# M&A Governance: Keep Integration Inside the CMA Boundary

**Category:** MA
**Author:** AI Assistant
**Published:** 2026-11-04
**Read Time:** 11 min read

## Summary
When CMA interim measures apply, operational boundaries must reach people, systems and integration plans. Connect the order to GRC, company secretarial, contracts and M&A work.

## Full Content
When a UK acquisition is under review, post-deal integration must not run on assumption alone. If the Competition and Markets Authority imposes interim measures, the parties must follow the terms that apply to them, which can constrain integration and require the businesses to be kept separate in specified ways. The practical answer is an operating boundary: translate the actual order into named owners, restricted decisions, controlled information flows and evidence, connected to GRC, company secretarial, contracts and M&A work. Get competition-law advice on the transaction and the order. A software workflow is not clearance.

## The integration plan needs a boundary condition

![A controlled integration gate with separated business systems and approved information flows](https://static.prod-images.emergentagent.com/jobs/sched-simplifi-daily-content-engine-1793782877150/images/0005320d0976f79ce01a18b363ef177d726d3d57370cc2a667a6caf29030be96.jpeg)

## What the market scan covers, and what it misses

For “M&A due diligence to post-merger integration” and “governance after an acquisition”, the current results and AI-style summaries emphasised diligence areas, integration strategy, workstream governance, Day 1 readiness, synergy tracking and operating-model changes. The scan examined [Forvis Mazars' post-merger integration guidance](https://www.forvismazars.com/uk/en/services/financial-advisory/deals/post-merger-integration), the [CMA's guide to how mergers are investigated](https://www.gov.uk/government/publications/mergers-how-they-are-investigated/mergers-how-they-are-investigated) and the CMA's [Interim measures in merger investigations, CMA108](https://assets.publishing.service.gov.uk/media/67766fb8e8ca4d66bc4c9487/CMA108_Interim_measures_in_merger_investigations.pdf). Adviser guidance explains governance and value-creation work. The official CMA material explains that interim measures are a separate competition-control mechanism, with requirements shaped by the measure and the case.

The useful gap is how an organisation controls the boundary while trying to prepare integration. A project plan can contain many work items and still fail if it does not identify which actions are permitted, who may access competitively sensitive information, which services must remain separate, and what evidence demonstrates compliance with an applicable order. The open platform position is to link those boundaries to GRC controls, entity records, contracts and deal milestones, while keeping legal interpretation with qualified advisers.

## Do not confuse integration preparation with permission to integrate

The phrase “integration planning” covers very different activities. Some preparation may be about planning people, systems, workstreams and decision routes. Other activity can change actual operations, management, access to information or competitive conduct. The line is not safely resolved by calling an activity “planning” or marking it “Day 1”. The facts and applicable legal requirements matter.

The [CMA's merger investigation guidance](https://www.gov.uk/government/publications/mergers-how-they-are-investigated/mergers-how-they-are-investigated) describes its investigation process and possible remedies. The CMA's [CMA108 interim measures guidance](https://assets.publishing.service.gov.uk/media/67766fb8e8ca4d66bc4c9487/CMA108_Interim_measures_in_merger_investigations.pdf) explains how interim measures may be used and stresses the importance of compliance. In a particular case, the operative order and any permitted derogation or variation determine the obligations. Do not generalise one order's wording to another transaction.

A hold-separate requirement is not a generic template that applies automatically to every acquisition. If the CMA makes an interim measure, it may be tailored to circumstances and can impose obligations aimed at preventing pre-emptive action or preserving the target business. The actual document, parties covered, scope and any later variation must be read. Obtain specialist advice before changing access, management, services, commercial terms or operational processes.

## Create an order-to-control register

The first job is to convert the actual legal instrument into an operational record without rewriting it into a vague summary. Preserve the order, its date, parties, terms, relevant correspondence and any variation. Have competition counsel interpret the obligations and identify permitted actions. Assign an accountable business owner to each operational restriction or condition.

1. **Source:** What to record: Exact order, paragraph, date and version; Why it matters: Prevents reliance on an outdated summary
2. **Scope:** What to record: Entity, business, asset, people and activity covered; Why it matters: Avoids applying a rule to the wrong perimeter
3. **Prohibition or condition:** What to record: Counsel-reviewed description linked to the text; Why it matters: Keeps the operational instruction anchored to law
4. **Permitted activity:** What to record: Approval, exception or derogation and its limits; Why it matters: Avoids treating silence as permission
5. **Owner:** What to record: Person responsible for the control in each business; Why it matters: Makes execution accountable
6. **Evidence:** What to record: Access logs, approvals, training or service records; Why it matters: Supports monitoring and review
7. **Trigger:** What to record: Proposed change, new access, incident or order change; Why it matters: Brings the issue back for decision
8. **Escalation:** What to record: Legal contact, decision forum and response route; Why it matters: Enables prompt handling of uncertainty

This is a working control record, not a substitute for the legal instrument. Every operational summary should link to the source and identify who approved the interpretation. When the order changes, update the scope, communications and evidence requirements together. Do not remove history or overwrite the previous version without an audit trail.

### 1. Fix the perimeter before routing work

Identify which legal entities and business activities are within scope. Build a map of the acquirer, target, relevant subsidiaries, shared services, key systems, suppliers, customers and management roles. Record which facts are verified and which are assumptions. If a company name or business unit is ambiguous, stop and resolve it with the deal team and counsel before assigning permissions.

The entity perimeter should be date-sensitive. A target structure, a proposed post-completion structure and the group chart after integration are not the same thing. Keep separate snapshots and mark which one applies to each action. If ownership or control changes during the process, route the event for legal review rather than relying on a static chart.

### 2. Convert legal restrictions into specific operational controls

For each obligation, define the prohibited action, permitted action, responsible owner, preventive control, monitoring evidence and escalation route. The operational instruction should be concrete enough to use. “Do not integrate” is often too vague for teams that need to know whether shared IT support, an employee transfer, common branding, access to customer data or a supplier change is permitted.

Do not let a project manager make a legal determination from an abbreviated status field. Build a consultation route so uncertain activities go to competition counsel before they occur. Make it clear that an urgent operational need does not automatically create an exception. If permission is sought, retain the request, advice, approval and any limitations.

### 3. Control information access by purpose and role

Identify what information is sensitive to competition, what is required for legitimate diligence or operations, and who may see it. Use clean-team or restricted-access arrangements only where designed and approved by advisers for the specific transaction. Set access by role and purpose, record approvals and retain logs. Revoke or adjust access when a role changes or the applicable boundary changes.

A data room's access controls do not themselves establish that information sharing is lawful or appropriate. Likewise, labelling a folder “clean team” does not make it safe. The control needs a documented scope, approved participants, prohibited onward use, oversight and a route for questions. Keep system permissions consistent with the legal advice and the order.

### 4. Establish an approval gate for proposed integration actions

Every material action that touches the target's management, systems, assets, pricing, customers, suppliers, personnel or operations should be triaged against the applicable boundary. The gate should capture the proposed action, reason, entity, people and systems affected, timing, supporting evidence, legal review, decision and conditions. Record whether the action is approved, prohibited, deferred or needs more information.

The status must not be inferred from a project plan. “Green” means only what the approval record says it means. If counsel's advice is conditional, retain those conditions in the task and verify them before execution. The owner should confirm completion and provide evidence. A downstream status update without the approval and source is not enough.

### 5. Monitor changes and exceptions

A newly requested system permission, a supplier's service change, a manager's dual role, a transfer of staff, a customer communication or an operational incident may change the risk profile. Set event triggers and assign a monitoring owner. When the trigger occurs, pause the affected work where appropriate and obtain advice under the agreed process. Do not imply that every such event breaches an order; the point is to make sure a relevant change is assessed before it is treated as routine.

If an exception or derogation is approved, record the precise scope, duration, conditions and decision source. Track the end date or event that closes it. Confirm after the event that the conditions were met and that any temporary access or process has been removed. Keep a clear distinction between a request for permission and permission actually granted.

### 6. Hand control forward after completion

If restrictions remain after completion, the business cannot assume that the deal team will remember them. Name the continuing control owner, transfer the latest order and advice, reconcile active permissions and contracts, and train the receiving teams. Set a review schedule and event triggers. Keep the transaction's open items visible in integration governance until there is a documented reason to close them.

The workstream can be transferred; legal responsibility and the facts do not disappear. Confirm that the operating model, entity structure, supplier arrangements and systems now reflect the approved state. Keep a record of what remains restricted, what has been permitted and who can answer questions.

![Controlled information access between acquirer and target teams under reviewed permissions](https://static.prod-images.emergentagent.com/jobs/sched-simplifi-daily-content-engine-1793782877150/images/7dd53e39bbf59ecf83d108e904310a51579adf4ec4b3ed32a77fcd066a4658ad.jpeg)

![The transaction order linked to an entity, risk control, contract and integration milestone](https://static.prod-images.emergentagent.com/jobs/sched-simplifi-daily-content-engine-1793782877150/images/f2d20b2e95c1655c50db1088ad4cf72b09cbd197d64faa82a8dfc06edac82c35.jpeg)

## Connect the boundary across the platform

### GRC: turn the order into controls and evidence

GRC should hold the applicable risk, control, owner, evidence, exception, incident and remediation record. A control failure or proposed exception can then be escalated through the agreed governance route. Simplif-i's [GRC workspace](https://simplif-i.com/solutions/grc) describes risk registers, controls, evidence, audit activity and remediation. The tool can coordinate work; it cannot determine whether a proposed act is permitted by a CMA order.

### Company secretarial: preserve which entity and body is acting

Connect the restriction to the entities and approval bodies that it affects. Keep board or committee records distinct from operational permission. Do not use general group approval as a substitute for legal review of a transaction restriction. Simplif-i's [company secretarial workspace](https://simplif-i.com/solutions/company-secretary) describes entity records, board packs, resolutions and authority records. Those records support traceability, not a competition-law conclusion.

### Contracts: check supplier and service dependencies

The order may affect how a supplier provides services or how the businesses access contractual information. Link relevant agreements, owners, permitted access, change requests and notice obligations. A contract term does not automatically authorise an action that conflicts with an applicable order. Simplif-i's [contracts workspace](https://simplif-i.com/solutions/contracts) describes contract records, obligations, supplier links and changes to be monitored.

### M&A and PMO: make approval a gate, not a retrospective note

The deal room and integration plan should share the approved boundary, open conditions, milestones and owners. A workstream cannot mark an action complete until any required legal approval and evidence are recorded. Keep unapproved actions out of the executable plan or mark them clearly as conditional. Simplif-i's [M&A workspace](https://simplif-i.com/solutions/ma) describes deal-room documents, AI-assisted review, findings and integration milestones. The page states that AI findings require human review and professional review is not replaced.

## Test the process before a deadline forces it

Run a tabletop using a realistic integration proposal: a request to migrate a target system, combine supplier support, share a customer list or move an employee into a shared team. Ask the deal team to identify the relevant entity, order paragraph, current permission, data and personnel affected, decision owner, counsel route, evidence and contingency if approval is not available. The aim is not to invent a rule. It is to expose whether the organisation can find the applicable rule and make a controlled decision in time.

Then test an order change. Can the new scope reach the people, system permissions, supplier tasks and workstream plans that it affects? Can the business show who received the update and when? Can an auditor distinguish an approved action from a request that was never granted? If not, the integration process relies on personal memory.

## Where Simplif-i fits

Simplif-i publishes workflows for M&A due diligence and integration, GRC controls, company records and contract management. That creates a potential place to connect a deal finding to the entity, risk, agreement, owner and milestone that follow. The system is workflow support, not competition counsel, a clearance mechanism or proof that integration is permitted. Simplif-i's published page says it is onboarding its first customers. Any buyer should test role-based access, legal hold-separate controls, evidence history, configuration and security with advisers before relying on it for a live transaction.

## Frequently asked questions

### Does a hold-separate requirement apply to every UK acquisition?

No. Do not assume that it does. The CMA's interim measures guidance describes tools that may be used in merger investigations. Whether a measure applies, and what it requires, depends on the particular case and the operative instrument. Obtain transaction-specific advice.

### Can integration planning begin before completion?

That question cannot be answered safely in the abstract. Distinguish preparation from actions that change operations, access or competitive conduct, and assess the specific facts and applicable rules with competition counsel. A label such as “planning” does not decide the issue.

### Does a CMA order allow any activity it does not mention?

Do not assume so. Read the full operative instrument, applicable law, correspondence and any approved derogation or variation with counsel. Seek advice before acting where the position is unclear.

### Can a project management system demonstrate compliance on its own?

No. It can organise owners, permissions, evidence and decisions. It cannot replace the legal instrument, specialist advice, accurate execution or appropriate monitoring. Evidence must reflect what actually happened.

### What should happen when an integration action is urgent?

Use the defined escalation route, preserve the relevant activity and timing details, and seek advice from the designated competition counsel. Do not treat urgency as permission. Record any advice, approval and conditions before proceeding where required.

## Sources

- [CMA, Interim measures in merger investigations, CMA108](https://assets.publishing.service.gov.uk/media/67766fb8e8ca4d66bc4c9487/CMA108_Interim_measures_in_merger_investigations.pdf)
- [CMA, Mergers: how they are investigated](https://www.gov.uk/government/publications/mergers-how-they-are-investigated/mergers-how-they-are-investigated)
- [Forvis Mazars, Post-merger integration](https://www.forvismazars.com/uk/en/services/financial-advisory/deals/post-merger-integration)
- [Simplif-i M&A solution](https://simplif-i.com/solutions/ma)
- [Simplif-i GRC solution](https://simplif-i.com/solutions/grc)
- [Simplif-i company secretarial solution](https://simplif-i.com/solutions/company-secretary)
- [Simplif-i contracts solution](https://simplif-i.com/solutions/contracts)

---
Source: https://simplif-i.com/api/blog/readable/ma/ma-cma-hold-separate-integration-boundary-20261104
Web Version: https://simplif-i.com/blog/ma/ma-cma-hold-separate-integration-boundary-20261104
© Simplif-i - Unified Business Management Platform