Due diligence is verification under transaction pressure.
The buyer tests whether the facts, the economics and the risks behind its offer survive scrutiny. A finding can become a price change, an indemnity, a warranty and a disclosure, a condition to closing, a reason not to close – or nothing at all. Here is who does the testing, what each team looks for, how long it takes, and why the outcome is largely decided before the data room opens.
- Diligence is not an audit and not an exam: it is verification, and it rewards a company whose numbers reconcile and whose known issues were disclosed first.
- A finding is not automatically a price reduction. It becomes one when the buyer can credibly argue that the economics or the risk it underwrote have changed.
- Buyers diligence companies. Founders should diligence buyers – especially if they are staying, taking an earn-out or rolling over.
Seven teams, one price.
- Financial.
The quality-of-earnings analysis: what recurs, what was a one-off, what the owner’s costs were, how earnings convert to cash, what working capital the business really needs and what counts as debt. The team rebuilds your EBITDA from the ledger up and compares it with the number the price was built on; the gap is the first negotiation. In software, the cohort and retention analysis sits here too – net and gross retention, contract terms, revenue recognition, the run-rate of what was signed last quarter. Quality of earnings, in the valuation chapter →
- Tax.
Historical exposures the buyer would inherit in a share deal: corporate tax positions, VAT, payroll and social-security treatment of contractors and equity, transfer pricing between group companies, the tax history of the structure itself. Findings here tend to become specific indemnities that survive for years rather than changes to the price.
- Legal.
Corporate records and the chain of title to every share; the contracts that carry the revenue, read for change-of-control, assignment, exclusivity and termination clauses; intellectual property – who created the code, under what agreements, and whether the company owns it outright; litigation and disputes; regulatory and data-protection compliance. The commercial contract you have not read since it was signed is the classic week-ten surprise.
- Commercial.
Market size and position, competitive dynamics, and – the part founders underestimate – direct interviews with your customers, conducted by the buyer’s advisers, as late in the process as the seller can hold them, and often framed as market research. Concentration is examined here: not the percentage itself but whether the relationship and the contract survive a change of owner.
- Technology.
Architecture and scalability, code quality and technical debt, open-source components and their licences, security posture and incident history, the dependency on named engineers – and, increasingly, the provenance of training data and the defensibility of anything described as AI. A buyer’s chief technology officer will price what they would have to rebuild.
- People.
Key individuals and the terms that bind them; employment contracts and their compliance with local law; incentive plans and what a change of control does to them; pension and social-security exposures; works councils and consultation duties in the relevant jurisdictions. The buyer is deciding who it needs to keep and what that will cost – a cost it will try to fund from the price.
- Operations, IT and everything else.
Systems, suppliers, insurance, property, environmental and ESG matters, sanctions and export controls, subsidies with clawback conditions. Rarely decisive; occasionally fatal.
What a private company’s diligence actually involves.
The first two are large-deal figures from global platforms; the third is from seventy-five small US deals. The proportions are the point. A buyer’s diligence is a project with more people on it than your finance team, running for months, whose participants are paid to check things. It is not personal, and it is not adversarial in the way founders expect; it is procedural, and procedure rewards preparation. A company whose data room was complete before launch, whose numbers reconcile to the ledger and whose known issues were disclosed first gives the procedure little to find that it has not already priced.
Every issue ends in one of six places.
Vendor due diligence, the data room, and one voice.
Vendor due diligence reverses the order: the seller commissions an independent report on its own company – financial, sometimes tax, legal and commercial – before any buyer arrives, and gives it to the bidders. It is used in larger European auctions because it speeds the process, keeps the information flow in the seller’s hands, and lets bidders bid on the same facts.4 Below the size at which a full vendor report is proportionate, the same logic applies at smaller scale: a sell-side quality-of-earnings analysis, a legal health check of the contracts and the cap table, a technology review by someone who will say what a buyer’s CTO will say. The readiness review is this, before any mandate →
The data room is built before launch and released in stages: enough for indicative offers, more for the shortlist, everything for the buyer under exclusivity – with the most sensitive material, customer names and code among it, held to the end. How disclosure is staged → One coordinator on the seller’s side answers every question, keeps the log, and makes sure the same number appears in the memorandum, the model, the room and the management presentation. Inconsistency is the finding that costs most and proves least; it is also the one that is entirely within your control.
And diligence runs both ways. The buyer will know your company in detail by closing. You should know theirs: what happened to the founders, the products, the people and the promised investment in their last three acquisitions. Diligence the buyer, in chapter 7 →
Two years out, the diligence list in this chapter is the most useful preparation checklist we know; the eight-point self-check on the preparing page is the founder’s view of the same questions, and the readiness review is the formal version, rated dimension by dimension. Eight things a buyer will test →
1 SS&C Intralinks with the Bayes Business School M&A Research Centre and Mergermarket, The Dynamics of Due Diligence (2024): 900+ deals announced 2013–2023; averages for private and public targets as stated. Mostly larger, announced transactions.
2 Datasite, first-half 2026 platform data (July 2026): median diligence time 181 days, median preparation time 12 days. One vendor’s platform; “diligence time” is the active life of the project.
3 Axial, Dead Deal Report (January 2026): of 75 letters of intent that broke in 2025, 25.3% on non-earnings diligence findings, 21.3% on quality-of-earnings discrepancies and 8.0% on business underperformance – 54.6% together. Small, US lower-mid-market, self-reported.
4 Deloitte Switzerland, Vendor due diligence: an independent, seller-commissioned report for prospective acquirers, used in auctions, dual-track and IPO preparation. No survey measures how often vendor due diligence is used in European mid-market processes.
Find out what a buyer will find – before a buyer does.
The readiness review covers six of these seven workstreams – tax stays with your tax adviser – in six rated dimensions, the way a buyer’s committee will, and gives you the report. We lead the commercial transaction: valuation, process, buyer strategy and the negotiation of the economics. Your M&A counsel leads legal advice, legal risk allocation and the drafting of the agreement; formal financial, tax and technical diligence is performed by the appropriate independent specialist. We work the issues together; we do not substitute for either. A paid, fixed-fee engagement, stated in writing before we start; no mandate attached.
Reading this with a live transaction in front of you? Ask a partner about due diligence → No engagement, and no need to name the company.