M&A due diligence is the structured investigation a buyer (and often its lenders and advisors) performs before acquiring a company. Done well, it confirms what you’re buying, uncovers risks you’ll inherit, and helps you price the deal, negotiate protections, and plan integration. Done poorly, it’s how buyers discover “surprises” after closing—when fixes are most expensive.
Below is a practical, deal-focused breakdown of what M&A due diligence covers, how it’s run, what red flags matter most, and how to keep the process fast without missing the issues that move value.
What M&A due diligence is and why it matters
In most transactions, the seller’s pitch (deck, financials, KPIs, pipeline) is the starting point—not the truth. Due diligence tests that story by validating:
Financial reality: quality of earnings, cash conversion, working capital needs
Legal enforceability: ownership, contracts, liabilities, litigation exposure
Commercial strength: customers, churn, pricing power, market positioning
Operational resilience: processes, suppliers, delivery capacity, scalability
Tax exposure: historical compliance, hidden liabilities, structure efficiency
People and culture: key talent retention, incentives, HR compliance
Technology and security: IP ownership, system robustness, cyber risks
The outcome isn’t just a “go/no-go.” It typically produces a list of value adjustments: purchase price changes, escrow/holdback sizes, earnout terms, reps & warranties, indemnities, conditions to closing, and a 100-day integration plan.
The core diligence workstreams
1) Financial due diligence (QoE)
Financial diligence is often the backbone of the process. A Quality of Earnings (QoE) review looks beyond accounting profit to answer: How sustainable is EBITDA, and how much cash does it produce?
What it typically includes:
Revenue recognition and seasonality
Customer concentration and churn effects on earnings
“Add-backs” (one-time costs) and whether they’re legitimate
Normalized margins and cost structure
Working capital trends and debt-like items
Capex requirements vs. “maintenance” capex
Forecast credibility (assumptions, pipeline conversion)
Common financial red flags
EBITDA inflated by aggressive add-backs
Revenue booked early, high returns/credits later
Significant customer concentration with weak contracts
Chronic underinvestment in capex that will hit post-close
Working capital “games” ahead of close (delayed payables, accelerated collections)
2) Legal due diligence
Legal diligence focuses on what you actually acquire and the liabilities attached to it.
Typical scope:
Corporate structure, shares/units, authority to sell
Material contracts (customers, suppliers, partners)
Change-of-control clauses, termination rights, assignment restrictions
Litigation, claims, disputes, and contingent liabilities
Regulatory compliance for the sector
Real estate, leases, liens, security interests
Insurance coverage and gaps
Common legal red flags
Change-of-control clauses that let key customers terminate
Contracts that are unsigned, expired, or materially noncompliant
Undisclosed disputes or recurring threatened claims
Weak IP assignment language for founders/contractors
Regulatory exposure with penalties or licensing risk
3) Tax due diligence
Tax diligence is about historical exposure and forward-looking structure.
Typical scope:
Corporate income tax filings and audit history
VAT/GST/sales tax compliance
Payroll and withholding taxes
Transfer pricing (for cross-border businesses)
Tax attributes (losses, credits) and limitations on use
Deal structure modeling (asset vs. share deal impacts)
Common tax red flags
Unfiled or late tax returns, aggressive positions without support
Sales tax nexus exposure (especially for multi-state/country operations)
Misclassified employees/contractors triggering payroll taxes
Transfer pricing documentation gaps
4) Commercial / customer diligence
Commercial diligence validates market demand and customer durability.
Typical scope:
Market size, growth, competitive dynamics
Pricing strategy, discounting discipline
Sales pipeline quality and win rates
Customer interviews (when allowed)
Churn cohorts, retention drivers, NPS/support tickets
Product roadmap alignment with buyer thesis
Common commercial red flags
“Sticky” revenue that isn’t actually sticky (short-term contracts, low switching costs)
Pipeline filled with low-probability deals
Heavy discounting to hit targets
Negative customer sentiment masked by top-line growth
5) Operations and supply chain diligence
Operational diligence checks whether the business can deliver at scale and whether operations are dependent on fragile processes or suppliers.
Typical scope:
Production/service delivery capacity
Supplier concentration and sourcing risk
Quality control and warranty/returns analysis
Logistics, inventory controls, and planning
Business continuity and disaster recovery
Common operational red flags
Single-source suppliers for critical inputs
Manual processes with no documentation or controls
Quality issues that haven’t hit financials yet (warranty tail)
Inventory inaccuracies and shrinkage
6) Technology, IP, and cybersecurity diligence (especially for SaaS)
For tech-enabled businesses, this workstream can be as important as financial diligence.
Typical scope:
IP ownership and chain-of-title (employees, contractors, open-source usage)
Codebase health, architecture, scalability
Data security posture, incident history, access controls
Privacy compliance (GDPR/CCPA, consent, retention policies)
Vendor risk (cloud contracts, dependencies, SLAs)
Tech debt and roadmap feasibility
Common tech/security red flags
Core IP owned by a founder personally or by contractors without assignment
Weak security controls and no incident response plan
Open-source licensing problems
Poor documentation and brittle infrastructure
7) HR and benefits diligence
People risks are deal risks—especially when value is tied to a small leadership group.
Typical scope:
Employment agreements, non-competes (where enforceable), confidentiality
Compensation, bonuses, commissions, and equity plans
Benefits plans and liabilities
Employee classification and HR compliance
Key person risk and retention plan
Common HR red flags
Key employees not under enforceable agreements
Commission plans creating undisclosed liabilities
Culture/turnover problems hidden by recent hiring
Misclassification of contractors
8) ESG and regulatory (industry-dependent)
For some deals (energy, healthcare, finance), regulatory diligence is a major value driver.
Typical scope:
Licenses and permits
Environmental liabilities
Anti-bribery/anti-corruption controls
Sanctions/export controls (where relevant)
Safety compliance and incident records
How the M&A due diligence process usually runs
Step 1: Set the diligence plan and “materiality”
Buyers define what matters most to the investment thesis (growth, margin expansion, cross-sell, cost takeout). This is crucial: diligence should focus on value drivers and deal breakers, not everything that could be reviewed.
Step 2: Data room + request list
Sellers populate a virtual data room. Buyers issue a request list that typically includes:
Financial statements, trial balance, AR/AP aging
Customer/supplier contracts
IP and employment documents
Tax filings
Policies (security, HR, compliance)
KPIs and cohort reports
Step 3: Management Q&A and functional sessions
Workstream leads meet the seller’s team, ask follow-up questions, and validate assumptions.
Step 4: Findings report and valuation/terms impact
The real output is an “issues list” mapped to deal terms:
Purchase price adjustment
Working capital peg adjustment
Escrow/holdback
Special indemnities or exclusions
Pre-close covenants or conditions
Earnout metrics and definitions
Step 5: Integration planning (“100-day plan”)
Good diligence feeds integration planning: systems, org structure, customer comms, retention packages, process changes.
The diligence outputs that actually move the deal
A clean diligence binder is nice, but these are the items that typically affect outcomes:
QoE adjustments: normalized EBITDA and sustainable margin
Net debt / debt-like items: deferred revenue treatment, leases, unpaid bonuses
Working capital peg: prevents seller from “underfunding” the business at close
Representations and warranties: what the seller must stand behind
Indemnities + caps + baskets: how claims are handled post-close
Escrow/holdback: security for those indemnities
Conditions to closing: consents, regulatory approvals, key contract renewals
Integration cost estimate: “hidden” costs that change your real purchase price
Common M&A due diligence red flags checklist
Here’s a focused list of issues that often become negotiation points:
Customer concentration > 20–30% in one account (context-dependent)
Contracts with termination for convenience or change-of-control exits
Material revenue reliant on one channel/partner
High churn masked by new customer growth
No clear IP assignments from contractors
Significant unpaid tax exposure or unclear filings
Weak cyber controls, no security audits, prior incidents
“Founder-dependent” sales/operations with no process depth
Aggressive add-backs and inconsistent KPI definitions
Unrecorded liabilities: bonuses, commissions, refunds, warranties
Tips to run diligence faster without losing quality
For buyers
Start with your thesis: define 10–15 “must prove” questions.
Get read-only exports early (trial balance, cohort tables, pipeline).
Use a single, centralized tracker for questions and answers.
Don’t wait for perfect data—parallelize: legal, financial, tech run together.
Push for customer reference calls where feasible and permitted.
For sellers
Build a clean data room before going to market.
Prepare a consistent KPI pack (definitions, cohort logic, reconciliation).
List known issues upfront with mitigation plans (trust speeds the deal).
Have contract summaries ready: term, pricing, renewal, termination, assignment.
Document IP ownership clearly.
M&A due diligence vs. audit: what’s the difference?
An audit is about whether financial statements comply with accounting standards. M&A due diligence is broader and deal-driven: it focuses on sustainability of earnings, cash, risks you inherit, and what changes the price or terms. A company can have audited financials and still fail diligence if contracts, customers, IP, or tax issues don’t support the valuation thesis.
Final takeaway
M&A due diligence is where deals are won or protected. The best diligence is not the longest—it’s the one that ties findings directly to valuation, contract protections, and integration actions. If you approach it as a value-and-risk roadmap rather than a compliance exercise, you’ll move faster and make better decisions.
If you tell me the deal type (asset vs. share), industry (SaaS, manufacturing, services), and whether it’s a majority buyout or a minority investment, I can tailor a diligence checklist and red-flag thresholds to your case.
