Key Takeaways

  • A significant financial penalty issued to Australian Clinical Labs shows how acquired technology risks can surface after a transaction closes.
  • Runoff insurance can cover certain unknown third-party claims arising from conduct before a managed service provider (MSP) sale.
  • Buyers still need rigorous security diligence, contractual protections, and a detailed integration plan to preserve deal value.

Closing an MSP acquisition transfers ownership, but it does not put a hard boundary around the target's past. A customer, employee, or government entity could make a claim months or years later, leaving the buyer and seller arguing over responsibility.

That exposure is pushing runoff insurance further into Australia and New Zealand's active MSP merger and acquisition market. Consolidation remains visible through deals such as Evergreen's acquisition of Office Solutions IT (OSIT) and efex's expansion strategy. As transaction volume grows, so does the practical importance of protecting value after completion.

The Australian Clinical Labs (ACL) case offers a blunt warning. ACL faced a significant financial penalty after vulnerabilities in IT systems acquired through its purchase of MedLab Pathology contributed to a major cyber incident and privacy breach. The case, highlighted in legal analysis by Clayton Utz, demonstrated that an inherited weakness can remain hidden during a deal and later create regulatory, financial, and reputational consequences.

This exposure underlines why closing day is only one milestone. ARN has previously highlighted integration as a key defense against value leakage after an MSP sale. That integration extends beyond combining sales teams and financial reporting. It involves identity systems, endpoint controls, software licenses, customer contracts, network routing, cloud environments, and incident-response procedures.

Insurance and technical integration address fundamentally different parts of the transaction risk. Runoff cover can create a defined route for handling some claims linked to pre-sale events. It does not repair an unpatched server or map an unknown customer dependency.

"A runoff policy is effectively covering the past actions of the business," an insurance specialist told ARN. "You're asking the insurer to cover that for the next three to five years, because a claim could come from a government entity, like a tax auditor."

Depending on the policy, examples of covered past actions include previously unknown third-party claims involving tax audits, employee liabilities, or conduct that occurred before completion. The specialist cited the possibility of a systemic workplace dispute emerging months after a business has been sold.

Known problems are a different matter. Prior knowledge of a potential claim is not insurable under these standard policies. Contractual guarantees are also typically outside this kind of protection. If a seller promises to complete a particular action and fails to do so, runoff insurance is not designed to replace that obligation.

That distinction places more weight on diligence. An AvePoint roadmap for MSP transactions highlights the operational work surrounding acquisitions, while a First Focus guide similarly emphasizes structured planning around MSP deals. Buyers are increasingly examining recurring revenue, customer concentration, gross margin, tooling, and security posture because weaknesses in any of those areas directly dictate post-close performance.

The technical review process requires careful navigation. MSPs frequently manage privileged access across hundreds of customer environments, operate several monitoring and ticketing platforms, and depend on licensing arrangements that do not transfer neatly. Heavy legacy infrastructure and weak modernization plans can stall integration efforts. Configuration details require equal scrutiny, particularly around DNS, routing, and private network design.

When allocating the cost of the runoff policy, the expense is sometimes absorbed by the buyer. In an acquisition of a small MSP by a larger competitor, the acquiring organization's primary insurance program might cost hundreds of thousands of dollars. Keeping a post-close claim contained within the acquired company's separate runoff program helps protect the buyer's broader insurance record and establishes a clearer claims process.

The arrangement can also reduce tension when a former owner or chief executive remains with the acquired business. A later allegation may otherwise blur the line between pre-sale conduct and decisions made under new ownership.

Runoff insurance was once largely associated with major enterprise transactions, but it has become increasingly common in smaller deals as competition among insurers has reduced its cost. Private equity participation and offshore buyers are adding momentum because both typically demand a strict allocation of legacy liabilities. For MSP acquirers, preserving deal value depends on pairing this specialized coverage with rigorous security assessments, customer retention strategies, and disciplined technical integration.