Crescent Capital Advisors

What a PRISM report contains.

Most technology diligence reports end in a color rating, while a PRISM report assigns every finding a deal action. This page shows the structure of the deliverable (the sections, the scoring, the classification, and the evidence discipline) without the substance of any one engagement. The sample is published on this page.

Illustrative composite: not derived from any single engagement.

The report has fifteen sections and one consolidated risk register.

A full-scope PRISM report follows the same structure every time. Every finding in Sections 4 through 11 is recorded in a single rated register in Section 13, so nothing observed is lost between the assessment and the deal. The section list shows the depth:

  1. 01Executive Summary
  2. 02Deal Context & Scope of Review
  3. 03PRISM Scorecard
  4. 04Portfolio Fit Findings
  5. 05Risk Quantification: Cybersecurity, OT/ICS & Compliance Exposure
  6. 06Infrastructure & Engineering Findings
  7. 07Strategic Data Assets: Data, Analytics & Digital Maturity
  8. 08Management & Execution Capacity Findings
  9. 09Disaster Recovery & Business Continuity
  10. 10Contracts, Licensing & Vendor Risk
  11. 11Technology-Linked Compliance Findings & Specialist Coordination
  12. 12Financial Exposure Summary
  13. 13Consolidated Risk Register
  14. 14100-Day Plan & Recommendations
  15. 15Appendix: Methodology, Data Room Index & Limitations

Five dimension scores are combined into one composite score.

Each of the five PRISM dimensions is scored 0 to 100. The scores are combined into a composite that places the asset in a band. The band tells the sponsor what the technology means for the deal, from an asset worth paying for to a risk that has to be priced or walked away from.

P

Portfolio Fit

Can the technology support the investment thesis?

R

Risk Quantification

What technology risks create financial exposure?

I

Infrastructure & Engineering

Can the platform scale with the plan?

S

Strategic Data Assets

Can the data create value?

M

Management & Execution

Can this team deliver the thesis?

80–100Technology StrengthAn asset. The work is value creation, not remediation.
60–79Technology ReadySound foundation. Targeted work supports the thesis.
40–59Technology RiskPriced remediation required. The 100-day plan is critical.
20–39Technology LiabilityMaterial exposure that changes the offer, the terms, or both.
0–19Technology Deal RiskA thesis-level problem. The question becomes whether to proceed.

Four classifications that turn a finding into a deal action.

Illustrative composite: representative findings, de-identified.

Every material finding is assigned a transaction classification, a timeline, and a confidence level, so it leads to a decision instead of remaining an observation. One representative example of each classification:

GATE

OT/IT network segmentation is absent

A flat network across the plants means a single compromised office endpoint reaches the plant floor. This must be resolved or contractually protected before close: validated interim controls, a funded remediation plan, an accountable owner, and appropriate escrow or holdback.

Impact
Pre-close protection required
Timeline
4–6 months to full remediation
Confidence
High
PRICE

ERP is fragmented across three footprints

One acquired site runs an unsupported, unintegrated legacy system that forces a manual monthly consolidation. The remediation cost and the integration exposure change the offer through purchase price, escrow, or indemnity, not the post-close plan.

Impact
Negotiated into the offer
Timeline
9–12 months
Confidence
Medium, pending partner scoping
THESIS

Digital maturity cannot support the margin plan

The underwritten operating-margin improvement depends on shop-floor visibility and scrap reduction the current stack cannot produce as it stands. A Phase 1 systems investment is a prerequisite to the value creation plan, not a discretionary upgrade.

Impact
Changes what the plan can achieve, and by when
Timeline
Hold-period, Phase 1 first
Confidence
High
LEVER

Automation upside, sequenced after the foundation

Once shop-floor data capture is standardized, machine-vision defect detection and predictive maintenance become quantifiable operating upside. It is modeled, then excluded from base underwriting until a pilot validates it.

Impact
Quantified value creation opportunity
Timeline
18–24 months, pilot-gated
Confidence
Validated before it is underwritten

Every number is given a confidence level.

Confidence reflects how an estimate was derived, not how serious the finding is. It separates a number a sponsor can underwrite from a number that needs a named validation step before it is used to set purchase price.

High confidence

Grounded in direct invoices, current vendor pricing, unit counts, contractual terms, or management-validated operating data.

Medium confidence

Suitable for initial underwriting, but the report names the specific validation step required before the figure is used for final price, escrow, or capital-plan decisions.

Low confidence

A directional scenario, flagged as such, that should not be included in base underwriting.

What we did not assess

Every report states what was reviewed, what was not independently validated, and which specialist workstreams sit outside the technology scope (environmental and legal, asset-condition engineering, commercial diligence, and financial-statement diligence). The sponsor can then see which confirmatory work is still outstanding and who owns it.

An excerpt from the executive summary.

Illustrative composite excerpt.

A composite mid-market precision-manufacturing platform, assessed for a buy-and-build thesis. The technology estate is functional and has supported steady performance. It was built incrementally across three decades and one tuck-in acquisition without a unifying architecture. It was not built to support the margin-improvement thesis the sponsor is underwriting. Composite PRISM Score: 45 / 100, Technology Risk. This places the target in the band where priced remediation is required. The 100-day plan is critical to whether the investment thesis is achievable on the underwritten timeline. Recommendation: proceed with conditions.

Frequently asked questions.

Do I need to ask for the sample report?

No. The sample is published on this page, with no form and no download gate. Read it here, and contact us when you have a live transaction to discuss.

Is this a real company?

No. The sample is a fictional composite built to demonstrate the format and the depth. The findings, figures, and company are representative and are not derived from any single engagement. In a live engagement, every conclusion is validated against management interviews, documentary evidence, and vendor quotations.

How is this different from a code review or a Big-4 technology diligence?

A code review tells you whether the code is messy. A Big-4 assessment gives you a thorough checklist. Neither tells you what the finding means for the deal. PRISM classifies every finding as GATE, PRICE, THESIS, or LEVER and ties it to price, terms, or the 100-day plan. It is written by an operator who has held P&L responsibility, for a sponsor who has to make an offer.

How long does a real engagement take?

Core diligence is typically seven to ten business days after a substantially complete data room and timely access to management. Multi-site coverage, passive OT asset discovery, specialist certification review, and detailed value-creation modeling are scoped to the transaction thesis, deal structure, and timeline.

Talk to us about a live transaction.

Tell us the situation in a few lines, and we will tell you whether a PRISM assessment fits. Sujit reads every note.