Quality Compliance Auditing to a Due Diligence Process

A framework for quality auditing of a merger and acquisition (M&A) pre-acquisition due diligence investigation process.

Who will head the acquired operation as represented by an independent investor will drive the auditor’s contribution for significant value by ensuring that a vibrant systematic quality approach is evident and in place and operating as intended. A rigorous audit of the quality system due diligence process can help companies take advantage of legitimate new business opportunities, while at the same time help minimize the risks by operating in the appropriate context from a mixture of regulation and standards impacting the operational context of the organization.

Making the case for auditing to a due diligence process can be awkward if an internal audit function has not been effectively generating improvement opportunities systematically. Strong relationships with the audit committee and management are a key factor, as well as the reputation of the internal audit department itself. If these two items are lacking, it will be difficult to obtain buy in for auditing the due diligence process, or any access to operation for that matter. Moving forward will assume that both of these factors are in place. A 3rd party approach may be imperative to effectively draw out the “bones in the closet” in order to get a true sense of the status of systematic effectiveness and efficiency in organizational improvement.

Prospective Pre-Acquisition Due Diligence

The audit of the due diligence process should begin with the assurance that a senior management advocate has been identified internally. This individual should assist with management and the investor for buy-in of the due diligence process and facilitate communication and cooperation of key aspects across all functional areas potentially affected by a new acquisition such as business process owners, procedural application, meeting objectives, data analysis and cooperation with the outside consultant(s).

The execution of the external audit should ensure that a due diligence checklist(s) exists and has been tailored to address unique risks associated with the prospective subsidiary, or prospective organization.

A quality due diligence checklist(s) should efficiently and effectively address the following key issues: process quality, compliance quality, potential for unrecorded or understated functions and processes, management review evaluations, resource adequacy and actual/potential infraction(s) of compliance, or conformance.

An efficient and effective control due diligence checklist should assess: a prospective acquisition control and risk mitigation posture relative to acquiring company expectations; whether unmitigated key quality functional risks such as the absence of a repeatable methodology may adversely influence the acquisition decision; the estimated effort required to implement missing resources as a factor in establishing the acquisition budget requirements; the compatibility of legacy and outsourced systems with acquiring company systems; and the impact of the cautionary control posture on due diligence factors that put the new operation at risk.

Concurrent Post-Acquisition Due Diligence

Pre-acquisition due diligence may miss important issues, especially when it is conducted in a competitive environment in which the acquiring company has only a few days to access financial records and key personnel.

Thus, it is possible for the buyer to overlook poor, misguided reporting and quality weaknesses in internal control. An audit of an immediate post-acquisition due diligence process can help compensate for such risks by providing early identification of unmet quality objective planned goals which may allow the acquiring company to take corrective action before substantial losses may be incurred.  This may become apparent with the assessment of quality dashboard(s) and data analysis or which a lacking in itself is a compliance infraction.

Critical components of an effective post-acquisition due diligence process should include: a quality management rep (QMR); process owners, qualified persons; an initial comprehensive quality plan; and management review of an annual internal audit.

Each acquisition should be assigned an internal transition manager who joins the company on a full-time basis for several months. The transition manager should be an expert who works closely with the existing quality representative to provide direct assistance with on-site integration including implementing the acquiring company’s expected quality culture and act as a liaison with senior management during the integration. Transition managers should not be directly involved in running the business to maintain their objectivity with respect to the integration. They also should also have received formal training, or certification in the regulation/standards applicable.

Quality process and control experts should have the primary responsibility for integrating the various infrastructure processes such as operational quality, corrective actions, risk assessment, documentation, procurement and material management. One, or more quality process and control experts should be assigned to each new site depending on the specific infrastructures that need to be integrated.

Within the first 30 to 60 days after an acquisition, the site(s) should undergo a comprehensive quality system and control review. This initial review should be considered an “assist visit” from the initial due diligence audit. The intent of this visit is to give management of the new site a “roadmap” of the controls and process changes that need to be implemented to bring the company into alignment with the parent company’s controls, culture, systems and reporting requirements.

Throughout the first few months after acquisition, the quality system and control experts and transition manager should employ a supportive, consultative approach toward the new site , or subsidiary with a focus towards implementing the items detailed in the roadmap (GAP MAP).

Prior to the end of the initial business year, the new site should undergo its first internal audit. Management Review (MR) would formally give a rating of A/E/E*, based on whether the roadmap’s recommendations have been implemented. (*Adequacy, Effectiveness, Efficiency)

An unsatisfactory rating should be examined closely. If serious process and control deficiencies were identified from the prior review(s) that need an extended time period to fully remediate (i.e. a new supplier control system), then this should be taken into account. If control deficiencies have been left to languish, then this could result in the loss of jobs within the sites senior management.


Externally qualified auditors can assist a company’s ensuring a strong due diligence process is maintained in all its forms: pre-acquisition and/or post-acquisition. A strong due diligence process is critical to ensure the acquirer is fully aware of all quality and compliance aspects of the deal and provides access to vital intelligence that is used to negotiate the final acquisition and integrate the new site/subsidiary more effectively.  A case study will be referenced during the presentation to accent key process points of the due diligence process.


Leave a Reply

Your email address will not be published. Required fields are marked *