Merger or Acquisition
Understanding the true state of IT before a deal closes. Technology risk that isn't quantified before completion becomes a cost after it.
IT Due Diligence & Risk Assessment
Know exactly what you're inheriting, before it costs you.
A structured, board-grade IT assessment that delivers a risk register with named owners, a prioritised remediation roadmap, and no assumptions. A governance document built for action.
The Problem
Most IT due diligence stops at the report. Risks are catalogued and ratings are applied, then a document is handed over and the engagement ends.
What's Missing
What's missing is ownership. Who is responsible for addressing what's been found, to what standard, and by when? Without a clear accountability structure, a risk register is a liability in itself, evidence that the problem was known and nothing was done.
The Bushey Approach
Bushey's IT Due Diligence & Risk Assessment doesn't produce a report and walk away. Every finding is assigned a named owner, a remediation priority, and a governance path. The output is structured for action, not filing.
When You Need This
Six situations that call for a structured IT assessment
This assessment is commissioned when visibility gaps carry material risk, financial, regulatory, or operational.
Board IT Risk Mandate
When the board or audit committee has formally requested assurance on the organisation's technology risk posture and governance maturity.
Regulatory or Compliance Requirement
Assessments required by regulators, industry standards (Essential 8, ISO 27001, APRA CPS 234), or contractual obligations with enterprise clients.
Pre-Transformation Baseline
Establishing an honest baseline before committing to a major technology programme. Avoidable risk is far cheaper to identify before transformation begins.
Major Vendor Change or Exit
Assessing dependency exposure and transition risk when exiting a key technology vendor or bringing in a new strategic supplier relationship.
Post-Incident Review
Following a cybersecurity incident, service failure, or near-miss. Understanding systemic vulnerabilities before remediation investment is committed.
Assessment Scope
Eight domains. No assumptions.
Each domain is assessed independently and cross-referenced. Findings in one area frequently expose exposure in another, the risk picture is only complete when viewed as a whole.
Domain 01
Infrastructure & Architecture
Physical, virtual, and cloud assets. Resilience design, single points of failure, lifecycle status, and capacity adequacy.
Domain 02
Cybersecurity Posture
Vulnerability exposure, access controls, endpoint protection, network security, incident response capability, and threat detection maturity.
Domain 03
Applications & Licensing
Application portfolio health, licensing compliance, unsupported or end-of-life software, shadow IT, and integration dependency mapping.
Domain 04
Data & Information Management
Data classification, quality, lineage, retention practices, backup integrity, and exposure to privacy regulatory obligations.
Domain 05
Capability & Resourcing
Team structure, skills coverage, key-person dependency, documentation practices, and the operational readiness of IT to support business continuity.
Domain 06
Vendor & Contract Exposure
Vendor concentration risk, contract terms and exit clauses, SLA performance history, and undisclosed dependencies on third-party capabilities.
Domain 07
Compliance & Regulatory Alignment
Gaps against applicable frameworks, Essential 8, ISO 27001, APRA CPS 234, Privacy Act, and any sector-specific obligations, with materiality ratings.
Domain 08
Technology Debt & Technical Risk
Accumulated debt across architecture, code, and process. Deferred remediation costs quantified and mapped against operational and strategic risk thresholds.
What You Receive
The deliverable is structured for action.
Every output is designed to move from assessment into governance. The findings are registered ready to be managed in a remediation process.
01
Board-Ready Risk Register
All findings captured with risk rating (critical / high / medium / low), business impact description, and recommended treatment. Formatted for presentation to board and executive leadership.
02
Prioritised Remediation Roadmap
A sequenced plan that translates findings into remediation workstreams, with effort estimates, dependencies, and recommended timeframes across 30, 60, and 90-day horizons.
03
Governance Accountability Matrix
Every material finding has a named owner, an escalation path, and a review cycle. The matrix ensures nothing found in the assessment disappears into a gap between teams.
04
Executive Briefing Deck
A concise, visual summary of assessment outcomes for C-suite and board audiences. Designed to communicate risk and recommended investment without requiring technical background.
05
Domain Findings Reports
Detailed supporting documentation for each of the eight assessed domains, providing technical teams with the evidence base and methodology behind every finding and rating.
06
Optional
Ongoing Monitoring Engagement
Where clients require continued assurance, Bushey can remain engaged to track remediation progress, validate closure of findings, and provide periodic risk refresh assessments.
The Bushey Difference
Direct accountability, not advisory
Bushey leads the assessment with its own team. Findings aren't delegated back to the client to self-assess.
Ownership at every finding
The accountability matrix assigns a name to every material risk before the engagement closes.
Vendor-neutral, always
The assessment reflects what is actually there.
Built for follow-through
The remediation roadmap is designed to be governed. Bushey can remain engaged through to closure validation.
AssureChange®
This solution operates within Bushey's proprietary delivery governance framework, AssureChange®. The five-stage model, from Alignment & Readiness through to Closure & Executive Assurance, provides the governance structure that converts assessment findings into managed, evidenced outcomes. Governance controls are technology-agnostic and apply uniformly across all engagement types.
Get Started