Fiction: Good GRC Software Companies Are Bought Not Sold

A common narrative among entrepreneurs is that good companies are bought, not sold. While this may seem like a straightforward exit strategy, it nearly always proves false, leaving founders with a sub-optimized or even failed exit.

Why This Narrative Is Dangerous

The "good companies are bought, not sold" narrative is one of the biggest pitfalls founders fall into when planning to make an exit. It’s rooted in heavily publicized transactions like Facebook’s purchase of Instagram when Instagram wasn’t looking to sell.

In the GRC software world, founders are looking at ServiceNow, Wolters Kluwer, Thomson Reuters, Diligent, or OneTrust hoping to catch their attention for a future acquisition. Entrepreneurs (successful or otherwise) perpetuate the narrative as they tell themselves that their product is so aligned with a buyer’s product, that the buyer couldn’t help but notice and buy the founder’s company.

In effect, founders are telling themselves:

• If I can build an aligned product, and
• If I can catch the attention of my target buyer, and
• If that buyer decides they’re going to make an offer, and
• If I’m happy with that offer,
• Then I’ll be able to make a great exit

That’s a lot of "ifs" that all need to line up for a successful exit.

Even for founders who recognize that outcomes like Instagram’s are exceptional, inbound interest from private equity firms and M&A professionals can lead them to feel their business’ best exit strategy is to wait until a buyer swoops in with a favorable offer.

If you as an GRC software founder think that waiting for the narrative to play out perfectly is the right exit strategy, then consider:

• High-quality buyers who pay premiums without competition rarely swoop in out of nowhere
• A reactive approach is not ideal when selling your business, given the timing of the offer (if an offer occurs at all) might not align with your interests
• A non-competitive sales situation limits your leverage and increases closing/retrade risk

The Rarity of the Swooping GRC Software Buyer

As mentioned, some deals do play out according to the narrative, where a buyer is so interested in a company that they march in ready to pay a premium. These deals garner a lot of media attention and social discussion due to their extraordinary nature, and as humans we consider the most emphasized information to be the standard.

But a deal where the buyer swoops in with a desirable offer probably happens 1 out of 100 times. They’re just not that common.

In reality, when founders wait around for buyers to make the first move, buyers drag their feet and look for problems with the business in order to justify low valuations and buyer-friendly purchase terms. So while many founders consider waiting for the premium buyer to show up a good exit strategy, this approach often leads to an undesirable outcome.

A Reactive Approach Yields Suboptimal Outcomes

Being reactive instead of proactive is hardly ever the right strategy in any aspect of life, so why take a reactive approach when selling your most valuable asset: your business?

A key part of achieving a successful outcome in the sale of your GRC software business is to create urgency, as urgency induces buyers to move quickly and pay premiums. If you let the buyer drive the timeline, buyers will drag out the sales process, watching to see if your company meets expectations and forecasts.

That’s assuming buyers reach out at all. If you don’t proactively initiate a sales process and invite buyers to participate, odds are they won’t know you exist.

Even if they do know you exist, big strategic buyers and private equity firms likely have dozens of other opportunities they’re considering at the same time. Buyers in the GRC space are looking to add AI governance capability, extend framework and regulatory coverage, or reach a compliance function they do not currently sell into, and none of that is easy to assess from the outside. As a result, if your company isn’t posted for sale, then your target buyer may not even consider it.

To make a comparison, assume you’re a real estate investor and you have the choice among:

• 6 properties posted for sale that all meet your general investment criteria
• 1 property that meets your criteria, but you’re not sure who the owner is or if the property is for sale

Which property would you choose? One you know is available and whose ownership information is easily accessible.

How Private Equity Firms Optimize Outcomes Through a Proactive Process

Take a look at how private equity firms approach the sales process for their portfolio companies. Regardless of how you feel about private equity, you can be certain that PE firms are laser-focused on optimizing the exit value of their companies. So what do they do? They certainly don’t wait around for a buyer. They hire investment bankers and actively take their business to market, because they know proactively going to market is almost always going to yield the best outcome.

Inbound interest from buyers can make you feel like your GRC software company is a company to be bought, not sold. But if you want to optimize your outcome, you should go to market on your timeline and on your terms like private equity firms do.

Much of that inbound interest has a specific source, and it has a name: the roll-up. Private equity sponsors back a platform company with hundreds of millions of dollars for the explicit purpose of acquiring point solutions and smaller competitors. If you receive a call from a private equity firm about acquiring your company, it may well be on behalf of a platform investment the firm has already made.

At Vista Point, roughly half of our GRC software deals are kicked off by some level of inbound interest (whether a written LOI or conversations indicating someone is forthcoming). The right thing to do in this situation is to hire an investment banker and make the process competitive to get the best outcome.

No Competition Means No Leverage

In the event that a buyer does reach out and make an offer, what kind of leverage will you have to improve the valuation and/or terms of the offer?

In a transaction process that only has one potential buyer, the only leverage you have is the ability to say "No," and that can only get you so far. The greatest leverage comes when you have multiple interested buyers negotiating against each other. Running a transaction with the full universe of buyers and transaction types will give you the most leverage to negotiate valuations up and undesirable terms out.

In GRC that universe is wider than most founders assume. Regulated-content publishers and risk consultancies have both bought GRC software, and they underwrite differently than a software platform or a sponsor.

Consider Negotiations from the Buyer’s Standpoint

As a founder, you have a vision of the value your GRC software business could bring to an acquiring company, and you’ll likely use that vision to justify your price point.

Now consider the conversations your potential acquirer’s executive team is having behind closed doors about whether or not they should buy your company. If you were acquiring a company, which argument would be more compelling?

• Non-competitive argument: "They want $100M because of what they bring to the table" or "They want a 3x multiple because that’s what their competitor got."
• Competitive argument: "They have 4 bids at $100M. At least one of those bids is likely from a competitor. They want to work with us but aren’t going to take a discount, so if we can meet the market price then the deal is ours."

When you change the buyer’s paradigm to focus on beating the competition, then you improve your leverage to negotiate higher valuations and better purchase terms.

Sell, Don’t Sit

If your goal as a founder is to:

• Receive a premium valuation on your equity
• Reduce closing risk to ensure a deal actually happens by having multiple options
• Negotiate a founder-friendly purchase agreement
• Sell your business in a timely fashion

then you should disregard the narrative that good companies are bought, not sold.

Taking your GRC software business to market instead of waiting around doesn’t mean you have to remove your preferred buyer from consideration, nor does it mean that you’ll have to orchestrate a sales process all on your own. The best approach is to hire an investment bank to run a structured transaction. By hiring a qualified, unconflicted investment banker to sell your business, you will be better positioned to achieve a successful exit in a reasonable amount of time.