{"id":3063,"date":"2020-11-23T07:54:31","date_gmt":"2020-11-23T07:54:31","guid":{"rendered":"http:\/\/www.ceo-worldwide.com\/blog\/?p=3063"},"modified":"2025-05-08T08:42:54","modified_gmt":"2025-05-08T08:42:54","slug":"ma-information-risk-management-towards-best-practices","status":"publish","type":"post","link":"https:\/\/www.ceo-worldwide.com\/blog\/ma-information-risk-management-towards-best-practices\/","title":{"rendered":"M&A INFORMATION RISK MANAGEMENT: TOWARDS BEST PRACTICES – by Nitin Kumar"},"content":{"rendered":"
<\/div>\n
<\/div>\n\n\n\n

“Someday, on the corporate balance sheet, there will be an entry which reads \u201cInformation\u201d; for in most cases, the information is more valuable than the hardware or software which processes it.”<\/em> Rear Admiral Grace Murray Hopper, US Navy (Ret)<\/p>\n\n\n\n

As the economy goes digital (and global), competitive advantage is increasingly synonymous with information. More and more organizations are dependent on information systems to store their assets, be it a pharmaceutical company\u2019s novel drug formulations; a music company\u2019s original recordings of artists\u2019 latest albums; or a tech firm\u2019s code for new software applications.<\/p>\n\n\n\n

Gaining competitive advantage through a merger or acquisition means that a company acquires the information assets of the target entity. How both acquirer\u2019s and target\u2019s information assets are integrated and shielded from various types of risk during the M&A can play a role in the success or failure of the new entity.<\/p>\n\n\n\n

This paper discusses the challenges of managing information risk for several types of M&As and introduces a framework that can be used to address those challenges. The paper also offers a checklist of best information risk management practices for an M&A, based on the author\u2019s experience as a Certified M&A Advisor.<\/p>\n\n\n\n

CHOOSING AN INFORMATION RISK MANAGEMENT APPROACH<\/h2>\n\n\n\n

Companies pursue M&As to enhance their market position, drive growth, or to expand capabilities, products or services. Senior management typically focuses on four major areas during an M&A: brand protection, customer retention, cost reduction, and change management.<\/p>\n\n\n\n

A robust information risk management (IRM) strategy supports the areas of management focus while creating value for the new entity. In this author\u2019s experience, managing information risk can be a challenge during an M&A, because it is typically a time of intense change and rapid execution.<\/p>\n\n\n\n

Understanding the type of M&A<\/a> the company is undertaking allows for more effective information risk management. M&As can be broadly categorized by the type of buyer (financial vs. strategic), the size of the deal, and the extent and speed of integration. These factors affect the overall integration strategy and call for different approaches to managing information risk (Figure 1).<\/p>\n\n\n\n

The first M&A category are financial buyers who seek targets outside their market that will enable them to create value through transformation. These buyers will usually extend their existing products and services into a new geography or diversify by connecting with large conglomerates or private equity groups. Integrations are usually done slowly so as not to rock the boat for the target or distract people through rapid change.<\/p>\n\n\n\n

How information assets are integrated and shielded from unnecessary risk during an M&A can play a role in the success or failure of the new company.<\/em><\/p><\/blockquote><\/figure>\n\n\n\n

For these financial buyers, the information risk management strategy should focus on compliance issues, laws and the regulatory frameworks that will impact the business. There is likely to be minimal formal integration and IRM teams must understand the resultant complexities in governance. The policies and procedures, although used to run distinctly different businesses, should be consistent across the two organizations. On the people side, IRM teams must recognize there are two different levels of risk awareness, skills and cultural knowledge. Since there is not full integration, there is little scope to bridge the gap between entities; this increases the complexities of governance. If not managed properly, this can adversely affect the strategic agility of the entities.<\/p>\n\n\n\n

Figure 1:<\/p>\n\n\n\n\n\n

The second M&A category is the strategic buyer pursuing market leadership by consolidating two large entities to eliminate redundancies, improve operations, and leverage economies of scale. These M&As often warrant a full integration and are usually done at a modest pace. Pushing forward at a rapid pace could be risky, jeopardize the full value of the deal, and burn out resources from the sheer size of the effort.<\/p>\n\n\n\n

For this strategic buyer, IRM teams should focus on classifying sensitive information to ensure the right people have the right level of information access, and the wrong people do not. The risks of any downtime and availability of information from systems migrations and integration of disparate systems should be well thought through; any downtime could affect customer retention and brand reputation. All obsolete and non-standard systems should be eliminated. Poor migrations and integrations often result in data accuracy and integrity issues, which have a huge impact on an organization\u2019s key business processes.<\/p>\n\n\n\n

The third M&A category are those financial buyers who execute a series of \u201cbolt-on\u201d acquisitions to create a new platform for growth. These expansions could be geographic or involve vertical integration. The speed of integration is rapid, leveraging the skills and scale of the platform company. There is likely to be low extent of integration beyond eliminating redundancies and overlaps in corporate functions and the back office.<\/p>\n\n\n\n

Here, the IRM teams should focus on compliance with specific regulations. Access risk and residual access risk must be evaluated and acted on quickly. There also needs to be a tight level of integration at the governance level, similar to that needed for the \u201ctransformational\u201d financial buyer.<\/p>\n\n\n\n

The strategic buyer who is absorbing a competitor \u2013 usually of a smaller size \u2013 are the final M&A category. This buyer seeks to capture operational synergies by eliminating excess capacity and enhancing efficiencies. This often includes merging sales functions, scrapping product lines or services, or closing offices.<\/p>\n\n\n\n

M&As can be categorized by the type of buyer, the deal size, and the extent and speed of the integration. These affect the overall integration approach and mean there are different kinds of information risk to be managed.<\/p><\/blockquote><\/figure>\n\n\n\n

While this is a full integration at rapid speed, extra care must be taken not to alter the risk profile of the target so much that it diminishes in value and takes on too much agility risk. In addition, access risks play a very important role in this kind of a merger, having the same level of impact as consolidation with full integration. The use of non-standard or obsolete systems stand a negligible chance and hence much time and effort is not spent on this area during absorptions thereby reducing accuracy risks.<\/p>\n\n\n\n

Frequently the methods used by the acquirer for managing availability risks are adopted by the new entity.<\/p>\n\n\n\n

THE \u20184 A\u2019 FRAMEWORK: UNDERSTANDING RISK PROFILES<\/h2>\n\n\n\n

M&As create environments more complex than steady state operations, and thus should be viewed differently when managing information risk. It is also important to have a common IRM framework during an M&A, so that the integration and IRM teams can ensure changes are visible and controlled.<\/p>\n\n\n\n

To manage, mitigate and monitor risk in this highly complex environment, it helps if the framework is robust enough to be customized by the type of M&A. The framework should allow for integration between the tactical tasks that help manage risk and the strategic imperatives of the transaction. Such an information risk framework also aids in building a common language of alignment between business design and the information environment.<\/p>\n\n\n\n

Figure 2:<\/p>\n\n\n\n\n\n

The 4 A Framework is a model that allows IRM teams to look at all aspects of risk. Using this framework for M&As allows IRM teams to customize to the transaction, maintain transparency and connect risk management to strategic goals. Entities undergoing M&A can evaluate the risk profile of the acquirer and the target company, and that of the combined entity based on these parameters:<\/p>\n\n\n\n