agreements commonly have trademark or branding licenses, licenses to feedback, or licenses to background or retained IP.

Open-source software: While open-source software offers significant development opportunities and a tremendous financial value proposition, it also comes with compliance risks including the possibility of an obligation to share your proprietary source code. We recommend an open source policy, created in conjunction between the engineering/product development team and legal, to approve and track all third-party open source software used by the company.

While it can be a significant administrative burden to document IP and ensure compliance, it’s extremely valuable to have IP usage rights clearly documented. Showing that the company is organized, aware of potential risks, and proactive about tackling them instills confidence in buyers that the sellers have a solid level of business acumen. Conversely, buyers may view disorganized IP as a sign of bigger issues at the selling company.

Data privacy goalposts have moved.

Over the last five years, the data privacy landscape has changed significantly since the EU’s General Data Protection Regulation (GDPR) took effect and the California Consumer Privacy Act (CCPA) was passed. If you are not proactively looking at which privacy laws apply to your company, you have likely come out of compliance through no fault of your own due to new laws and regulations moving the compliance goalposts.

In 2023, several new state laws and an update to the CCPA have or are taking effect – putting more restrictions on controlling, processing, and selling data. When you are facing due diligence for a transaction, it is helpful to have policies in place with regard to the collection, use, and sharing of data, and policies on how you manage data and respond to consumer access and deletion requests.

Your company’s level of data privacy maturation may determine the levels of compliance and risk that buyers want to take on. In the case of data privacy, like all due diligence, context matters and the size of your company, industry, and other factors apply to your data processing situation.

Prevention and preparation are key to smooth due diligence.

In short, proactively organizing your company for a major transaction early on helps build credibility with investors and acquirers and reduces risk and time to close. If you are getting organized while doing the deal, you are likely behind.

Experienced attorneys who have navigated hundreds of sell- and buy-side M&A transactions can understand the context of your deal, provide practical insights, and help you navigate the due diligence process to a successful transaction.

This post was adapted from a legal panel co-hosted by KO Law Firm and SoftwareColorado. Check out the video recording here. For related content, see how commercial contracts can impact M&A and our data privacy educational video series.

Matt McKinney is a partner at KO Law Firm who focuses on structuring and negotiating complex commercial and technology transactions and representing companies in intellectual property and technology-related matters. KO data privacy partner Chris Achatz also contributed to this article.