--- title: "Portfolio Company Technology Assessment: A PE Checklist" description: "A six-area checklist for operating partners: the questions to ask, how to score the answers, the red flags, and how findings feed the value-creation plan." canonical: https://shipshapedata.com/resources/data-governance-compliance/portfolio-company-technology-assessment/ language: en-GB author: "Emile Van Zyl" author_role: "MarTech Automation Consultant" author_url: https://www.linkedin.com/in/emile-vanzyl-enhancing-your-human-advantage/ date_published: 2026-10-03 date_modified: 2026-10-03 --- # Portfolio company technology assessment: a diligence checklist > A six-area checklist for operating partners: the questions to ask, how to score the answers, the red flags, and how findings feed the value-creation plan. Section: Home > Resources > Data governance & compliance Canonical page: https://shipshapedata.com/resources/data-governance-compliance/portfolio-company-technology-assessment/ By Emile Van Zyl, MarTech Automation Consultant (https://www.linkedin.com/in/emile-vanzyl-enhancing-your-human-advantage/) | published 2026-10-03 A deal team signs off a technology section that says the systems are adequate. Months after completion, the board pack still takes a week to assemble, two finance teams report different revenue figures, and the AI initiative in the value-creation plan has no data to run on. The assessment was accurate. It did not ask the questions that decide value. A portfolio company technology assessment constitutes a structured review of a business's systems, data, reporting, security and cost of change, conducted during diligence or within the first hundred days after acquisition. It informs an operating partner what the technology can support, the cost to remediate, and which value-creation initiatives are at risk. This guide is for operating partners, portfolio operations leads and deal teams. It gives you six areas to check, the questions to ask in each, a way to score the answers and the red flags that should change a plan. It is broader than our guide to AI due diligence for private equity investors, which covers AI-specific risk. Shipshape Data builds data foundations and the AI that runs on them, and this checklist reflects what we look for before we agree to build anything. ## Why assessments do not change decisions Most technology assessments seek to identify risks that could stop a deal from closing. Although this is a valid goal, it does not supply the information an operating partner needs. A value-creation plan depends on specific technical assumptions. These commonly include the ability to analyse pricing data, the possibility of merging reporting for two acquired companies, and the potential to cut support costs via automation. If an assessment does not verify these assumptions, it cannot affect the plan. Three patterns repeat. - The review describes the stack instead of judging it. A list of systems and versions tells you what exists. It does not tell you whether the finance team trusts the numbers that come out of it. - The review solely addresses infrastructure. It incorporates checks for servers, licences, and security certificates, yet it excludes the data itself. Most change-related costs are tied to data, namely its ownership, its quality, and the number of systems that store it. - Findings lack an associated cost or owner. A finding indicating mixed data quality does not give anyone a decision to make. A finding that pinpoints the specific problem, the effort needed to resolve it, and the initiative it blocks offers a basis for action. The checklist below aims to prevent these three issues. Each section ends with a judgement that links to a specific value-creation initiative. Every identified gap contains an estimate of the time and effort needed to address it. > An assessment that cannot change the plan is a description, not a diligence finding. ## The six areas and the related questions Apply the same six categories to every company to enable comparisons across the portfolio. The questions are intended for management teams to answer during a working session. You should request evidence for any answer that impacts the plan. ### Systems inventory Start with what the business runs and how the systems connect. You are looking for the systems of record, the integrations between them and the places where people fill the gaps by hand. - Which system serves as the record for customers, products, orders, finance and people? - How do these systems exchange data: via integrations, file exports, or manual re-keying? - Identify the systems that are out of support, heavily customised, or known by only one person. - Which spreadsheets does the business depend on to close the month or run operations? - Identify which contracts and licences renew during the holding period and the specific terms of those renewals. ### Data ownership and quality Data is where most of the hidden cost resides. Ask who owns each core dataset and how its quality is verified. Our guide to data quality dimensions outlines the measures to use: accuracy, completeness, consistency, timeliness, validity and uniqueness. - Is there a named owner for customer, product and financial data, with the authority to fix it? - Identify how many systems maintain a copy of the customer list and determine whether the data in these copies is consistent. - Are there written definitions for revenue, margin, active customer and churn? - Do you measure data quality, or do you only notice problems when a report contains errors? - Identify the locations of the data silos and the individuals who spend time bypassing them. ### Reporting reliability The board pack offers a quick way to evaluate the entire system. When you assemble it manually using different exports, each number is subject to the risks inherent in the slowest and least precise part of the process. - How many people are involved in the monthly close and the board pack, and how much time does it take to complete them? - Is the management team able to trace a headline figure back to the individual source transactions? - Do the finance, sales, and operations departments provide identical revenue figures for the same time period? - If figures do not match, is there a formal process to resolve the difference, or does the highest ranking person make the final decision? Our guide to data reconciliation describes the reasons for system discrepancies and offers methods for resolving them once they are identified. ### Security and compliance Security findings may impact the price or the terms of a deal. Therefore, these findings must be supported by evidence rather than assurances. Under UK GDPR, a business must also know what personal data it holds, where that data is stored, and why it is retained. - Provide the list of individuals with administrator access to core systems and indicate the date when this list was last reviewed. - Do you maintain a current record of personal data processing activities? - Has the business encountered a security incident, a breach notification, or a regulator enquiry? - Are backups tested by restoring them, and is there a recovery plan that someone has practised? - Which suppliers process company data, and under what contractual terms? When the answers are weak, a data security governance framework gives you a structure for the follow-up work. ### AI readiness AI readiness relies on your data and organisation rather than the tools you choose. A company that has a governed data foundation can move from a concept to a functional use case quickly. A company without this foundation will allocate most of its AI budget to fixing data issues. - Do you use a central data store such as a cloud data warehouse, or does each report pull directly from source systems? - Has the business tried AI before, and what stopped it? - Which processes are document-heavy, repetitive or high-volume enough to automate? - Who would own an AI system after it goes live? - Is there a policy on staff use of public AI tools? ### Cost of change The last area turns the other five into money and time. For each planned initiative, ask what has to change in the technology to deliver it, and what that change depends on. - Which initiatives in the value-creation plan depend on data or systems that are not ready? - What needs to be built, migrated, or replaced, and in what order? - Determine whether the team has the necessary skills to deliver the project or if outside help will be required. - Which changes would disrupt trading if they went wrong, and how is that risk managed? ## Scoring and red flags Scores enable comparison of results across different companies and time periods. You should use a simple scale so that two reviewers reach the same conclusion when examining the same evidence. ### A four-point scale - Ready: the area supports the value-creation plan as it stands, with evidence. - Workable: gaps exist, but they can be fixed inside the current plan and budget. - Constraining: gaps will delay or reduce at least one initiative unless they are funded separately. - Blocking occurs when an initiative cannot proceed until a gap is closed, or when the gap itself poses a risk to the deal. Assign a score to each of the six areas and document the evidence for each rating. Scores without supporting evidence are considered opinions, which are hard to justify to an investment committee. ### Red flags that change the plan - Nobody can say who owns customer or financial data. - The board pack depends on one person and a set of spreadsheets. - Two functions report different revenue figures and nobody owns the difference. - Core systems are out of support and no replacement is funded. - There is no tested recovery plan for the systems the business trades on. - The value-creation plan includes AI, yet there is no central data store for the technology to use. These issues do not force you to cancel the deal. Each item must be added to the plan with a cost assigned, a responsible owner, and a completion date. > A red flag is not a reason to walk away. It is a line in the plan that needs a budget. ## Moving from assessment to a value-creation plan The assessment is valuable only when its findings are incorporated into the plan overseen by the operating partner. Each finding should be placed into one of three specific actions. You may resolve the issue before the initiative starts, address it while the initiative is underway, or accept the risk and record the justification. Sequence matters more than speed. Most initiatives that depend on technology depend on the same few things: one agreed set of definitions, a reliable route from source systems to reports, and named owners for the data. Fixing those first means the second and third initiatives cost less than the first. This is the order we work in: the data foundation first, then a first win that pays for the second. ### Building the hundred-day plan - In the first month, you need to verify the scores with management, determine data ownership, and draft definitions for the core metrics. - In the second month, you ought to correct the reporting path for the board pack so that all core metrics come from a single source. You should also start tackling the most significant blocking gap. - During the third month, you need to finish one initiative that uses the new foundation. You will compare the results of this initiative to the metric set at the project's start. Link each initiative to a metric the board already monitors, like days to close, working capital, or cost to serve. This makes progress visible and prevents the technology work from turning into a programme without an end date. ## Assessing AI readiness across a portfolio A portfolio view needs the same questions asked the same way at every company. That lets you see which holdings can move on AI now, which need foundation work first, and where a capability built once could be reused elsewhere. Our free AI readiness assessment provides one way to begin. It contains 16 questions, scores strategy, people, data and change instantly, and has no email gate. Having each management team complete it offers a consistent initial screen before a deeper review. ### Group companies by readiness - These companies are ready to build. They have set up a central data store, appointed specific owners, and put reliable reporting in place. They can move an AI use case into production. - Foundation first: systems that work but data that does not line up. The first engagement is the data foundation, with an AI use case planned on top. - Not yet: unreliable reporting or blocking security gaps. AI waits until the basics are fixed. Look for patterns across the groups. If several companies share a problem, such as document-heavy back-office work or slow month-end reporting, one approach can be designed once and repeated. Our guide to the stages of an AI maturity model describes what each stage looks like in more detail. Over time, a portfolio KPI foundation replaces the collection of spreadsheets that most funds use to compare results. Each company's core metrics flow into one governed store with shared definitions, so the fund sees the same figure the management team sees. The same logic applies to AI tools for portfolio monitoring. A tool that reads inconsistent exports from each company will give confident answers built on numbers that do not agree. ## What to outsource and what to keep in-house The fund should manage certain parts of the assessment. Specialists should carry out other parts because they can review the evidence directly within the systems. ### Keep in-house - The link to the investment thesis and the value-creation plan. - The scoring standard, so results stay comparable across the portfolio. - The decisions cover which projects to fund, the order of those projects, and which management team to assign. ### Bring in outside help - Hands-on review of data quality, reporting pipelines and integrations, where the evidence sits in the systems rather than in the slides. - Security testing needs specialised skills and independence from the management team. - Estimating the cost of change using the experience of people who have built and migrated similar systems. When you engage external consultants, enquire whether the people doing the assessment will also carry out the implementation. Also ask whether they would advise you to stop a planned initiative when it is necessary. An assessment prepared solely by reviewers might miss the true costs of change. Conversely, an assessment created only by builders might overlook reasons to avoid building. Our guide to choosing an AI consultancy offers a list of questions to pose before hiring a firm. ## Where this leaves you A useful technology assessment performs three actions. It evaluates each area against the value-creation plan, scores the answers on a scale that anyone can apply, and converts each gap into a cost, an owner, and a date. The six areas listed in this checklist address what most plans rely on: systems, data ownership and quality, reporting, security and compliance, AI readiness, and the cost of change. Use the same process at each company. Maintain all decision-making and scoring standards inside the organisation. You need to fix the data foundation before launching initiatives that rely on it. The first successful project will finance the next, and your perspective on the portfolio will get better with each company you assess. Our private equity work focuses on value creation, visibility and repeatable AI capability across portfolio companies, from a portfolio KPI foundation to a readiness assessment you can repeat across holdings. The hands-on data work runs through our data consultancy service, delivered by the people who will build what the assessment recommends. If you have a deal in diligence or a new holding entering its first hundred days, Talk to us. You will get a personal reply, and we will say if we are not the right fit. ## Frequently asked questions In a portfolio company, the technology portfolio includes all systems, applications, data stores, integrations, and supplier contracts used by the business, together with current change initiatives. A technology assessment examines this portfolio against the value-creation plan. This process determines which systems hold the records for core data, how those systems interconnect, who owns the data, and the projected costs of modifying them to achieve the plan's goals. A portfolio analysis evaluates holdings collectively to help you decide how to allocate time and money. For technology, this process involves asking identical questions across six specific areas at each company and using a single scale to score the answers. The results identify which companies are ready to build, which need foundational work, and which have common issues that a single solution could address for multiple holdings. The primary tools for a technology review include a standard set of questions, a basic scoring scale, and evidence collected from the systems. This evidence comprises access lists, board pack processes, and reconciliation records. A self-assessment of readiness offers a consistent initial screening for all companies. Eventually, a portfolio KPI system supersedes the spreadsheets that most funds use to compare results. In this system, core metrics from each company flow into a single governed database that uses shared definitions. The most effective AI tool uses data you already trust. If a tool uses inconsistent exports from different companies, it will give confident answers based on conflicting numbers. First, you should establish agreed definitions for core metrics and consolidate them in a single governed data store. Then, choose a tool that connects to that store, integrates with the fund's existing reporting, and explains the logic behind each answer it produces. ## Frequently asked questions ### What is a technology portfolio? In a portfolio company, the technology portfolio includes all systems, applications, data stores, integrations, and supplier contracts used by the business, together with current change initiatives. A technology assessment examines this portfolio against the value-creation plan. This process determines which systems hold the records for core data, how those systems interconnect, who owns the data, and the projected costs of modifying them to achieve the plan's goals. ### What is a portfolio analysis? A portfolio analysis evaluates holdings collectively to help you decide how to allocate time and money. For technology, this process involves asking identical questions across six specific areas at each company and using a single scale to score the answers. The results identify which companies are ready to build, which need foundational work, and which have common issues that a single solution could address for multiple holdings. ### What are the tools used in portfolio analysis? The primary tools for a technology review include a standard set of questions, a basic scoring scale, and evidence collected from the systems. This evidence comprises access lists, board pack processes, and reconciliation records. A self-assessment of readiness offers a consistent initial screening for all companies. Eventually, a portfolio KPI system supersedes the spreadsheets that most funds use to compare results. In this system, core metrics from each company flow into a single governed database that uses shared definitions. ### Which AI tool is best for portfolio analysis? The most effective AI tool uses data you already trust. If a tool uses inconsistent exports from different companies, it will give confident answers based on conflicting numbers. First, you should establish agreed definitions for core metrics and consolidate them in a single governed data store. Then, choose a tool that connects to that store, integrates with the fund's existing reporting, and explains the logic behind each answer it produces. --- Shipshape Data is a London AI consultancy: we build the data foundation your AI depends on, then the AI on top. Site guide for agents: https://shipshapedata.com/llms.txt | Contact: hello@shipshapedata.com