Table of Contents
For SME owners considering a sale, the recent capital gains tax (CGT) increases announced in the Budget pose new challenges.
According to Ed Bartlett, CEO of leading compliance provider Hicomply, one of the biggest risks to business valuation during due diligence lies in cybersecurity and compliance standards.
“Cybersecurity and compliance have become critical to maintaining and maximizing business value,” Bartlett explains. “Buyers and investors are now more cautious than ever, and poor security management or a lack of certifications such as ISO 27001 can significantly erode value or even derail deals completely.”
In an increasingly stringent deal landscape, SME owners must be proactive in addressing cybersecurity risks, which are increasingly scrutinized as part of due diligence processes. Investors are no longer content with addressing cybersecurity gaps post-transaction; these concerns are now deal-critical.
Cybersecurity failures can have far-reaching implications for valuation, especially in sectors such as technology, financials, healthcare and retail. The average cost of a cyber attack on SMEs in the UK is around £75,000, with even higher risks in high-value sectors.
Industry-specific costs for cyber attacks according to IBM’s 2023 Cost of a Data Breach Report:
- Finance and insurance: over £4 million per incident.
- Healthcare: approximately £3.2 million.
- Retail and e-commerce: approximately £2 million.
- Technology and software: approximately £2.5 million per breach.
Bartlett warns that such breaches not only affect profitability and operations, but also tarnish a company’s reputation, making it less attractive to potential buyers.
“Investors see cybersecurity negligence as a liability,” Bartlett notes. “Both private equity firms and trade buyers are increasingly unwilling to overlook security shortcomings. For some it has become a criterion when closing deals.”
Certifications to stimulate appreciation
Meeting recognized standards such as ISO 27001 or Cyber Essentials can significantly improve business valuation. Research shows that ISO-certified companies often command 10-20% higher valuations than non-certified counterparts, reflecting the confidence these certifications inspire among buyers.
“Cybersecurity is not just about protection; it is about showing resilience and preparedness,” Bartlett emphasizes. “Companies that proactively achieve these certifications send a clear signal of their commitment to robust security practices, streamlining the due diligence process and attracting premium valuations.”
Steps to Secure Value
To help SMB owners prepare for sale, Bartlett recommends:
- Conduct cybersecurity audits: discover vulnerabilities before potential buyers do.
- Pursue ISO certification: Demonstrate internationally recognized security practices.
- Adopt Cyber Essentials: Get Basic Protection for Smaller Budgets.
- Train employees: reduce the risks of human error.
- Improve physical security: Strengthen access controls to critical IT systems.
- Consult experts: tailor your cybersecurity strategy to the needs of businesses and investors.
Adapting to the new tax landscape
In the post-CGT surge era, cybersecurity and compliance have shifted from operational concerns to strategic imperatives. For SME owners planning a sale, investing in these areas is not only advisable; it is essential.
“The stakes have risen,” Bartlett concludes. “To preserve and grow value, companies must adapt quickly to meet the higher expectations of today’s buyers and investors. Cybersecurity and compliance are no longer optional – they are critical.”