The Effect of Cybersecurity on Enterprise Value [Updated August 2020]

August 2020 Update

With the advent of a “small global pandemic” – and the near universal move to “Work From Home” environments- the impact of Cyber Security threats has dramatically increased.  Think “Cyber” was a risk to value previously?  A trend we’ve seen is that not only has the pace of due diligence slowed as buyers become more cautious, but the amount of time and scrutiny put into cyber security and IT posture has definitely increased.  – Dan Doran / August 2020

Cyber Threats are an Impact to Enterprise Value  

As we kick off a new year we’ve been thinking about emerging trends in 2020 and one area that seems to be increasing at a meteoric rate is cyber risk.   As valuation experts we spend much of our time thinking about risk and assessing its impact on enterprise value.  Risk comes in many flavors – the usual suspects for SMB’s include customer concentration risks, key person reliance, etc – but the topic that we are thinking about increasingly is the cyber security risk.    

We’ve collectively gone from thinking about “hackers” as bored high schoolers drinking Red Bulls in their parents basement to more sophisticated and organized efforts.  Who can forget the Capital One Cyber Incident back in 2019? This cyber breach affected 100 million individuals in the United States, compromising Social Security numbers, linked bank account numbers and information from credit card applications.  What is really alarming is the number of state and state-sponsored actors on the scene.  The most recent “high conflict” dustup between the U.S. and Iran is in fact more likely to play out not on a traditional battlefield but in data centers and databases around the world.   

The cyber security landscape is ever-changing. It is becoming exceedingly imperative for business owners to keep the importance of cybersecurity at top of mind in order to protect their assets they’ve worked so hard to build. 

What You Should Be Thinking 

So why should a business owner, even who isn’t in the IT space, care about cybersecurity? 

Simple: it’s important to safeguard your systems and data in any business. In doing this, you’re not only safeguarding everything you’ve worked for, but you’re safeguarding the value of your business.  

To do this, you need to have a battle drill in place. Take Daniel Chew’s advice: 

“The first couple of steps is that you want to be able to identify where the problem originated from. Typically, you’ll want to look at your logs, systems and reports that your own internal systems are generating so that you can pinpoint where the problem started. That’s usually step number one. 

Step two, you want to ensure that you’re preserving the data. This is because if you bring in a forensic specialist, you want to ensure that you haven’t tampered with the data in any way. As they’re going through their investigations, if you’ve tampered with the evidence, that might lead them to the wrong conclusion, and you may never end up catching the bad guy.”  

The cybersecurity landscape continues to grow in threat numbers by the minute. With the recent conflict with Iran, U.S. government officials are warning that the new phase of hostilities will begin to shift into cyberspace.  

Cybersecurity experts are already seeing malicious activity from pro-Iranian forces and are warning that they have complete capability to do real damage to American computer systems.  

“The public should be prepared for worse, Christopher C. Krebs, the director of the Cybersecurity and Infrastructure Security Agency, said in an interview. Iran has the ability to not only access private-sector and government computers in the United States, but to burn down the system’.” 

As of right now, most of the activity thus far has been limited to anti-Trump threats on social media. However, this could very well be the calm before the storm.  

Resources for Owners and Executives 

Luckily, we got to discuss some of the main takeaways from this breach with Daniel Chew of CrossCountry Consulting on our podcast “The Deal – Unscripted” shortly after the Capital One cybersecurity breach.   

“Threats today come at all angles for an organization. The most typical ones that we see are phishing attacks– and then insider threats is another big one.” Chew stated when asked about the most common attacks he has seen in his experience in the cybersecurity space. 

Understanding the recent jump in cybersecurity threats is one thing but knowing the costs and what your battle drill should be when your cybersecurity is in jeopardy should be top priority for a business owner. Check out the rest of Dan Doran and Daniel Chew’s discussion on the cybersecurity considerations you should be thinking about.  

Interested in learning more about the threats of today’s cybersecurity from industry experts? The Reston Business Advisory Council is hosting a presentation and Q&A discussion for business owners on “Cyber Threats to Your Business” on February 26th. Click here to find out more! 

Quantive’s Valuation Process and What to Expect

We get it, it’s daunting. Especially if it’your first time getting a business valuation. With a quick search on Google, you can probably figure out how to get one However, the even bigger question Google fails to answer is – What does the process look like?  

Quantive answers this question by running a tight valuation process to ensure a high-quality result. We say this consistently: repeatable processes yield repeatable results.  

We feel strongly about this. Since our valuation process is crafted to yield consistent results every single time, this helps our clients understand what to expect throughout the business valuation process and when to expect it. Assignments from end to end can be completed in as short as 2-3 weeks and can be expedited as necessary.  

Our process is so concrete that it allows us to engage with many different industries on a consistent basis. This is one of the top reasons that Quantive is trusted by small to medium sized businesses all over the United States.

Here’s an overview of our process:  

1) Data Collection 

The actual request will certainly vary from case to case, but the core data request is usually somewhat similar. Ideally, we want to see a five-year period of data, with three years being the usual minimum. A typical request will include: 

  • Company tax returns 
  • Historical profit and loss statements 
  • Year-end balance sheets 
  • Profit and loss statement for the last twelve months (“LTM”) 
  • Current year-to-date profit and loss statement 
  • Current balance sheet 
  • AR and AP aging 
  • Customer demographic data 
  • Management forecasts or budgeting (if readily available) 

Download our preliminary document request here.

Depending on the nature and scope of the assignment, we might also request other documents such as the company’s buy-sell agreement, corporate formation documents, inventory data, and other documents as necessary. 

2) Initial Analysis  

Once we have data, our analyst team will conduct what we call a “first pass analysis.” We’ll start looking at trending in the data, looking for variances, unusual items, positive and negative trends, and financial ratios.  

We’ll likely send you a detail of questions that we will want to cover during the management interview related to the data provided. 

3) Management Interview 

You’ll hear us say this again and again: the numbers only tell part of the story.  To really understand a company, we need to marry the narrative to the numbers.   At its heart valuation is about understanding the future prospects of the company.  It stands to reason that historical numbers- and to large extent even a forecast- doesn’t give a full picture of future prospects.  To get that complete picture and an accurate assessment of value we need to understand the story around how the company got to this point, as well as the narrative of what is likely to come next.   

To get to the story we’ll conduct an interview with the client to get an in-depth understanding of what drives the business.  Our goal is to quantify the financial statements, and beyond that understand both the value proposition and risk factors associated with the company.  

We’re looking to answer questions like: 

  • How did the company get here?  
  • Why is current performance where it is?   
  • What is likely to happen next?   
  • What are the risks?   
  • Where is the upside?   

While the interview can be done on-site, oftentimes we are able to complete the bulk of the project via phone conference or video conference. 

4) Rinse and Repeat! 

Sometimes we get to this point and we are ready to push to the finish line. In most cases, the management interview will uncover more questions which will result in more requests. We iterate this process until we have an adequate understanding of the company. 

5) Deep Dive Analysis Modeling  

The appraiser will analyze the companies normalized financial statements and use one or more of the several approaches below.  Our professionals will consider each model that is appropriate for the subject company. 

Approach to Valuation: There are 3 recognized approaches to valuation (with many models under each). They are: 

  • Asset Based Approach – What is the net worth of the physical assets of the business? 
  • Market Approach – How does entity compare to peers that have sold? 
  • Income Approach  – What is the value of the ongoing “benefit stream” of the company? 

During the analysis phase our professionals may also: 

  • Review buy-sell agreement for any controlling language or impairments to marketability and control 
  • Conduct a comparative analysis of the financial statements 
  • Complete any normalizing adjustment to the financial statements 
  • Gather and analyze comparative market data 
  • Develop an appropriate Discount Rate for the subject company 
  • Determine required Discounts for Control or Marketability. 

To arrive at a final estimate of value, the appraiser will reconcile the values derived in each of the valuation methods and combine them with appropriate discounts. 

6) Document Findings 

When a final valuation conclusion has been reached and all relevant information has been considered, the valuation report is delivered to the client. We thoroughly explain the report to our clients and their advisers and answer any questions to ensure a thorough understanding of our conclusions. A typical report runs between 40-60 pages and will frequently include: 

  • Summary Letter reviewing the valuation and findings 
  • Statement of Limiting Conditions 
  • Overview of Subject Company 
  • Review of adjustments to financial statements 
  • Detailed discussion of all valuation methodologies considered and used 
  • Detail of valuation calculations and supporting data 

7) Brief Out 

For most of our assignments we’ll conduct a brief out with our client. (In some cases this isn’t appropriate or necessary – think a “date of death” report for probate. For the most part, though, we feel that the brief out is the most important element of the entire engagement. 


Next Steps: After the Valuation 

A frequent discussion we have with clients is that the final number is less important than how we got there and what happens next.  

Consider that our work up until this point has likely created a road map for corporate value. Like all maps, this provides direction as to where we might go next. At Quantive, we understand the importance of how to get you from where you are to where you need to go.  

Enter: Value Engineering. See more about getting on a more deliberate path to creating enterprise value here.

You Probably Don’t Know the Actual Value of Your Company

And not knowing is eventually going to cause problems. 

Over the course of thousands of client interactions one statistic stands out above all others: entrepreneurs drastically overestimate the value of their company.   It’s not surprising, of course.  It falls right in line with human nature: we all think our house is perfect, no one thinks they have an ugly kid, and owners overprice the asset that they have worked so hard to build.  It’s funny – when we sit down with entrepreneurs they fundamentally realize this – they invariably chuckle along knowing it’s a fundamental truth.

So what is the big deal?

Well let’s talk some other facts: studies consistently show that a company will typically make up over 80% of an entrepreneur’s net worth.  For the vast majority, liquidating (i.e. selling) that company is going to be critical to the success or failure of realizing their retirement goals.  That ordinarily wouldn’t be a big deal if that company were a highly liquid asset.  If you needed to sell some Google or Facebook stock you could do that this afternoon.  But privately held companies are certainly not as liquid as a publicly traded stock, and selling one is no sure bet.

More facts: studies show that only 20% of companies are successful in selling in their first attempt.  That is just an abysmal success rate.  The number one reason that companies don’t sell?  It’s probably not a surprise: the market won’t support the price that a seller is willing (or able) to sell at.  Even worse is the number two reason that companies do not sell: in some cases there simply is no market for the company – meaning that not a single market participant has found the company attractive enough to enter into negotiations.

Putting this all in context: if you are an entrepreneur you probably have most of your eggs in one basket.  You also probably don’t know what those eggs are worth.  And there is only a 20% chance that you’d be able to successfully sell your company… likely because there is a gap between value expectations.

There has to be a better way, right?

The Value Engineering Playbook

Let’s imagine I want to go visit my sweet old Aunt in Schenectady, NY.  I’m probably going to need to know at least two things: where I’m starting from, and the location that I’m trying to get to.  I can’t really get on the right roads if I don’t know the starting point, and I’m certainly not going to end up in the right point if I don’t know the destination.  I’d also probably want to know a couple of other things to improve my odds of getting there, right?  Like… how far away is Schenectady?  Is my car in good shape?  Do I have enough gas?  But just like you, I’m sure there is definitely a mental playbook that I’d run to get to Schenectady, right?

There’s a playbook for getting to “Schenectady” with a company too.  In the life of a business owner the starting point is your Current Market Value, and the destination is the number you’ve worked out in your financial plan.  Is your car in good shape?  Right – that’s your company.  And gas?  Well that’s probably capital.

Running the table when it comes time to sell is going to require you to get an accurate insight into your company’s value now, how much of a gap there is between where you are trying to go, and executing on a legit plan in order to close that gap.

Of course it all starts with knowing Current Market Value.

How Long is a Valuation Good For?

It’s a logical question from business owners: how long is a valuation good for? The short answer:  probably for about a year. The longer answer: it depends.

Context is critical

Business valuations are always completed for 1) a particular purpose and 2) at a specific point in time. While a valuation will take into account a wide range of data – future projections, management’s past ability to hit projections, prior performance, structural trends in an industry – it remains that the valuation is as of a certain date.

For instance, here is what the American Society of Appraiser (ASA) has to say on valuations:

The determination of value for a business is always done as of a specific date; however, the final opinion of value most always considers historical information as well as the future projections about the subject company and its industry. Each day there could be slight modifications of value due to changes in the capital structure of the company; however, in general practice, if there are been no significant changes in the operations of the business or its capital structure, annual updates may satisfy most uses of the appraisal report.

The ASA definition gives us a starting point. There can be small fluctuations on a daily basis in value but on a macro level, a valuation is usually good for about a year.  However, there are situations when a valuation is not good for a year, which is why understanding context is critical.

What might change your value within a year?

When we say “about a year,” this generally assumes that nothing has materially changed that would impact our analysis.  For example:

  • Has something happened to materially impact revenues?  Or earnings?
  • Has there been a change of control?
  • Is there a new management team?
  • Loss of a key sales person?
  • Legislation that has a material impact on your industry?
  • Has the purpose of the valuation changed?

Any of the above might impact the validity of a valuation inside the one-year period.

How Can a Change in Purpose Affect Value?

One aspect of value many business owners don’t consider is the impact that “purpose” has on the validity of a valuation.  For instance, we are likely to arrive at vastly different conclusions if a valuation is done for a minority buyout vs. a strategic purchaser.  Understanding the context of the valuation is critical – and by default, a change in context (or purpose) is likely to impact value.

Valuation and Divorce: A Case Study in Purpose

A great example of valuation purpose affecting value is when a valuation is performed in the context of a divorce.  Valuations are often required when a privately held business is part of a marital estate.  In order to perform a division of property the parties must know the value of the asset, and in the absence of a public market price a third party valuation is required.

If we assume for a moment that we are valuing a minority interest (50% or less, lacking elements of control and liquidity), as a valuation analyst we would ordinarily consider applying a Discount for Lack of Control and/or a Discount for Lack of Marketability. This may result in a discount from the pro rata share of the business of anywhere from 20-50%.

Example 1:

In many jurisdictions, the courts have stepped in and limited the ability to apply so called discounts.  In order to not “punish” an exiting spouse, the valuation is precluded from applying these discounts, instead developing a value that is higher than what we would conclude if we were performing the value for a different purpose.

Example 2:

Staying with the divorce scenario, in many situations as a valuation analyst we might look at the impact of “personal goodwill’ on the overall value of a business. That is to say, how much value is attributable to an individual owner vs. the enterprise itself? This is very common in medical and professional practices, or scenarios where the “owner is the business.”

Similar to limiting discounts, states take wildly differing views on the treatment of personal goodwill in divorce matters.  In many states personal goodwill is considered a marital asset, this divisible in the separation of assets.  In others, personal goodwill attaches to the individual and is separated from our valuation.


Given the above scenarios, a valuation performed in the context of a divorce could have a materially different finding than a valuation performed for, say, exit planning purposes.  In our examples above, not only does purpose affect the validity of a valuation, but so does jurisdiction!

[This article by Dan Doran originally appeared on Axial in 2015]

The Buy-Sell Agreement: 9 reasons you need one

When forming a business, one of the first things every entrepreneur should think about is their ultimate exit. For most, this is the farthest thing from their mind.  As any corporate attorney will tell you, in the same way in which you would plan to protect your children with the creation of a will, your business should also be treated with kid gloves. A Buy-Sell Agreement should be a top priority. Think of it as a prenup for business partners. Read more

How Shareholder Compensation Affects Value

Question:  What’s the going rate to hire a business owner these days?  Or put another way… how much should an owner-operator pay themselves? In some privately held companies that may be a question that is answered by the Board of Directors.  But in most privately held companies it’s a question answered by a single person: the one writing the check.  Owner compensation is really an arbitrary matter for just about every payroll run… except on the days that someone is trying to value / price a company.

Why’s that?  Well, when I pay myself an extra buck where does it come from?  Profit.  And in most cases what is the basis of establishing value?  Profit.  See where I’m going with this?   We deal with a wide array of valuation engagements in which shareholder compensation becomes a sticking point.  Sometimes it’s a bit of gamesmanship (negotiating an M&A buyout), others it’s a highly litigated matter (how does owner comp impact a) valuation and b) alimony in a divorce matter?)

Making matters even more “interesting” – in some instances it is proper to adjust shareholder compensation as part of adjustments to the financial statements, while others an adjustment isn’t proper at all.   Given that changes in owner comp will more often than not have a direct – and often material – impact on the calculated value of a company, you can imagine that it’s often a bone of contention.

Why Adjust Compensation?

Oftentimes a working shareholder will use their salary as a mechanism to withdraw profits from the business.  The W2 compensation thus reflects not their actual contributions to the business as an employee, but rather their stature as a shareholder.  For businesses with a single shareholder (or perhaps a small group), the owner doesn’t draw a distinction between salary and dividends: it’s all the same pile of money from which he or she can pay themselves.

Take for example a company with $2.5 million in revenues and $100k in earnings, and a single shareholder that takes a salary of $1 million (“Scenario 1” below).   That same shareholder might choose to pay themselves a salary of $100k and receive the rest as a dividend.  In both cases the cash available to the shareholder is the same.   Makes sense, right?

Valuation is most frequently a function of earnings.  And if that’s the case are we to conclude that the companies in Scenarios 1 and 2 above are worth the same? If we assume that this business, other things being equal, is worth 5x earnings… is $500k a reasonable valuation?  Likely not.  A more reasonable interpretation is that a portion of owner salary is actually a dividend in disguise.  Adjusting to a “normalized” salary would increase earnings, thereby result in a more accurate value.

So What’s the Big Deal?

Adjust the salary to a market rate, right?  Therein of course lies the problem.  What is market rate?  To replace the day to day services of the shareholder, is the proper rate $100k?  Or 500k?  Or 900k?  Using our example above, adjusting to $100k in salary would increase valuation by $4.5 million.  Adjusting to $900k would only increase the valuation by $500k.

These sorts of adjustments can cause significant strife among parties.

When NOT to Adjust?

All shareholders are not created equal.  If the shareholder lacks “control” – i.e. the ability to adjust their own salary- it’s unlikely that a change is warranted.  For instance, imagine a company in which Suzanne Shareholder is the VP of Sales and owns a 7% stake in the company.  She’s paid $1 million per year, which is far above peers in similar roles within the industry.  She reports to the CEO (and majority owner) who establishes her salary.

Is a compensation adjustment warranted? Maybe! We’d probably look at the purpose of the valuation to understand whether or not to adjust.  If we are valuing JUST her 7% interest- perhaps for a divorce matter – then an adjustment likely wouldn’t be warranted.  Why?  Because her comp is unlikely to change as a result of the divorce.  On the other hand, what if we are valuing the entire enterprise and Suzanne is likely to accept a more reasonable salary in conjunction with the sale?  Good chance we’d adjust.

How to Get Beyond the Strife?

We’ve got a couple of moving pieces here: first, understanding whether or not an adjustment to shareholder compensation is warranted.  That’s totally in the wheelhouse of us as the valuation expert.  Second, we need to understand what to adjust to.  Options include:

  • Option 1: Rely on third party data. In some industries there is robust data available for purchase.
  • Option 2:  Rely on your valuation expert.  We have a sense for what CEO’s are paid for companies in certain industries and sizes.  We can make an educated guess – but we are NOT experts on executive comp.
  • Option 3: Hire a compensation expert to analyze what it would cost to source a replacement.  There is a material costs to going this route, but in some cases the benefit may be worth it.

Ultimately your valuation expert can help guide you to the best decision based on your particular circumstances.

Tip: In Buy-Sell Agreements / Operating Agreements, consider including language regarding compensation in order to avoid this very conflict down the road.  

Understanding Terms: Main Street vs. Middle Market

We often throw around the terms “middle market,” “lower middle market,” and “Main Street.”  These are pretty common terms in the finance, banking, and M&A world, but probably less so to most business owners and entrepreneurs.  For the sake of clarity we thought we’d dive in.


Defining Main Street vs. Middle Market

It seems that everyone has their own definition, but here is ours.  Because of the wide range of company sizes within the definition, the middle market can be further broken down into the following:

  • Main Street-  <$5 million of revenues
  • Lower Middle Market – $5 – $50 million of revenue
  • Middle Market – $50 – $500 million of revenue
  • Upper Middle Market – $500 – $1 billion of revenue

What Does it Matter?

Company size has an impact on all sorts of considerations in the valuation world.  Perhaps the first is the so called “size premium” – the notion that larger companies have higher relative valuations.  The reason for this is somewhat straightforward: larger companies are able to better diversify risk and have access to cheaper capital.

Related to the above, business sellers need to consider their target audience when going to market.  If you are a Main Street company, chances are that your buyer pool is an individual who is looking to buy a business or maybe a lower middle market company.  Chances are exceedingly slim that you are in play for a private equity buyer.

On the other hand, if you are a lower middle market company, your target acquirer is likely in your “bucket” or the next higher.  You very well could be in play for a private equity deal… though depending on a range of factors perhaps as an add on rather than a “platform” company.  Private equity groups offer healthy multiples and strategic acquisitions, driving up value, compared to an individual buyer looking for a quality investment.

But in the end, what is the main importance? Since business folk are always throwing these terms around it’s always good to get a baseline so we are all speaking the same language.



What is working capital? Why negotiate a working capital adjustment in your purchase price?

When a buyer values a target company, the buyer’s valuation is based on the target company’s financial condition on a specific date.  In most instances, several months pass between that initial valuation date and the closing date, which is when the buyer acquires the target company.  Purchase price adjustments need to be negotiated to reflect changes in the target company’s financial condition between those two dates.

According to the American Bar Association’s 2011 Private Target Mergers & Acquisitions Deal Points Study, 82% of private company acquisitions in 2010 included purchase price adjustments. Read more

Understanding Seller’s Discretionary Earnings

So you’ve heard someone throwing around the term “Seller’s Discretionary Earnings” and you find yourself thinking “my earnings aren’t discretionary at all.”  Let’s jump in and understand this oft-misunderstood term (which also, confusingly, goes by “Seller’s Discretionary Income,” SDE, and SDI…). Read more

How To Get a Business Loan

Your small business is ready to grow and you need a loan to make it happen. Just like with a personal loan or a mortgage, you will want to shop around and find the best rate and terms to meet your needs. Being prepared will be key to expediting the process. Follow these four basic steps and watch load offers roll in.

1.  Improve your personal and business credit scores.

Read more