“Management should improve security after close” is not a deal term. It is a hope with no owner.
1. State the business consequence
Translate the finding into a transaction outcome: revenue interruption, data liability, inability to separate, dependency on a founder, customer breach, change-of-control failure, integration cost or loss of evidence.
2. Establish the evidence
Record the system, affected assets, factual observation, management explanation, test performed and uncertainty. Separate confirmed exposure from extrapolation. Counsel cannot draft cleanly from an adjective such as “weak.”
3. Choose the mechanism
- Condition precedent when risk must be removed before control transfers.
- Specific indemnity when a defined historic exposure may crystallise later.
- Holdback or escrow when remediation evidence will arrive after close.
- Covenant when work can safely occur later under named obligations and dates.
- Price or structure adjustment when the issue changes expected value or capital need.
- Integration restriction when connection would import the exposure.
4. Define acceptance evidence
Name what proves completion: provider confirmation, revocation record, independent test, restored backup, executed assignment, customer consent or clean separation rehearsal. Avoid “to buyer’s satisfaction” where a measurable state is available.
5. Preserve leverage
Give the term an owner, deadline, reporting right, consequence of failure and survival period. If the seller controls all evidence and the buyer has no inspection right, the term is weak.
Deal-term card
Finding; consequence; affected value; mechanism; responsible party; deadline; acceptance evidence; failure consequence; residual risk. Attach it to both the technical report and the legal drafting list so the finding cannot disappear between teams.