How can I identify the exact software, designs or know-how being reviewed in due diligence?

Start with a specific asset, not a project folder

For registered rights, an application or registration number gives reviewers an official starting point. Unregistered software, designs and know-how need a description that identifies the material being examined. The broader evidence checklist is covered in what to organise before IP due diligence; this answer focuses on defining one asset and its supporting record.

Consider a fictional manufacturer preparing its production-line calibration method for a potential licensee. The method combines operating instructions, parameter tables and a test procedure. The folder called “Line A development” also contains abandoned experiments, supplier manuals and working drafts. Sharing that folder would leave the reviewer to decide which material constitutes the method.

Instead, prepare a short asset description. Give it a reference that stays the same as it develops, such as CAL-01, and explain its purpose, boundaries and dependencies:

• Included: the sequence for calibrating line A, the settings for the specified materials and the procedure for checking the result.
• Excluded: earlier experimental settings, the machine supplier’s manual and the control software supplied with the machine.
• Dependencies: the machine model and software version needed to apply the method, with separate references to the relevant supplier documentation and permissions.

Excluding a supplier’s manual from the asset does not make it irrelevant. It makes clear that the company is presenting its calibration method, while identifying the external material needed to use it.

List the files that define this version

Give the package a version, such as CAL-01 version 2.0, and preserve a fixed copy. Its file list might look like this:

Add the exact filenames and storage references to the actual list. The package version identifies the combination being reviewed; individual files can have different revision numbers.

Check whether the documents are sufficient to explain the method. If an operator selects settings using experience that has never been recorded, identify that gap and arrange for it to be documented. Do not describe the package as containing the complete method while essential steps remain unexplained.

For software, the equivalent package might contain a preserved source-code release, build instructions and a dependency list. For a design, it might contain the editable drawings, specifications and reference images for one version. In each case, identify what belongs to the version under review.

Connect each point to the evidence supporting it

Keep the material defining the asset distinct from the records explaining its history and the company’s rights. Both belong in the review, but they serve different purposes.

For CAL-01, an evidence index could contain entries like these:

In the actual index, use precise document references and point to the relevant clause, page, delivery or file. “Contractor agreements” is not enough if several contractors worked on different versions. Mark uncertainty where a delivery schedule fails to identify the material clearly.

This lets a reviewer check whether the ownership documents cover the identified material, as recommended in the Hong Kong Intellectual Property Department’s due diligence guidance.

Preserve and timestamp the package prepared for review

Once the CAL-01 package is ready, set aside the exact files being submitted for review, including the description and file list. Prepare readable copies where needed. For the parameter tables, retain the source spreadsheet if its formulas or structure matter, and include an export showing the values and how to read them. Check that the export accurately represents the selected version before certifying it.

Timestamp this fixed package to create a dated record of the material assembled for review. The certification process uses cryptographic fingerprints to connect the certificate to the exact digital files. During verification, the fingerprints are recalculated from the supplied files and checked against the certified record. See what a digital timestamp establishes.

Preserve the certified files unchanged and use separate copies for editing or annotation. Certification covers the file’s exact bytes, not just its visible contents: saving a spreadsheet again can change the file even when its displayed values look the same. Exports need the same care. If you certify an archive, retain that exact archive; recreating it from the same documents can produce different bytes.

Keep earlier timestamped development records alongside this review package, with their scope clearly identified. A certificate covering revision 7 of the parameter tables supports that version’s dated existence. It does not give the same date to instructions added later. Equally, timestamping the assembled package now records the combination available now; it does not establish the earlier history described in its trial reports.

Retain the certificates and verification data, link them from the evidence index and check that verification succeeds before handing over the package. Record separately which version the reviewer received: a timestamp establishes a dated record of material, not its delivery. See what to preserve alongside a timestamp certificate.

Keep the description useful without disclosing the secret

The general inventory can identify CAL-01, its purpose and the categories of material included. Keep the detailed settings and instructions in restricted storage, with access appropriate to the review. Check that filenames and index descriptions do not themselves reveal sensitive parameters.

The restricted description should identify the information or combination the company treats as secret. WIPO notes that a secret combination can include elements that are individually public. For CAL-01, the relevant know-how might lie in how the sequence and settings work together. Calling every file “confidential” would not explain that relationship or demonstrate the measures taken to protect it.

Record changes without replacing what was reviewed

If the team changes the settings during due diligence, preserve CAL-01 version 2.0 and create version 2.1. Record which files changed, why, and which supporting records apply to the update. Tell the reviewer which version is current and retain a record of the version they received.

Before handing over the package, ask a colleague unfamiliar with the method to follow the references. They should be able to identify the included files, distinguish supplier material, locate the agreement covering a contribution and find the files matching a certificate. Any broken connection is a concrete item to resolve before the review proceeds.