€4M in Regulatory Risk Identified Before the Ink Dried

Situation

Affirma Capital was evaluating three portfolio companies across the consumer goods and professional services sectors. Each target carried a significant Salesforce implementation as core operational infrastructure: CRM, sales operations, service management, and in one case a custom-built customer portal on Experience Cloud. Sellers in all three deals presented the implementations as production-ready, fully configured, and compliant with applicable data protection regulations.

The investment thesis on each company depended partly on the operational efficiency that Salesforce was supposed to enable. If the implementations were technically sound, they were an accelerant for growth. If they carried hidden technical debt, compliance risk, or architectural problems that would require remediation, the post-acquisition cost model and integration timeline shifted materially.

The structural issue is that Salesforce as an asset in M&A due diligence sits in a blind spot. Standard financial and legal review does not reach it. Auditors read financials, lawyers read contracts, and nobody assesses whether the org is a liability. The seller controls the narrative. Sellers have no incentive to surface problems that would reduce their valuation.

Challenge

Three portfolio companies, three different Salesforce profiles, all needed reading inside the deal timeline.

Company A, consumer goods, €180M ARR. The org presented well from the outside: custom-branded UI, clean-looking pipeline reports, what appeared to be a well-configured Sales Cloud. The reality underneath was different. Over 400 inactive custom fields cluttered the schema. The org ran 12 active Apex triggers, six of them with no error handling, meaning a single malformed record could cascade into a full transaction failure. Data quality was poor: 34 percent of Account records had missing or invalid postal codes, 22 percent had duplicate email addresses. Five years of Salesforce use, zero data quality initiatives.

Company B, professional services, €95M ARR. A more recent implementation with significantly better code quality. The primary finding was compliance. The org processed personal data of EU citizens but had not implemented the data retention policies required under GDPR. Records were being kept indefinitely with no automated deletion or anonymisation. The privacy impact assessment had never been completed. Remediation cost was estimated at €200K plus legal fees, with regulatory enquiry risk if the gap came to light post-close.

Company C, consumer services, €62M ARR. The Experience Cloud customer portal had been built by a boutique SI that was no longer in business. The codebase was entirely undocumented: 40,000 lines of custom Visualforce and Apex that nobody in the company could maintain. The Experience Cloud licensing was misconfigured, with Community licenses assigned to users who required full Salesforce licenses, creating a retroactive license compliance issue estimated at €350K.

Action

The assessment methodology was built for M&A timelines: high-signal, fast to execute, with findings structured for non-technical decision-makers.

Every finding was categorised by severity (Critical / High / Medium / Low) and sized in three dimensions: direct remediation cost, ongoing operational risk, and deal risk (findings that could affect deal completion or valuation). Findings were presented as ranges, not point estimates, because honesty about uncertainty matters more in investment decisions than the false precision of a single number.

Brief delivered to the investment committee on Company A

The integration layer is not production-ready. Rebuilding it post-acquisition costs 800K to 1.2M euros and adds six months to the integration timeline. That is not a remediation. That is a price negotiation.

Result

The assessment surfaced €4M in combined risk exposure across the three portfolio companies, risks that were entirely absent from seller documentation and from the standard due diligence process.

Company A’s integration layer risk and data quality issues were factored into the acquisition negotiation, producing a price adjustment. The post-acquisition integration timeline was extended by six months, preventing the buyer from committing to a Day 1 target that was structurally impossible. Company B’s GDPR compliance gap led to a specific warranty and indemnification clause covering any regulatory action arising from data retained before close. Company C’s license compliance issue was resolved pre-close, with the seller funding the retroactive license reconciliation as a condition of deal completion.

The assessments were delivered in 11 weeks across all three companies, inside the deal timeline. Findings were structured as a prioritised remediation roadmap that transitioned directly into the post-acquisition 100-day integration plan. The buyer teams went into Day 1 knowing what needed fixing, in what order, and at what cost.

Reflection

This pattern works when Salesforce is core operational infrastructure on the target, not a peripheral system. The cost of independent assessment is small relative to the deal; the cost of inheriting a hidden integration debt, a GDPR gap, or a license compliance issue is not. It works less well when Salesforce is barely used or running a vanilla Sales Cloud instance with no integrations, where the upside on findings is bounded.

Worth doing earlier: starting the read in parallel with legal due diligence, not after. The Salesforce findings often inform clauses the lawyers need to draft. Sequencing them in series adds two weeks to the deal timeline that nobody has.

The pattern that does not transfer: trying to compress this into a one-day org health checkup. The 60-point methodology covers the surfaces where M&A-relevant risk hides. Skipping integration architecture or compliance to save time produces findings that look credible and miss the money.