M&A · Mergers

The Combined Operating Model before Day One: Decisions that Cannot Wait for Closing

A lawful pre-close design framework linking the future operating model, Day One controls, synergy ownership and implementation readiness.

The Combined Operating Model before Day One: Decisions that Cannot Wait for Closing
Quick answer

Separate lawful pre-close design from implementation; map current operating models and closing dependencies; define design principles, leadership interfaces, decision rights, customer ownership, finance, data, technology, controls and shared services; assign net synergy ownership; rehearse the Day One minimum viable model; then retain a closing-ready operating-model certificate.

Abstract

Merger leaders face a narrow pre-close design problem. Waiting until closing to choose governance, leadership interfaces, customer ownership, financial controls, data boundaries, system access and synergy accountabilities can waste the first months of ownership. Implementing those choices early can create gun-jumping, information-sharing, employment, privacy, regulatory and execution risk. This paper develops a lawful pre-close operating-model framework for decisions that cannot wait for Day One.

It separates design from implementation; maps closing conditions and interim restrictions; defines a decision taxonomy and design authority; establishes the target model across customer propositions, value streams, organisation, governance, entities, workforce, finance, data, technology, controls and shared services; and converts the design into Day One and first-100-day releases.

Five figures and five tables present the decision-rights boundary, operating-model dependency map, Day One critical path, synergy-accountability architecture and closing-ready operating-model certificate. The framework draws on current merger-control, interim-measures, information-exchange, cybersecurity, privacy, financial-reporting, employment and operational-resilience sources. Eight frequently asked questions and twenty-eight primary or authoritative references support application.

Numerical values are illustrative analytical scenarios. Transaction-specific conclusions require verified transaction terms, regulatory status, interim restrictions, employee processes, licences, contracts, systems, controls and jurisdiction-specific advice from competition, legal, regulatory, employment, privacy, cyber, accounting, tax and other specialists.

JEL Classification: G34, L22, M10, M14, D23

Keywords: operating model, Day One, merger integration, pre-close planning, decision rights, synergy ownership, hold separate, governance, systems integration, M&A

This Matchpoint Insight presents the web edition of Matchpoint Partners' research. The supporting paper contains the full framework, structures, worked examples and source material.

Read the full research paper   Explore our None practice

1. Set the board's design mandate

The merger leadership team should define value objectives, legal boundaries, design scope, decision rights, evidence standards, timetable and escalation thresholds. The required output is a board-approved pre-close operating-model mandate. Record the design question, current-state evidence, future-state choice, legal boundary, dependency, owner, reviewer and approval status [1][2].

Translate the choice into a controlled operating-model release. Separate lawful pre-close analysis from implementation; specify what can be prepared, what triggers at closing and what remains a post-close management decision. Link organisation, process, data, systems, controls, people, cost and customer consequences.

The principal risk is that teams can confuse permission to plan with authority to implement. Quantify revenue exposure, service continuity, critical roles, cost, cash, control effectiveness, cyber risk, synergy timing and residual risk across base, delayed and remediated cases.

Retain source data, current-state maps, design options, legal advice, approvals, assumptions, dependencies, rehearsal evidence, exceptions and change records. Refresh after material developments and expire provisional decisions that no longer fit the closing path.

2. Separate design from implementation

The merger leadership team should classify analysis, recommendation, preparation, access, communication, commitment and execution activities. The required output is a design-versus-control boundary map. Record the design question, current-state evidence, future-state choice, legal boundary, dependency, owner, reviewer and approval status [1][3].

Translate the choice into a controlled operating-model release. Separate lawful pre-close analysis from implementation; specify what can be prepared, what triggers at closing and what remains a post-close management decision. Link organisation, process, data, systems, controls, people, cost and customer consequences.

The principal risk is that a planning workstream can direct the target's competitive conduct. Quantify revenue exposure, service continuity, critical roles, cost, cash, control effectiveness, cyber risk, synergy timing and residual risk across base, delayed and remediated cases.

Retain source data, current-state maps, design options, legal advice, approvals, assumptions, dependencies, rehearsal evidence, exceptions and change records. Refresh after material developments and expire provisional decisions that no longer fit the closing path.

Figure 1. Design-to-control boundary
Figure 1. Design-to-control boundary

Illustrative analytical scenario; verified transaction evidence should replace index values.

3. Map the closing pathway

The merger leadership team should record filings, approvals, shareholder actions, financing, remedies, long-stop dates and plausible timing ranges. The required output is a condition and timing map. Record the design question, current-state evidence, future-state choice, legal boundary, dependency, owner, reviewer and approval status [4][5].

Translate the choice into a controlled operating-model release. Separate lawful pre-close analysis from implementation; specify what can be prepared, what triggers at closing and what remains a post-close management decision. Link organisation, process, data, systems, controls, people, cost and customer consequences.

The principal risk is that the model can assume a date or perimeter that remains conditional. Quantify revenue exposure, service continuity, critical roles, cost, cash, control effectiveness, cyber risk, synergy timing and residual risk across base, delayed and remediated cases.

Retain source data, current-state maps, design options, legal advice, approvals, assumptions, dependencies, rehearsal evidence, exceptions and change records. Refresh after material developments and expire provisional decisions that no longer fit the closing path.

4. Create the decision taxonomy

The merger leadership team should distinguish current-party decisions, conditional recommendations, reversible preparation, closing actions and post-close choices. The required output is a governed decision register. Record the design question, current-state evidence, future-state choice, legal boundary, dependency, owner, reviewer and approval status [2][6].

Translate the choice into a controlled operating-model release. Separate lawful pre-close analysis from implementation; specify what can be prepared, what triggers at closing and what remains a post-close management decision. Link organisation, process, data, systems, controls, people, cost and customer consequences.

The principal risk is that provisional choices can harden into unauthorised commitments. Quantify revenue exposure, service continuity, critical roles, cost, cash, control effectiveness, cyber risk, synergy timing and residual risk across base, delayed and remediated cases.

Retain source data, current-state maps, design options, legal advice, approvals, assumptions, dependencies, rehearsal evidence, exceptions and change records. Refresh after material developments and expire provisional decisions that no longer fit the closing path.

Table 1. Pre-close decision taxonomy

Decision classPermitted outputControl
current-partyindependent actionown authority
conditional designrecommendationno implementation
reversible preparationready artefactlegal approval
closing actioncutover stepcontrol transfer

Illustrative structure; verified transaction evidence and specialist review govern.

5. Define operating-model principles

The merger leadership team should agree customer, value, accountability, control, simplicity, resilience and local-autonomy principles. The required output is a ranked design-principles scorecard. Record the design question, current-state evidence, future-state choice, legal boundary, dependency, owner, reviewer and approval status [7][8].

Translate the choice into a controlled operating-model release. Separate lawful pre-close analysis from implementation; specify what can be prepared, what triggers at closing and what remains a post-close management decision. Link organisation, process, data, systems, controls, people, cost and customer consequences.

The principal risk is that functions can optimise locally without a coherent enterprise model. Quantify revenue exposure, service continuity, critical roles, cost, cash, control effectiveness, cyber risk, synergy timing and residual risk across base, delayed and remediated cases.

Retain source data, current-state maps, design options, legal advice, approvals, assumptions, dependencies, rehearsal evidence, exceptions and change records. Refresh after material developments and expire provisional decisions that no longer fit the closing path.

6. Establish the design authority

The merger leadership team should set sponsor, integration leader, functional owners, clean teams, advisers, challenge and approval forums. The required output is a pre-close design governance map. Record the design question, current-state evidence, future-state choice, legal boundary, dependency, owner, reviewer and approval status [1][9].

Translate the choice into a controlled operating-model release. Separate lawful pre-close analysis from implementation; specify what can be prepared, what triggers at closing and what remains a post-close management decision. Link organisation, process, data, systems, controls, people, cost and customer consequences.

The principal risk is that decisions can be made without accountable owners or lawful access. Quantify revenue exposure, service continuity, critical roles, cost, cash, control effectiveness, cyber risk, synergy timing and residual risk across base, delayed and remediated cases.

Retain source data, current-state maps, design options, legal advice, approvals, assumptions, dependencies, rehearsal evidence, exceptions and change records. Refresh after material developments and expire provisional decisions that no longer fit the closing path.

7. Baseline both operating models

The merger leadership team should document structures, value streams, decision rights, capabilities, systems, costs, controls and service levels independently. The required output is a comparable current-state evidence pack. Record the design question, current-state evidence, future-state choice, legal boundary, dependency, owner, reviewer and approval status [7][10].

Translate the choice into a controlled operating-model release. Separate lawful pre-close analysis from implementation; specify what can be prepared, what triggers at closing and what remains a post-close management decision. Link organisation, process, data, systems, controls, people, cost and customer consequences.

The principal risk is that the louder organisation can become the undocumented default. Quantify revenue exposure, service continuity, critical roles, cost, cash, control effectiveness, cyber risk, synergy timing and residual risk across base, delayed and remediated cases.

Retain source data, current-state maps, design options, legal advice, approvals, assumptions, dependencies, rehearsal evidence, exceptions and change records. Refresh after material developments and expire provisional decisions that no longer fit the closing path.

8. Anchor the customer promise

The merger leadership team should define which customer outcomes, service commitments and trust attributes the combined model must protect. The required output is a customer-promise control statement. Record the design question, current-state evidence, future-state choice, legal boundary, dependency, owner, reviewer and approval status [11][12].

Translate the choice into a controlled operating-model release. Separate lawful pre-close analysis from implementation; specify what can be prepared, what triggers at closing and what remains a post-close management decision. Link organisation, process, data, systems, controls, people, cost and customer consequences.

The principal risk is that internal integration convenience can weaken the external proposition. Quantify revenue exposure, service continuity, critical roles, cost, cash, control effectiveness, cyber risk, synergy timing and residual risk across base, delayed and remediated cases.

Retain source data, current-state maps, design options, legal advice, approvals, assumptions, dependencies, rehearsal evidence, exceptions and change records. Refresh after material developments and expire provisional decisions that no longer fit the closing path.

9. Map end-to-end value streams

The merger leadership team should connect demand, sales, fulfilment, service, cash, product and support across organisational boundaries. The required output is a value-stream dependency map. Record the design question, current-state evidence, future-state choice, legal boundary, dependency, owner, reviewer and approval status [7][13].

Translate the choice into a controlled operating-model release. Separate lawful pre-close analysis from implementation; specify what can be prepared, what triggers at closing and what remains a post-close management decision. Link organisation, process, data, systems, controls, people, cost and customer consequences.

The principal risk is that functional charts can conceal broken handoffs and duplicated accountability. Quantify revenue exposure, service continuity, critical roles, cost, cash, control effectiveness, cyber risk, synergy timing and residual risk across base, delayed and remediated cases.

Retain source data, current-state maps, design options, legal advice, approvals, assumptions, dependencies, rehearsal evidence, exceptions and change records. Refresh after material developments and expire provisional decisions that no longer fit the closing path.

10. Choose organisation layers

The merger leadership team should define enterprise, business, geography, product, customer and shared-service accountabilities. The required output is an organisation-layer blueprint. Record the design question, current-state evidence, future-state choice, legal boundary, dependency, owner, reviewer and approval status [7][14].

Translate the choice into a controlled operating-model release. Separate lawful pre-close analysis from implementation; specify what can be prepared, what triggers at closing and what remains a post-close management decision. Link organisation, process, data, systems, controls, people, cost and customer consequences.

The principal risk is that matrix complexity can multiply approvals without improving control. Quantify revenue exposure, service continuity, critical roles, cost, cash, control effectiveness, cyber risk, synergy timing and residual risk across base, delayed and remediated cases.

Retain source data, current-state maps, design options, legal advice, approvals, assumptions, dependencies, rehearsal evidence, exceptions and change records. Refresh after material developments and expire provisional decisions that no longer fit the closing path.

11. Design leadership interfaces

The merger leadership team should specify roles, spans, reserved matters, interim appointments, succession and conflict protocols. The required output is a leadership-interface map. Record the design question, current-state evidence, future-state choice, legal boundary, dependency, owner, reviewer and approval status [15][16].

Translate the choice into a controlled operating-model release. Separate lawful pre-close analysis from implementation; specify what can be prepared, what triggers at closing and what remains a post-close management decision. Link organisation, process, data, systems, controls, people, cost and customer consequences.

The principal risk is that title allocation can precede capability and accountability design. Quantify revenue exposure, service continuity, critical roles, cost, cash, control effectiveness, cyber risk, synergy timing and residual risk across base, delayed and remediated cases.

Retain source data, current-state maps, design options, legal advice, approvals, assumptions, dependencies, rehearsal evidence, exceptions and change records. Refresh after material developments and expire provisional decisions that no longer fit the closing path.

12. Set decision rights

The merger leadership team should assign recommend, decide, execute, challenge and inform roles for value-critical decisions. The required output is a decision-rights matrix. Record the design question, current-state evidence, future-state choice, legal boundary, dependency, owner, reviewer and approval status [7][17].

Translate the choice into a controlled operating-model release. Separate lawful pre-close analysis from implementation; specify what can be prepared, what triggers at closing and what remains a post-close management decision. Link organisation, process, data, systems, controls, people, cost and customer consequences.

The principal risk is that shared accountability can leave urgent decisions ownerless. Quantify revenue exposure, service continuity, critical roles, cost, cash, control effectiveness, cyber risk, synergy timing and residual risk across base, delayed and remediated cases.

Retain source data, current-state maps, design options, legal advice, approvals, assumptions, dependencies, rehearsal evidence, exceptions and change records. Refresh after material developments and expire provisional decisions that no longer fit the closing path.

Figure 2. Operating-model dependency map
Figure 2. Operating-model dependency map

Illustrative analytical scenario; verified transaction evidence should replace index values.

13. Design governance forums

The merger leadership team should define purpose, membership, inputs, thresholds, cadence, minutes and escalation for each forum. The required output is a governance operating calendar. Record the design question, current-state evidence, future-state choice, legal boundary, dependency, owner, reviewer and approval status [7][18].

Translate the choice into a controlled operating-model release. Separate lawful pre-close analysis from implementation; specify what can be prepared, what triggers at closing and what remains a post-close management decision. Link organisation, process, data, systems, controls, people, cost and customer consequences.

The principal risk is that meetings can proliferate while decisions slow. Quantify revenue exposure, service continuity, critical roles, cost, cash, control effectiveness, cyber risk, synergy timing and residual risk across base, delayed and remediated cases.

Retain source data, current-state maps, design options, legal advice, approvals, assumptions, dependencies, rehearsal evidence, exceptions and change records. Refresh after material developments and expire provisional decisions that no longer fit the closing path.

14. Map legal entities and authorities

The merger leadership team should reconcile boards, delegations, signatories, bank mandates, licences, contracts and statutory duties. The required output is a legal-to-operating authority bridge. Record the design question, current-state evidence, future-state choice, legal boundary, dependency, owner, reviewer and approval status [19][20].

Translate the choice into a controlled operating-model release. Separate lawful pre-close analysis from implementation; specify what can be prepared, what triggers at closing and what remains a post-close management decision. Link organisation, process, data, systems, controls, people, cost and customer consequences.

The principal risk is that a target model can require powers the entity or manager does not hold. Quantify revenue exposure, service continuity, critical roles, cost, cash, control effectiveness, cyber risk, synergy timing and residual risk across base, delayed and remediated cases.

Retain source data, current-state maps, design options, legal advice, approvals, assumptions, dependencies, rehearsal evidence, exceptions and change records. Refresh after material developments and expire provisional decisions that no longer fit the closing path.

Table 2. Operating-model layer matrix

LayerCore questionEvidence
enterprisewhat is centralreserved matters
businesswho owns valueP&L and capabilities
geographywhat remains locallicence and customer need
shared servicewhat is standardservice catalogue

Illustrative structure; verified transaction evidence and specialist review govern.

15. Protect licences and regulated activities

The merger leadership team should identify notifications, approvals, controllers, responsible persons, ring-fences and conduct requirements. The required output is a regulatory continuity plan. Record the design question, current-state evidence, future-state choice, legal boundary, dependency, owner, reviewer and approval status [4][21].

Translate the choice into a controlled operating-model release. Separate lawful pre-close analysis from implementation; specify what can be prepared, what triggers at closing and what remains a post-close management decision. Link organisation, process, data, systems, controls, people, cost and customer consequences.

The principal risk is that a centralised model can breach licence perimeter or local accountability. Quantify revenue exposure, service continuity, critical roles, cost, cash, control effectiveness, cyber risk, synergy timing and residual risk across base, delayed and remediated cases.

Retain source data, current-state maps, design options, legal advice, approvals, assumptions, dependencies, rehearsal evidence, exceptions and change records. Refresh after material developments and expire provisional decisions that no longer fit the closing path.

16. Set brand and channel architecture

The merger leadership team should decide conditional brand roles, migration criteria, customer channels and transition evidence. The required output is a brand-and-channel option map. Record the design question, current-state evidence, future-state choice, legal boundary, dependency, owner, reviewer and approval status [1][11].

Translate the choice into a controlled operating-model release. Separate lawful pre-close analysis from implementation; specify what can be prepared, what triggers at closing and what remains a post-close management decision. Link organisation, process, data, systems, controls, people, cost and customer consequences.

The principal risk is that premature convergence can destroy local trust or imply completion. Quantify revenue exposure, service continuity, critical roles, cost, cash, control effectiveness, cyber risk, synergy timing and residual risk across base, delayed and remediated cases.

Retain source data, current-state maps, design options, legal advice, approvals, assumptions, dependencies, rehearsal evidence, exceptions and change records. Refresh after material developments and expire provisional decisions that no longer fit the closing path.

17. Design the commercial model

The merger leadership team should map segments, propositions, coverage, pricing authority, incentives, pipeline and conflict rules. The required output is a post-close commercial blueprint. Record the design question, current-state evidence, future-state choice, legal boundary, dependency, owner, reviewer and approval status [3][22].

Translate the choice into a controlled operating-model release. Separate lawful pre-close analysis from implementation; specify what can be prepared, what triggers at closing and what remains a post-close management decision. Link organisation, process, data, systems, controls, people, cost and customer consequences.

The principal risk is that joint planning can expose sensitive information or coordinate competition. Quantify revenue exposure, service continuity, critical roles, cost, cash, control effectiveness, cyber risk, synergy timing and residual risk across base, delayed and remediated cases.

Retain source data, current-state maps, design options, legal advice, approvals, assumptions, dependencies, rehearsal evidence, exceptions and change records. Refresh after material developments and expire provisional decisions that no longer fit the closing path.

18. Protect customer ownership

The merger leadership team should define account continuity, relationship handoffs, consent, service evidence and escalation. The required output is a customer-transition register. Record the design question, current-state evidence, future-state choice, legal boundary, dependency, owner, reviewer and approval status [11][12].

Translate the choice into a controlled operating-model release. Separate lawful pre-close analysis from implementation; specify what can be prepared, what triggers at closing and what remains a post-close management decision. Link organisation, process, data, systems, controls, people, cost and customer consequences.

The principal risk is that customers can experience duplicate contact, silence or unapproved promises. Quantify revenue exposure, service continuity, critical roles, cost, cash, control effectiveness, cyber risk, synergy timing and residual risk across base, delayed and remediated cases.

Retain source data, current-state maps, design options, legal advice, approvals, assumptions, dependencies, rehearsal evidence, exceptions and change records. Refresh after material developments and expire provisional decisions that no longer fit the closing path.

19. Rationalise the product portfolio

The merger leadership team should classify retain, invest, integrate, migrate and retire options with customer and regulatory gates. The required output is a product decision portfolio. Record the design question, current-state evidence, future-state choice, legal boundary, dependency, owner, reviewer and approval status [7][23].

Translate the choice into a controlled operating-model release. Separate lawful pre-close analysis from implementation; specify what can be prepared, what triggers at closing and what remains a post-close management decision. Link organisation, process, data, systems, controls, people, cost and customer consequences.

The principal risk is that synergy assumptions can rely on product exits before evidence exists. Quantify revenue exposure, service continuity, critical roles, cost, cash, control effectiveness, cyber risk, synergy timing and residual risk across base, delayed and remediated cases.

Retain source data, current-state maps, design options, legal advice, approvals, assumptions, dependencies, rehearsal evidence, exceptions and change records. Refresh after material developments and expire provisional decisions that no longer fit the closing path.

20. Design service delivery

The merger leadership team should link capacity, locations, workflows, quality, resilience and service-level ownership. The required output is a delivery operating model. Record the design question, current-state evidence, future-state choice, legal boundary, dependency, owner, reviewer and approval status [8][13].

Translate the choice into a controlled operating-model release. Separate lawful pre-close analysis from implementation; specify what can be prepared, what triggers at closing and what remains a post-close management decision. Link organisation, process, data, systems, controls, people, cost and customer consequences.

The principal risk is that centralisation can save cost while lengthening recovery or response time. Quantify revenue exposure, service continuity, critical roles, cost, cash, control effectiveness, cyber risk, synergy timing and residual risk across base, delayed and remediated cases.

Retain source data, current-state maps, design options, legal advice, approvals, assumptions, dependencies, rehearsal evidence, exceptions and change records. Refresh after material developments and expire provisional decisions that no longer fit the closing path.

21. Design supply-chain ownership

The merger leadership team should map category authority, critical suppliers, concentration, continuity, contracting and change control. The required output is a supply-chain accountability map. Record the design question, current-state evidence, future-state choice, legal boundary, dependency, owner, reviewer and approval status [24][25].

Translate the choice into a controlled operating-model release. Separate lawful pre-close analysis from implementation; specify what can be prepared, what triggers at closing and what remains a post-close management decision. Link organisation, process, data, systems, controls, people, cost and customer consequences.

The principal risk is that procurement consolidation can create a single point of failure. Quantify revenue exposure, service continuity, critical roles, cost, cash, control effectiveness, cyber risk, synergy timing and residual risk across base, delayed and remediated cases.

Retain source data, current-state maps, design options, legal advice, approvals, assumptions, dependencies, rehearsal evidence, exceptions and change records. Refresh after material developments and expire provisional decisions that no longer fit the closing path.

22. Design workforce architecture

The merger leadership team should map roles, capabilities, locations, consultation, selection, retention, succession and workforce data. The required output is a workforce transition blueprint. Record the design question, current-state evidence, future-state choice, legal boundary, dependency, owner, reviewer and approval status [15][26].

Translate the choice into a controlled operating-model release. Separate lawful pre-close analysis from implementation; specify what can be prepared, what triggers at closing and what remains a post-close management decision. Link organisation, process, data, systems, controls, people, cost and customer consequences.

The principal risk is that organisation design can prejudice required employee processes. Quantify revenue exposure, service continuity, critical roles, cost, cash, control effectiveness, cyber risk, synergy timing and residual risk across base, delayed and remediated cases.

Retain source data, current-state maps, design options, legal advice, approvals, assumptions, dependencies, rehearsal evidence, exceptions and change records. Refresh after material developments and expire provisional decisions that no longer fit the closing path.

23. Design finance and performance management

The merger leadership team should set ledger, close, reporting, planning, management information, policies and controller accountabilities. The required output is a finance operating-model map. Record the design question, current-state evidence, future-state choice, legal boundary, dependency, owner, reviewer and approval status [27][28].

Translate the choice into a controlled operating-model release. Separate lawful pre-close analysis from implementation; specify what can be prepared, what triggers at closing and what remains a post-close management decision. Link organisation, process, data, systems, controls, people, cost and customer consequences.

The principal risk is that Day One can begin without one trusted view of performance. Quantify revenue exposure, service continuity, critical roles, cost, cash, control effectiveness, cyber risk, synergy timing and residual risk across base, delayed and remediated cases.

Retain source data, current-state maps, design options, legal advice, approvals, assumptions, dependencies, rehearsal evidence, exceptions and change records. Refresh after material developments and expire provisional decisions that no longer fit the closing path.

24. Design treasury and cash control

The merger leadership team should map accounts, signatories, liquidity, payments, debt, hedging, guarantees and trapped cash. The required output is a Day One cash-control schedule. Record the design question, current-state evidence, future-state choice, legal boundary, dependency, owner, reviewer and approval status [20][29].

Translate the choice into a controlled operating-model release. Separate lawful pre-close analysis from implementation; specify what can be prepared, what triggers at closing and what remains a post-close management decision. Link organisation, process, data, systems, controls, people, cost and customer consequences.

The principal risk is that legal ownership can change before cash authority and funding are operable. Quantify revenue exposure, service continuity, critical roles, cost, cash, control effectiveness, cyber risk, synergy timing and residual risk across base, delayed and remediated cases.

Retain source data, current-state maps, design options, legal advice, approvals, assumptions, dependencies, rehearsal evidence, exceptions and change records. Refresh after material developments and expire provisional decisions that no longer fit the closing path.

Table 3. Day One control matrix

DomainMinimum outcomeProof
cashpayments authorisedbank test
customerservice ownership clearaccount roster
peopleemployment and escalation livemanager rehearsal
cyberidentity and incident controlaccess test

Illustrative structure; verified transaction evidence and specialist review govern.

25. Design tax governance

The merger leadership team should map entities, registrations, transfer pricing, permanent establishments, indirect tax, attributes and decision ownership. The required output is a tax operating-model register. Record the design question, current-state evidence, future-state choice, legal boundary, dependency, owner, reviewer and approval status [30][31].

Translate the choice into a controlled operating-model release. Separate lawful pre-close analysis from implementation; specify what can be prepared, what triggers at closing and what remains a post-close management decision. Link organisation, process, data, systems, controls, people, cost and customer consequences.

The principal risk is that operational choices can create tax exposures outside the deal model. Quantify revenue exposure, service continuity, critical roles, cost, cash, control effectiveness, cyber risk, synergy timing and residual risk across base, delayed and remediated cases.

Retain source data, current-state maps, design options, legal advice, approvals, assumptions, dependencies, rehearsal evidence, exceptions and change records. Refresh after material developments and expire provisional decisions that no longer fit the closing path.

26. Design data ownership

The merger leadership team should classify domains, controllers, purposes, quality, access, lineage, retention and deletion. The required output is a combined data-governance blueprint. Record the design question, current-state evidence, future-state choice, legal boundary, dependency, owner, reviewer and approval status [32][33].

Translate the choice into a controlled operating-model release. Separate lawful pre-close analysis from implementation; specify what can be prepared, what triggers at closing and what remains a post-close management decision. Link organisation, process, data, systems, controls, people, cost and customer consequences.

The principal risk is that integration design can rely on personal or sensitive data without lawful use. Quantify revenue exposure, service continuity, critical roles, cost, cash, control effectiveness, cyber risk, synergy timing and residual risk across base, delayed and remediated cases.

Retain source data, current-state maps, design options, legal advice, approvals, assumptions, dependencies, rehearsal evidence, exceptions and change records. Refresh after material developments and expire provisional decisions that no longer fit the closing path.

27. Design the application landscape

The merger leadership team should classify systems to retain, separate, interoperate, migrate or retire with business owners and exit criteria. The required output is an application disposition map. Record the design question, current-state evidence, future-state choice, legal boundary, dependency, owner, reviewer and approval status [34][35].

Translate the choice into a controlled operating-model release. Separate lawful pre-close analysis from implementation; specify what can be prepared, what triggers at closing and what remains a post-close management decision. Link organisation, process, data, systems, controls, people, cost and customer consequences.

The principal risk is that technology sequencing can be driven by licence dates instead of business risk. Quantify revenue exposure, service continuity, critical roles, cost, cash, control effectiveness, cyber risk, synergy timing and residual risk across base, delayed and remediated cases.

Retain source data, current-state maps, design options, legal advice, approvals, assumptions, dependencies, rehearsal evidence, exceptions and change records. Refresh after material developments and expire provisional decisions that no longer fit the closing path.

28. Design infrastructure and cyber controls

The merger leadership team should map identity, networks, endpoints, cloud, logging, incidents, recovery and third-party dependencies. The required output is a Day One cyber architecture. Record the design question, current-state evidence, future-state choice, legal boundary, dependency, owner, reviewer and approval status [24][34].

Translate the choice into a controlled operating-model release. Separate lawful pre-close analysis from implementation; specify what can be prepared, what triggers at closing and what remains a post-close management decision. Link organisation, process, data, systems, controls, people, cost and customer consequences.

The principal risk is that new connectivity can expand attack paths before controls and monitoring converge. Quantify revenue exposure, service continuity, critical roles, cost, cash, control effectiveness, cyber risk, synergy timing and residual risk across base, delayed and remediated cases.

Retain source data, current-state maps, design options, legal advice, approvals, assumptions, dependencies, rehearsal evidence, exceptions and change records. Refresh after material developments and expire provisional decisions that no longer fit the closing path.

29. Design shared services and transition agreements

The merger leadership team should define service catalogues, volumes, standards, pricing, access, data, change, exit and dispute controls. The required output is a TSA and shared-service blueprint. Record the design question, current-state evidence, future-state choice, legal boundary, dependency, owner, reviewer and approval status [13][36].

Translate the choice into a controlled operating-model release. Separate lawful pre-close analysis from implementation; specify what can be prepared, what triggers at closing and what remains a post-close management decision. Link organisation, process, data, systems, controls, people, cost and customer consequences.

The principal risk is that temporary services can become an unpriced permanent dependency. Quantify revenue exposure, service continuity, critical roles, cost, cash, control effectiveness, cyber risk, synergy timing and residual risk across base, delayed and remediated cases.

Retain source data, current-state maps, design options, legal advice, approvals, assumptions, dependencies, rehearsal evidence, exceptions and change records. Refresh after material developments and expire provisional decisions that no longer fit the closing path.

30. Integrate risk and controls

The merger leadership team should map financial, operational, regulatory, conduct, cyber and resilience controls to owners and evidence. The required output is a combined control architecture. Record the design question, current-state evidence, future-state choice, legal boundary, dependency, owner, reviewer and approval status [8][18].

Translate the choice into a controlled operating-model release. Separate lawful pre-close analysis from implementation; specify what can be prepared, what triggers at closing and what remains a post-close management decision. Link organisation, process, data, systems, controls, people, cost and customer consequences.

The principal risk is that process redesign can remove compensating controls before replacements operate. Quantify revenue exposure, service continuity, critical roles, cost, cash, control effectiveness, cyber risk, synergy timing and residual risk across base, delayed and remediated cases.

Retain source data, current-state maps, design options, legal advice, approvals, assumptions, dependencies, rehearsal evidence, exceptions and change records. Refresh after material developments and expire provisional decisions that no longer fit the closing path.

31. Build the synergy accountability ledger

The merger leadership team should assign baseline, owner, mechanism, dependency, timing, investment, risk and evidence for every benefit. The required output is a board-owned synergy ledger. Record the design question, current-state evidence, future-state choice, legal boundary, dependency, owner, reviewer and approval status [7][23].

Translate the choice into a controlled operating-model release. Separate lawful pre-close analysis from implementation; specify what can be prepared, what triggers at closing and what remains a post-close management decision. Link organisation, process, data, systems, controls, people, cost and customer consequences.

The principal risk is that synergies can remain targets without controllable delivery paths. Quantify revenue exposure, service continuity, critical roles, cost, cash, control effectiveness, cyber risk, synergy timing and residual risk across base, delayed and remediated cases.

Retain source data, current-state maps, design options, legal advice, approvals, assumptions, dependencies, rehearsal evidence, exceptions and change records. Refresh after material developments and expire provisional decisions that no longer fit the closing path.

Figure 4. Synergy-accountability architecture
Figure 4. Synergy-accountability architecture

Illustrative analytical scenario; verified transaction evidence should replace index values.

32. Quantify dis-synergies

The merger leadership team should model customer loss, talent exits, supplier changes, duplicated operations, remediation and service disruption. The required output is a net-value bridge. Record the design question, current-state evidence, future-state choice, legal boundary, dependency, owner, reviewer and approval status [11][25].

Translate the choice into a controlled operating-model release. Separate lawful pre-close analysis from implementation; specify what can be prepared, what triggers at closing and what remains a post-close management decision. Link organisation, process, data, systems, controls, people, cost and customer consequences.

The principal risk is that gross savings can conceal the cost of preserving revenue and resilience. Quantify revenue exposure, service continuity, critical roles, cost, cash, control effectiveness, cyber risk, synergy timing and residual risk across base, delayed and remediated cases.

Retain source data, current-state maps, design options, legal advice, approvals, assumptions, dependencies, rehearsal evidence, exceptions and change records. Refresh after material developments and expire provisional decisions that no longer fit the closing path.

33. Fund integration costs

The merger leadership team should phase technology, people, facilities, advisers, retention, working capital and contingency before benefits. The required output is an integration funding curve. Record the design question, current-state evidence, future-state choice, legal boundary, dependency, owner, reviewer and approval status [27][29].

Translate the choice into a controlled operating-model release. Separate lawful pre-close analysis from implementation; specify what can be prepared, what triggers at closing and what remains a post-close management decision. Link organisation, process, data, systems, controls, people, cost and customer consequences.

The principal risk is that value delivery can stall because one-time cash needs are understated. Quantify revenue exposure, service continuity, critical roles, cost, cash, control effectiveness, cyber risk, synergy timing and residual risk across base, delayed and remediated cases.

Retain source data, current-state maps, design options, legal advice, approvals, assumptions, dependencies, rehearsal evidence, exceptions and change records. Refresh after material developments and expire provisional decisions that no longer fit the closing path.

Table 4. Net-value bridge

ComponentOwnerGate
gross synergybusiness leadermechanism proven
dis-synergycustomer or operationsmitigation funded
integration costCFOcash approved
net valuesponsordependency reconciled

Illustrative structure; verified transaction evidence and specialist review govern.

34. Define the Day One minimum viable model

The merger leadership team should specify legal operation, authority, cash, customers, employees, suppliers, reporting, cyber and compliance essentials. The required output is a Day One critical-path plan. Record the design question, current-state evidence, future-state choice, legal boundary, dependency, owner, reviewer and approval status [8][20].

Translate the choice into a controlled operating-model release. Separate lawful pre-close analysis from implementation; specify what can be prepared, what triggers at closing and what remains a post-close management decision. Link organisation, process, data, systems, controls, people, cost and customer consequences.

The principal risk is that teams can pursue optimisation before continuity is secured. Quantify revenue exposure, service continuity, critical roles, cost, cash, control effectiveness, cyber risk, synergy timing and residual risk across base, delayed and remediated cases.

Retain source data, current-state maps, design options, legal advice, approvals, assumptions, dependencies, rehearsal evidence, exceptions and change records. Refresh after material developments and expire provisional decisions that no longer fit the closing path.

Figure 3. Day One critical path
Figure 3. Day One critical path

Illustrative analytical scenario; verified transaction evidence should replace index values.

35. Sequence the first 100 days

The merger leadership team should release decisions through evidence, dependency, consultation, technology and change-capacity gates. The required output is a 100-day decision roadmap. Record the design question, current-state evidence, future-state choice, legal boundary, dependency, owner, reviewer and approval status [7][14].

Translate the choice into a controlled operating-model release. Separate lawful pre-close analysis from implementation; specify what can be prepared, what triggers at closing and what remains a post-close management decision. Link organisation, process, data, systems, controls, people, cost and customer consequences.

The principal risk is that too many simultaneous changes can overwhelm scarce leaders and control teams. Quantify revenue exposure, service continuity, critical roles, cost, cash, control effectiveness, cyber risk, synergy timing and residual risk across base, delayed and remediated cases.

Retain source data, current-state maps, design options, legal advice, approvals, assumptions, dependencies, rehearsal evidence, exceptions and change records. Refresh after material developments and expire provisional decisions that no longer fit the closing path.

36. Prepare for a longer closing

The merger leadership team should maintain current-state changes, refresh assumptions, preserve optionality and control decision expiry. The required output is a long-close refresh protocol. Record the design question, current-state evidence, future-state choice, legal boundary, dependency, owner, reviewer and approval status [1][4].

Translate the choice into a controlled operating-model release. Separate lawful pre-close analysis from implementation; specify what can be prepared, what triggers at closing and what remains a post-close management decision. Link organisation, process, data, systems, controls, people, cost and customer consequences.

The principal risk is that the approved design can become obsolete before ownership transfers. Quantify revenue exposure, service continuity, critical roles, cost, cash, control effectiveness, cyber risk, synergy timing and residual risk across base, delayed and remediated cases.

Retain source data, current-state maps, design options, legal advice, approvals, assumptions, dependencies, rehearsal evidence, exceptions and change records. Refresh after material developments and expire provisional decisions that no longer fit the closing path.

37. Prepare for remedies and perimeter change

The merger leadership team should design modular options for divestiture, ring-fencing, behavioural commitments and excluded assets. The required output is a remedies-ready architecture. Record the design question, current-state evidence, future-state choice, legal boundary, dependency, owner, reviewer and approval status [5][21].

Translate the choice into a controlled operating-model release. Separate lawful pre-close analysis from implementation; specify what can be prepared, what triggers at closing and what remains a post-close management decision. Link organisation, process, data, systems, controls, people, cost and customer consequences.

The principal risk is that one irreversible target model can become unusable after regulatory change. Quantify revenue exposure, service continuity, critical roles, cost, cash, control effectiveness, cyber risk, synergy timing and residual risk across base, delayed and remediated cases.

Retain source data, current-state maps, design options, legal advice, approvals, assumptions, dependencies, rehearsal evidence, exceptions and change records. Refresh after material developments and expire provisional decisions that no longer fit the closing path.

38. Rehearse cutover and decisions

The merger leadership team should simulate authority, incidents, customer cases, payments, reporting, access and escalation with evidence. The required output is a Day One rehearsal record. Record the design question, current-state evidence, future-state choice, legal boundary, dependency, owner, reviewer and approval status [8][34].

Translate the choice into a controlled operating-model release. Separate lawful pre-close analysis from implementation; specify what can be prepared, what triggers at closing and what remains a post-close management decision. Link organisation, process, data, systems, controls, people, cost and customer consequences.

The principal risk is that a complete checklist can conceal untested cross-functional handoffs. Quantify revenue exposure, service continuity, critical roles, cost, cash, control effectiveness, cyber risk, synergy timing and residual risk across base, delayed and remediated cases.

Retain source data, current-state maps, design options, legal advice, approvals, assumptions, dependencies, rehearsal evidence, exceptions and change records. Refresh after material developments and expire provisional decisions that no longer fit the closing path.

39. Operate the readiness dashboard

The merger leadership team should track decision maturity, evidence, dependencies, critical-path status, stakeholder risk, cost and residual exposure. The required output is a board readiness dashboard. Record the design question, current-state evidence, future-state choice, legal boundary, dependency, owner, reviewer and approval status [7][18].

Translate the choice into a controlled operating-model release. Separate lawful pre-close analysis from implementation; specify what can be prepared, what triggers at closing and what remains a post-close management decision. Link organisation, process, data, systems, controls, people, cost and customer consequences.

The principal risk is that green workstreams can conceal red enterprise dependencies. Quantify revenue exposure, service continuity, critical roles, cost, cash, control effectiveness, cyber risk, synergy timing and residual risk across base, delayed and remediated cases.

Retain source data, current-state maps, design options, legal advice, approvals, assumptions, dependencies, rehearsal evidence, exceptions and change records. Refresh after material developments and expire provisional decisions that no longer fit the closing path.

40. Issue the operating-model certificate

The merger leadership team should reconcile design choices, legal boundaries, dependencies, owners, rehearsals, exceptions and residual risks. The required output is a retained closing-ready operating-model certificate. Record the design question, current-state evidence, future-state choice, legal boundary, dependency, owner, reviewer and approval status [1][8].

Translate the choice into a controlled operating-model release. Separate lawful pre-close analysis from implementation; specify what can be prepared, what triggers at closing and what remains a post-close management decision. Link organisation, process, data, systems, controls, people, cost and customer consequences.

The principal risk is that leaders can declare readiness without proving lawful operability. Quantify revenue exposure, service continuity, critical roles, cost, cash, control effectiveness, cyber risk, synergy timing and residual risk across base, delayed and remediated cases.

Retain source data, current-state maps, design options, legal advice, approvals, assumptions, dependencies, rehearsal evidence, exceptions and change records. Refresh after material developments and expire provisional decisions that no longer fit the closing path.

Table 5. Operating-model certificate

ConclusionRetained evidenceApproval test
lawful designboundary registercleared
operabilityDay One rehearsalpassed
valuenet synergy ledgerowned
exceptionsowner and deadlinebounded

Illustrative structure; verified transaction evidence and specialist review govern.

Figure 5. Operating-model certificate readiness
Figure 5. Operating-model certificate readiness

Illustrative analytical scenario; verified transaction evidence should replace index values.

References

  1. UK Competition and Markets Authority, Interim Measures in Merger Investigations CMA108, https://www.gov.uk/government/publications/interim-measures-and-derogations-guidance-and-templates
  2. US Federal Trade Commission, Avoiding Antitrust Pitfalls during Pre-Merger Negotiations and Due Diligence, https://www.ftc.gov/enforcement/competition-matters/2018/03/avoiding-antitrust-pitfalls-during-pre-merger-negotiations-due-diligence
  3. US Department of Justice, Antitrust Division, Merger Guidelines, https://www.justice.gov/atr/merger-guidelines/overview
  4. UK Competition and Markets Authority, Mergers Guidance on Jurisdiction and Procedure, https://www.gov.uk/government/publications/mergers-guidance-on-the-cmas-jurisdiction-and-procedure
  5. UK Competition and Markets Authority, Merger Remedies CMA87, https://www.gov.uk/government/publications/merger-remedies-cma87
  6. European Commission, EU Merger Control Procedures, https://competition-policy.ec.europa.eu/mergers/procedures_en
  7. UK Financial Reporting Council, UK Corporate Governance Code 2024, https://www.frc.org.uk/library/standards-codes-policy/corporate-governance/uk-corporate-governance-code/
  8. UK Government, UK Government Resilience Framework, https://www.gov.uk/government/publications/the-uk-government-resilience-framework
  9. US Federal Trade Commission, Premerger Notification and Merger Review Process, https://www.ftc.gov/advice-guidance/competition-guidance/guide-antitrust-laws/mergers/premerger-notification-merger-review-process
  10. IFRS Foundation, IFRS 8 Operating Segments, https://www.ifrs.org/issued-standards/list-of-standards/ifrs-8-operating-segments/
  11. IFRS Foundation, IFRS 15 Revenue from Contracts with Customers, https://www.ifrs.org/issued-standards/list-of-standards/ifrs-15-revenue-from-contracts-with-customers/
  12. UK Competition and Markets Authority, Consumer Protection from Unfair Trading Regulations Guidance, https://www.gov.uk/government/publications/consumer-protection-from-unfair-trading-regulations-traders
  13. International Organization for Standardization, ISO 22301 Business Continuity Management Systems, https://www.iso.org/standard/75106.html
  14. US Government Accountability Office, Business Process Reengineering Assessment Guide, https://www.gao.gov/products/aimd-10.1.15
  15. European Union, Directive 2002/14/EC on Informing and Consulting Employees, https://eur-lex.europa.eu/eli/dir/2002/14/oj
  16. US Department of Labor, Worker Adjustment and Retraining Notification Act Guidance, https://www.dol.gov/agencies/eta/layoffs/warn
  17. UK Financial Reporting Council, Guidance on Board Effectiveness, https://www.frc.org.uk/library/standards-codes-policy/corporate-governance/guidance-on-board-effectiveness/
  18. Committee of Sponsoring Organizations of the Treadway Commission, Internal Control Integrated Framework, https://www.coso.org/internal-control
  19. UK Companies House, Company Directors Responsibilities, https://www.gov.uk/guidance/being-a-company-director
  20. IFRS Foundation, IAS 7 Statement of Cash Flows, https://www.ifrs.org/issued-standards/list-of-standards/ias-7-statement-of-cash-flows/
  21. European Commission, Merger Control Overview, https://competition-policy.ec.europa.eu/mergers/overview_en
  22. European Commission, Practical Information for Mergers, https://competition-policy.ec.europa.eu/mergers/practical-information_en
  23. IFRS Foundation, IFRS 3 Business Combinations, https://www.ifrs.org/issued-standards/list-of-standards/ifrs-3-business-combinations/
  24. National Institute of Standards and Technology, SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management, https://csrc.nist.gov/pubs/sp/800/161/r1/final
  25. National Institute of Standards and Technology, SP 1326 Cybersecurity Supply Chain Due Diligence, https://csrc.nist.gov/pubs/sp/1326/final
  26. European Union, Directive 2009/38/EC on European Works Councils, https://eur-lex.europa.eu/eli/dir/2009/38/oj
  27. IFRS Foundation, IAS 1 Presentation of Financial Statements, https://www.ifrs.org/issued-standards/list-of-standards/ias-1-presentation-of-financial-statements/
  28. US Securities and Exchange Commission, Management's Discussion and Analysis Guidance, https://www.sec.gov/rules-regulations/2003/12/interpretation-commission-guidance-regarding-managements-discussion-analysis-financial-condition
  29. IFRS Foundation, IFRS 9 Financial Instruments, https://www.ifrs.org/issued-standards/list-of-standards/ifrs-9-financial-instruments/
  30. OECD, Transfer Pricing Guidelines for Multinational Enterprises and Tax Administrations, https://www.oecd.org/tax/transfer-pricing/oecd-transfer-pricing-guidelines-for-multinational-enterprises-and-tax-administrations-20769717.htm
  31. IFRS Foundation, IAS 12 Income Taxes, https://www.ifrs.org/issued-standards/list-of-standards/ias-12-income-taxes/
  32. European Union, General Data Protection Regulation, https://eur-lex.europa.eu/eli/reg/2016/679/oj
  33. UK Information Commissioner's Office, Data Minimisation, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/the-principles/data-minimisation/
  34. National Institute of Standards and Technology, Cybersecurity Framework 2.0, https://www.nist.gov/cyberframework
  35. National Institute of Standards and Technology, IR 8286 Rev. 1 Integrating Cybersecurity and Enterprise Risk Management, https://csrc.nist.gov/pubs/ir/8286/r1/final
  36. UK Cabinet Office, Sourcing Playbook, https://www.gov.uk/government/publications/the-sourcing-playbook
Questions, answered

The Combined Operating Model before Day One: frequently asked questions

Teams can analyse evidence, develop options and prepare conditional plans within applicable competition, confidentiality, privacy, employment and interim-measures boundaries. Implementation and control remain with the current owners until lawful closing.

Decisions with long lead times or closing-critical dependencies often include leadership interfaces, legal authority, cash control, reporting, cyber access, customer ownership, employee communication and regulated-accountability preparation.

Use necessity, proportionality, clean-team, aggregation, access, output and deletion controls approved for the transaction. Competitively sensitive information requires particular discipline.

Detail should follow decision need and evidence. Define the minimum viable Day One model and high-consequence dependencies first; preserve options where regulation, consultation, data or leadership decisions remain unresolved.

Each synergy should have a verified baseline, accountable owner, operating mechanism, dependencies, timing, required investment, dis-synergies, evidence and release gate.

It proves lawful authority, cash, customer service, employee leadership, supplier continuity, reporting, access, cyber response, regulatory compliance and escalation through cross-functional rehearsal.

Refresh current states, assumptions, cost, people, systems, regulation and dependencies at defined milestones. Preserve modular options and expire decisions when the evidence changes.

It should reconcile design decisions, legal boundaries, dependencies, owners, Day One controls, rehearsals, stakeholder risks, synergy economics, exceptions, deadlines and residual risk.

This publication is general information for professional audiences. It is not investment, legal or tax advice, and it is not an offer or solicitation. Readers should verify current legal, regulatory and tax requirements with qualified advisers.

Apply this insight to a live decision

Discuss the financing, capital allocation or transaction implications with a Matchpoint partner.

WhatsApp