vaayaa Inclusive Education
Finance risk assessment

Mergers, Acquisitions and Corporate Restructuring Risk Assessment: Deal, Integration and People Risks

A worked example of how a deal team identifies, scores and controls the risks that threaten value from acquisition, integration and restructuring, from overpayment and data loss to people, supplier and legal exposure.

Updated November 2026 8 hazards assessed Review every 3 months Highest risk: Critical to Medium
See the Mergers, Acquisitions and Corporate Restructuring course

Executive summary

This assessment shows how a deal team can find, rate and control the risks that decide whether an acquisition and restructuring create value. Eight risks were chosen because they are plausible in everyday deal and integration work. Data loss during migration and a legal breach in approvals are the most serious before controls, with integration failure, key staff loss and overpayment close behind. Each risk is scored before controls and again after existing and added controls. Most risks fall to Medium or Low once controls are in place, but integration failure and key staff loss stay at Medium because the disruption is hard to remove. The first actions are a documented due diligence checklist, a verified data map, a retention plan for key people and a single communication plan. The company is a teaching example, so every score illustrates method rather than a real transaction.

Focus area
Mergers, acquisitions and corporate restructuring
Setting
Corporate development and finance teams in a mid-sized group that acquires a smaller business and reorganizes parts of its own operations
Method
Five by five likelihood and impact risk register with deal stage gate review

Scope

This assessment covers a mid-sized group that plans to acquire a smaller business and then restructure part of its own operations. It covers the deal from target screening and due diligence through completion, integration and the reorganization of roles and sites. It does not cover any real transaction, valuation or legal advice. Jurisdiction, sector, deal size and systems are assumptions made for teaching.

Context

The acquirer has a corporate development team, a finance function, an HR business partner, an IT lead and a legal adviser. The target runs its own accounting and customer systems, uses a mix of cloud and on-site software, and relies on several shared suppliers. The plan includes combining two sales teams, moving finance to a shared service, closing one duplicate site and retiring a legacy system. Each risk is scored before controls to show its natural level, then again after existing controls and the additional controls that should be added.

Objectives, assets and stakeholders

The objective is to complete the acquisition and restructuring on the agreed terms, keep the value of the target, protect people and customers, and meet legal and reporting duties. The assets in scope are the target customer relationships, staff know-how, customer and employee data, financial records, key contracts and systems, and the reputation of the acquiring group. Stakeholders include the board, the deal and finance teams, employees and their representatives, customers, shared suppliers, lenders, regulators and the legal advisers. Every risk has one owner role, and the deal lead reports progress to the board at each stage gate.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely Likelihood 4, impact 4, score 16, high: H02 H04 Likelihood 4, impact 5, score 20, critical: H03
3 Possible Likelihood 3, impact 3, score 9, medium: H08 Likelihood 3, impact 4, score 12, high: H01 H06 H07 Likelihood 3, impact 5, score 15, high: H05
2 Unlikely
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible Likelihood 3, impact 3, score 9, medium: H02 H04
2 Unlikely Likelihood 2, impact 2, score 4, low: H08 Likelihood 2, impact 3, score 6, medium: H01 H06 H07 Likelihood 2, impact 4, score 8, medium: H03 H05
1 Rare
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Overpayment and flawed valuation 12 High 6 Medium Corporate development director
H02 Integration failure of processes and systems 16 High 9 Medium Integration lead
H03 Data loss and security breach during migration 20 Critical 8 Medium IT lead
H04 Loss of key people and know-how 16 High 9 Medium HR business partner
H05 Legal and regulatory breach in due diligence and approvals 15 High 8 Medium General counsel
H06 Redundancy and restructuring handled poorly 12 High 6 Medium HR business partner
H07 Supplier and contract disruption from change of control 12 High 6 Medium Procurement lead
H08 Reputational harm and poor stakeholder communication 9 Medium 4 Low Corporate communications lead
H01

Overpayment and flawed valuation

Financial Before 12 After 6

The price is set on optimistic forecasts, overstated earnings or weak evidence, so the acquirer pays more than the target is worth and the expected return is lost.

Who or what is affected: Board, shareholders and lenders

Causes

Pressure to win the deal, reliance on seller figures and forecasts that are not challenged.

Consequences

Write down of goodwill, reduced returns, pressure on lenders and loss of board confidence.

Existing controls

  • Valuation is reviewed by the finance lead before the offer is made.
  • The board approves the price range in writing.

Control gaps

Seller adjustments to earnings are accepted without independent testing.

Additional controls

  • Prevent: Test the valuation against a low case and a downside case with each assumption documented.
  • Detect: Compare the quality of target earnings with cash conversion and reported adjustments.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Corporate development director Target: Within 30 days Early warning: A forecast that depends on growth well above the target historical trend.
H02

Integration failure of processes and systems

Operational Before 16 After 9

Two sets of processes, controls and systems are combined without a clear plan, so orders, invoices or reporting break down during and after the handover.

Who or what is affected: Customers, finance staff and operations teams

Causes

Unclear ownership, different working practices and deadlines set before the design is complete.

Consequences

Missed orders, billing errors, delayed reporting and loss of customers.

Existing controls

  • An integration steering group meets each week.
  • Key processes are listed in a shared inventory.

Control gaps

Parallel running is not planned for every process, and sign off is informal.

Additional controls

  • Prevent: Define a target operating model and sign off each process before cutover.
  • Respond: Keep the legacy process running in parallel until the new one is proven.
Likelihood 4 x impact 4 before; 3 x 3 after Owner: Integration lead Target: Within 45 days Early warning: Process steps that are still manual after the agreed cutover date.
H03

Data loss and security breach during migration

Technology and data Before 20 After 8

Customer and employee records are copied, moved or exposed during migration through weak access rights, unencrypted transfers or incomplete backups, so data is lost or disclosed.

Who or what is affected: Customers, employees and the acquirer

Causes

Unmapped data stores, rushed timetables, shared passwords and third party tools with broad access.

Consequences

Loss of customer trust, regulator notice, legal claims and the cost of recovery.

Existing controls

  • Migration runs from a managed environment with individual user accounts.
  • Backups are taken before each major system change.

Control gaps

Data held in spreadsheets and personal folders is not in the migration map.

Additional controls

  • Prevent: Encrypt data in transit and limit migration access to named staff for the migration period.
  • Detect: Reconcile record counts and checksums after each test load and review access logs daily.
  • Recover: Rehearse restoring the target data from backup before cutover.
Likelihood 4 x impact 5 before; 2 x 4 after Owner: IT lead Target: Within 30 days Early warning: Record count differences above the agreed tolerance after a test load.
H04

Loss of key people and know-how

People Before 16 After 9

Staff who hold customer relationships, technical knowledge or deal knowledge leave during uncertainty, taking know-how and relationships with them and slowing the integration.

Who or what is affected: Employees, customers and the integration team

Causes

Uncertainty about roles, pay changes and culture differences between the two businesses.

Consequences

Lost customers, delayed projects, higher recruitment cost and reduced capability.

Existing controls

  • Key roles are listed in the deal file.
  • Some managers hold informal retention conversations.

Control gaps

Retention is considered only for senior staff, and knowledge capture is not planned.

Additional controls

  • Prevent: Agree written retention terms for named key people before the deal is announced.
  • Respond: Document critical know-how and name a backup for each key role.
Likelihood 4 x impact 4 before; 3 x 3 after Owner: HR business partner Target: Within 60 days Early warning: Resignations or notice given by key staff in the first six months after completion.
H05

Legal and regulatory breach in due diligence and approvals

Legal and compliance Before 15 After 8

Required approvals, disclosures, competition checks or employee consultation steps are missed or misapplied, so the transaction is delayed, challenged or unwound.

Who or what is affected: Board, shareholders, regulators and employees

Causes

Complex deal structure, cross border elements and reliance on the seller for information.

Consequences

Penalties, delay, rescission claims and loss of regulator trust.

Existing controls

  • The general counsel reviews the main transaction agreements.
  • The board receives a regulatory checklist before signing.

Control gaps

Jurisdiction is assumed, and no one confirms current rules before each step.

Additional controls

  • Prevent: Build a dated approvals and consultation calendar that names an owner for each step.
  • Detect: Have a second legal reviewer check the checklist against the agreed deal terms.
Likelihood 3 x impact 5 before; 2 x 4 after Owner: General counsel Target: Within 30 days Early warning: An approval or consultation step due within 10 days that has no named owner.
H06

Redundancy and restructuring handled poorly

People Before 12 After 6

Roles are removed or relocated without fair selection, proper consultation or clear communication, so employees challenge the process and morale falls.

Who or what is affected: Employees, employee representatives and managers

Causes

Time pressure, unclear selection criteria and managers who are not trained in the process.

Consequences

Employment claims, delays, reputational harm and lost goodwill.

Existing controls

  • Role changes are reviewed by HR before any announcement.
  • A standard consultation timetable is used for each site.

Control gaps

Selection scores are not checked by a second person before decisions are made.

Additional controls

  • Prevent: Apply written selection criteria and test them for consistency before any decision is made.
  • Respond: Offer a named contact and a review route to each affected employee.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: HR business partner Target: Within 45 days Early warning: Complaints or grievances about selection raised within one function.
H07

Supplier and contract disruption from change of control

Supplier Before 12 After 6

Key supplier or customer contracts contain change of control or termination rights that the deal or restructuring triggers, so essential services can stop.

Who or what is affected: Operations teams, customers and shared suppliers

Causes

Shared suppliers with exclusive terms and contracts that were not reviewed for deal triggers.

Consequences

Service interruption, higher costs, lost customers and legal dispute.

Existing controls

  • Contracts are listed in a central register.
  • Major contracts are reviewed by legal before signing.

Control gaps

Clauses are reviewed only after a supplier raises an issue.

Additional controls

  • Prevent: Review change of control and termination clauses and seek written waivers before completion.
  • Detect: Track supplier performance and payment disputes weekly during integration.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Procurement lead Target: Within 30 days Early warning: A supplier or customer asking about its rights after the announcement.
H08

Reputational harm and poor stakeholder communication

Reputational Before 9 After 4

Staff, customers and the market hear different messages about the deal and restructuring, so trust falls and rumors spread faster than the facts.

Who or what is affected: Employees, customers, investors and the public

Causes

Leaks, mixed messages from different leaders and slow answers to questions.

Consequences

Loss of trust, customer churn, staff anxiety and unwanted media attention.

Existing controls

  • A holding statement is agreed before announcement.
  • Managers are briefed before staff hear the news.

Control gaps

No owner is named for social media and there is no escalation route for sensitive questions.

Additional controls

  • Prevent: Publish a single communication plan with approved messages and a named spokesperson.
  • Respond: Keep a question log and answer each query within an agreed period.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Corporate communications lead Target: Within 30 days Early warning: Repeated questions in one channel that the approved message does not answer.

Rating method and evaluation

Each risk is rated on two five-point scales. Likelihood runs from Rare to Almost certain, and impact runs from Insignificant to Catastrophic, with impact judged on lost value, cost, delay, legal exposure, harm to people and damage to trust. Multiplying the two gives a score from 1 to 25, which falls into one of four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. The score orders work and does not measure it. Inherent risk is the score before any controls, and residual risk is the score after existing and added controls are working. A residual score can never be higher than the inherent score, and where inherent is 10 or more, residual must be lower. Anything still High or Critical needs a senior sponsor and a dated plan, anything Medium needs routine controls with a named owner, and anything Low is accepted and watched. Ratings are challenged by the people who do the work, by a second reviewer outside the deal team, and by the board at each stage gate. A rating is reviewed whenever a warning indicator reaches its threshold or the deal terms change.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 3 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Due diligence items open past their agreed date without a documented waiver.Escalate to the deal lead when any item is more than 14 days late, and to the deal sponsor after 30 days.
Systems migration tests that fail or show unreconciled records.Escalate to the IT lead at once and hold cutover until the failure is resolved and retested.
Key employees resigning or giving notice within the first six months after completion.Escalate to the HR business partner within two working days, and to the deal sponsor if two or more are lost from one function.
Key customers or suppliers invoking change of control or termination rights.Escalate to the general counsel and deal lead within one working day, and to the board if revenue at risk exceeds the agreed limit.
Unresolved concerns raised through staff or customer channels about the restructuring.Escalate to the compliance officer within three working days, and to the board if a concern points to a possible legal breach.

Contingency arrangements

If a serious event occurs, such as a data breach during migration, a key customer or supplier withdrawing, or a legal challenge to the restructuring, the integration lead pauses the affected workstream and informs the deal sponsor and the board. The IT lead isolates affected systems and restores data from the latest tested backup. The general counsel makes all regulator and employee representative contacts, as required in the relevant jurisdiction. Cash and payment commitments are protected by a standby funding plan, and staff and customers receive clear, early information.

Prioritized action plan

  1. Complete a documented due diligence checklist with sign-off, owner deal lead, within 30 days.
  2. Verify a full data map and migration plan before any system is switched, owner IT lead, within 45 days.
  3. Agree a retention plan for named key people with a written handover, owner HR business partner, within 60 days.
  4. Review change of control and termination clauses in all key supplier and customer contracts, owner general counsel, within 30 days.
  5. Publish a single communication plan for staff, customers and suppliers, owner corporate communications lead, within 45 days.

Conclusion

Successful deals depend on steady habits: evidence based valuation, a verified data map, named owners for every workstream, a retention plan for key people and a clear communication plan. The highest scores sit with overpayment, data loss and legal breach, and each has actions that bring the residual score down. Treat the register as a living record, review it at every stage gate, and seek qualified legal, tax, accounting and employment advice for any real transaction.

Assumptions and limitations

Assumptions

  • The acquirer is a private group with a board that approves the deal and any restructuring plan.
  • Jurisdiction is not specified, so legal and employment duties are described in general terms only.
  • The target holds customer data and uses cloud and on-site systems that have not yet been fully mapped.

Limitations

  • The scores are examples for learning and do not describe any real transaction or business.
  • Deal, tax, employment and data protection rules differ by country and change over time, so specialist legal and accounting review is needed.
  • This is educational content and does not replace a formal site-specific assessment or licensed advice.

Related frameworks to study

  • Deal stage gate review with defined go and no go decisions
  • Post-merger integration planning across people, process, technology and customers
  • Three lines model of risk ownership

Finance Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Mergers, Acquisitions and Corporate Restructuring course Read the best practices for this course

More Finance risk assessments

Hourly Active: 45,552 Learners