Due diligence

Due diligence (DD) is the structured investigation a buyer (with its advisors) conducts on a target company in the window between the signing of the letter of intent and the signing of the definitive purchase agreement — typically eight to fourteen weeks of intense work in modern private-company M&A.^[1][2] Its job is to verify what the seller has represented, uncover risks the seller may not have disclosed, quantify what those risks are worth, and act on the findings — by adjusting price, restructuring deal terms, demanding contractual protections, or walking away.

Diligence is the single workstream that separates good buyers from bad ones. Empirical research on M&A failure consistently identifies inadequate due diligence as a leading cause of value destruction post-close, alongside overestimated synergies and weak integration.^[3] On the sell side, the corollary is that preparing for the buyer's diligence — and pre-empting it with a sell-side QofE — is one of the highest-leverage ways an owner can compress the deal timeline and reduce retrade risk.

Why due diligence exists

The seller knows the business; the buyer does not. Closing the information gap is a basic prerequisite for the transaction to be priced correctly and to close at all. Diligence operates at three levels:

1. Verification. Confirm that what the seller has told the buyer is true. Trial balance ties to the income statement; the customer list reconciles to invoiced revenue; the major contracts are what the seller says they are.
2. Discovery. Find what the seller has not told the buyer — sometimes by omission, occasionally by misrepresentation, often because the seller does not know it themselves. Side letters, oral commitments, environmental issues, undocumented related-party transactions, customer churn that has not yet appeared in revenue.
3. Quantification. Convert findings into dollars. A customer concentration above 30% might be worth a 10–20% price discount or a $2M earnout shift; a permitting irregularity might be worth a $500K escrow.

The output is a set of decisions: adjust the price, harden the indemnification, expand the escrow, walk away.

Buyer perspective vs seller perspective

The same workstream looks very different from the two sides of the deal table.

Buyer-side diligence

The buyer is paying real money for a business it has known for weeks or months. Its diligence questions are:

• Is the EBITDA real? Not just reported, but the run-rate adjusted EBITDA buyers will pay a multiple on. The QofE report answers this.
• What customers are at risk? Customer-cohort analysis, retention rates, contract auto-renewals, top-customer interviews.
• What contracts have change-of-control clauses? Identifying which deals can be voided or renegotiated by counterparties when ownership changes.
• What are the unrecorded liabilities? Litigation pipeline, environmental exposure, tax positions, undisclosed warranties.
• Will the people stay? Key employees, their compensation, their non-competes, their willingness to work for new ownership.
• What does it actually take to operate this business? IT systems, supply contracts, real estate, facility licenses.

The buyer's diligence findings are negotiating leverage. Each material issue surfaces a choice: re-price, restructure, indemnify, or walk.

Sell-side diligence (preparation)

The seller's "diligence" is upstream and outbound: pre-empt and pre-position findings before the buyer's team finds them in unfavourable light. A well-prepared sell-side process produces:

• A sell-side QofE that puts a credible normalised EBITDA in the CIM and on the LOI, anchoring price and dramatically reducing buyer retrades.^[4]
• A clean, indexed virtual data room populated before outreach starts.
• Pre-resolved issues: outstanding litigation settled or accrued for, related-party transactions terminated or documented, missing leases reconstructed.
• A draft of the disclosure schedules to the purchase agreement, with a defensible position on each known issue.

The largest single retrade-prevention move in the lower-middle market is a sell-side QofE 60–120 days before launch.

The eight workstreams

Buy-side diligence is organised into discrete workstreams, each with its own team, deliverable and timeline.

1. Financial diligence

The largest workstream by spend, and the one whose findings move price the most. Conducted by a transaction-services accountant — often Big-Four for $50M+ deals, mid-tier or specialty firms for the lower-middle market. Core deliverables:

• Quality of earnings (QofE) report — see quality-of-earnings. Tests reported EBITDA against accounting policies, normalisation adjustments, one-time items, customer-cohort revenue trends and gross-margin sustainability.
• Working-capital analysis — trailing-twelve-month average net working capital, seasonality patterns, the working-capital target peg, and the cash-conversion cycle.
• Debt and debt-like items schedule — what gets subtracted from enterprise value to bridge to equity value: traditional debt, capital-lease obligations, deferred consideration on prior acquisitions, contingent liabilities, underfunded pensions, accrued bonuses.
• Cash-flow build — converting reported earnings into the free-cash-flow waterfall a buyer will model in its base case.
• Customer- and product-cohort analysis — revenue-retention rates, customer concentration, churn, expansion revenue.

2. Legal diligence

Conducted by buyer's M&A counsel. Reviews the legal underpinnings of the business and surfaces issues that drive indemnification, reps and warranties scope, and conditions to closing. Areas covered:

• Corporate records, ownership history, capitalisation table, equity issuances and stock-option grants.
• All material contracts: customer master agreements, supplier agreements, leases, employment agreements, IP licenses, indebtedness, change-of-control clauses.
• Litigation and threatened litigation; settled litigation in the last 5–7 years.
• Permits and licenses; regulatory standing.
• IP ownership: patents, trademarks, copyrights, trade secrets, employee invention-assignment agreements.
• Privacy and data security obligations: GDPR/CCPA exposure, breach history.

3. Tax diligence

See tax-due-diligence. Reviews federal, state and local income-tax exposure, sales-and-use tax, payroll tax, transfer pricing, R&D credits, NOL availability and the historical positions taken on aggressive deductions. Cross-state nexus is one of the most commonly missed exposures in lower-middle-market deals.

4. Commercial diligence

Frequently outsourced to a strategy consultancy or specialty CDD firm. Focuses on the outside-in view of the business:

• Market sizing, growth, structure, fragmentation.
• Competitive positioning, pricing power, market-share trajectory.
• Customer interviews — buyers, defectors, prospects — to test the seller's customer-relationship narrative.
• Industry trend analysis, regulatory environment, technology disruption risk.
• Sales-pipeline coverage and growth assumptions in the management plan.

5. Operational diligence

Walks the operations: facilities, supply chain, equipment, capacity utilisation, safety, quality systems, product/service delivery process. In home-services M&A this includes route density, dispatch software, technician productivity, callback rates, warranty exposure, fleet condition and parts-inventory management.

6. IT and cybersecurity diligence

Increasingly its own workstream as data has become central:

• IT systems landscape: ERP, CRM, billing, dispatch (e.g., ServiceTitan, FieldEdge), payroll, finance.
• Software licenses and SaaS contracts.
• Cybersecurity posture: penetration test results, incident history, ransomware preparedness, MFA coverage.
• Data privacy compliance.
• Integration complexity assessment.

7. HR / human-capital diligence

• Headcount, organisation chart, span of control, compensation benchmarking.
• Turnover history, particularly key roles.
• Benefits structure, retirement plan funding, paid-time-off accruals.
• Equity plans, vesting, change-of-control acceleration.
• Employment agreements, non-competes, non-solicits, severance arrangements.
• Pending HR matters: discrimination claims, wage-and-hour issues.

8. Environmental diligence

Phase I environmental site assessments on owned real estate; Phase II as needed. Asbestos, lead paint, underground storage tanks, hazardous-waste handling, OSHA history. In home-services categories that handle refrigerants (HVAC), solvents (electrical) or pesticides (pest control), targeted regulatory diligence is required.

Sample document request lists

Each workstream issues a document request list (DRL) at kick-off. Below is a representative sample — actual lists run dozens to hundreds of items depending on deal size and complexity. (See the Confidential Information Memorandum for what a sell-side data room should already contain on Day 1 of buyer access.)

Financial diligence DRL — selected items

• Trial balance, general ledger detail, monthly P&L by customer/product, last 36 months
• Bank statements and reconciliations, last 24 months
• Customer revenue detail by customer by month, last 36 months
• Top-20 customer contracts and terms
• AR aging detail at each month-end, last 24 months
• Inventory listing with valuation method, last 12 months at each quarter-end
• Capital-expenditure detail, last 36 months
• Deferred-revenue and accrued-liability waterfall
• Owner compensation, distributions, related-party transactions, last 5 years
• Bonus and commission plans
• Insurance schedules (D&O, GL, EPL, cyber, workers’ comp), claims history

Legal diligence DRL — selected items

• Corporate org chart, certificate of incorporation, bylaws, all amendments
• Capitalisation table, all stock issuances and option grants since inception
• Minute books and resolutions of board and shareholders
• Material contracts (revenue ≥ defined threshold, term ≥ 12 months, exclusivity)
• Lease agreements for all owned and leased real estate
• IP registrations, prosecution files, license-in / license-out agreements
• Open and threatened litigation; settled in the last 5–7 years
• Government investigations or regulatory inquiries
• Insurance policies and claims history
• Compliance with industry-specific regulation

Customer / commercial DRL — selected items

• Customer count by year, channel and segment
• Top-50 customers: revenue history, contract terms, sales rep, service status
• Lost top-customers in the last 36 months: reason, replacement
• New-customer acquisition: cost, channel, conversion
• Win/loss analysis on RFPs in the last 24 months
• Customer satisfaction (NPS, online reviews, complaint logs)

A well-organised data room turns these DRLs from a multi-week scavenger hunt into a structured walk through indexed folders.

Red flags by category

The findings that most often cause deals to retrade or break in lower-middle-market M&A:

Financial red flags

• Reported EBITDA materially higher than QofE-adjusted EBITDA (>15–25% gap).
• Revenue recognition policy that pulls forward future-period revenue.
• Working-capital position that has been depleted in the run-up to the sale.
• Customer concentration: any single customer above 15–20% of revenue.
• Gross-margin trend declining while revenue grows (volume-discounting, mix-shift).
• "One-time" add-backs that recur every year for the last three years.

Legal / contract red flags

• Anti-assignment clauses on top customer contracts that the seller has not flagged.
• Active litigation not disclosed in the CIM.
• IP that is not assigned (e.g., contractor-developed code without invention-assignment agreements).
• Side letters or oral commitments that contradict written agreements.
• Compliance gaps: lapsed permits, unfiled state-tax returns, outdated licenses.
• Pending regulatory inquiries that have not been disclosed.

Operational red flags

• Owner-dependence: the founder is the largest sales rep, top technician or sole signatory on key contracts.
• Key-person risk in the COO/finance/operations roles without documented backup.
• Single-source supplier for a critical input.
• IT systems that are unmanaged, unsupported or subject to migration risk at change of control.
• Real-estate concentration with related-party landlords at off-market rates.

Tax red flags

• State-tax nexus exposure (income, sales, payroll) in jurisdictions where the company has filed nothing.
• Aggressive R&D credit positions without contemporaneous documentation.
• Worker-classification issues (1099 contractors who function as W-2 employees).
• Unrecorded sales tax on bundled service-and-product offerings.
• Old NOLs likely subject to Section 382 limitation post-close.

HR red flags

• Wage-and-hour issues (unpaid overtime, misclassification).
• Pending discrimination, harassment or wrongful-termination claims.
• High turnover in the last 12 months — particularly in field operations.
• Underfunded retirement plans or benefit accruals.

Environmental red flags

• Phase I findings recommending a Phase II.
• Underground storage tanks of any age.
• Hazardous-waste manifests with gaps.
• OSHA citations in the last 5 years.

Lower-middle-market specifics

Diligence in the $1M–$50M EV segment differs from large-cap M&A in several important ways, and getting the differences right is what separates an effective lower-mid-market diligence team from one used to bigger budgets and longer timelines.

• Scope is proportional to deal size. A $5M deal cannot afford a six-week Big-Four QofE; it can absolutely afford a focused two-week sell-side QofE from a specialist firm.
• Owner-dependence is the dominant risk. In large-cap deals, "key person" risk is a footnote; in a $4M EBITDA HVAC business, the owner-as-top-technician issue can swing the multiple by a full turn.
• Data quality is uneven. Lower-mid-market sellers often track revenue in QuickBooks and dispatch in field-service software with inconsistent customer matching. Diligence has to invest in reconciling the two, and the seller has to live with the surprises that surfaces.
• Working-capital diligence is consequential. A poorly-pegged working-capital target on a $20M deal is six-figure money the seller will not see at closing.
• Sell-side QofE pays back. Investing $30–60K on a sell-side QofE before launch routinely saves six-figure retrades in diligence.^[4]
• R&W insurance changes the diligence economics. With R&W insurance now standard at $20M+, the insurer's underwriting team becomes a third diligence customer alongside the buyer and seller.

Real-deal implications

Diligence findings translate into tangible deal-term moves. The most common:

• Price reduction. A QofE-adjusted EBITDA materially below the LOI EBITDA at the same multiple cuts the headline price by the gap × the multiple.
• Earnout introduction. Where some risk is real but quantifiable only in hindsight (customer churn, post-close growth), the buyer pushes 10–25% of price into a multi-year earnout.
• Escrow expansion. Identified-but-quantified risks (specific litigation, an exposed permit, a recurring tax issue) are often handled by carving out a specific escrow reserve.
• Indemnification carve-outs. Discovered issues become "specific indemnities" that survive the general-rep survival period and have higher caps.
• Reps-and-warranties insurance retention adjustments. Issues identified in diligence are typically excluded from R&W coverage, leaving the seller on the hook for them in traditional indemnification.
• MAC clause hardening. Diligence findings on unstable customer relationships often produce more aggressive MAC clause drafting.
• Outright deal break. When the discovery is large enough — material undisclosed liability, material misrepresentation, environmental disaster — the buyer terminates under the LOI's contingencies. Roughly 5–10% of LOIs that enter diligence do not reach signing in lower-mid-market M&A.

The data room

The virtual data room (VDR) is where diligence physically happens — a permission-controlled web repository where the seller posts documents in response to DRLs, the buyer's team reviews them and submits Q&A, and access is staged by deal phase and bidder identity. Best practices:

• Indexed structure. Folders mirror the DRL categories: 01-Corporate, 02-Financial, 03-Customers, 04-Contracts, etc.
• Version control. Documents are versioned and dated; replacements do not silently overwrite originals.
• Q&A in the room. Buyer questions and seller answers are visible to all bidders (or to the bidder asking, depending on process design) and become part of the disclosure record.
• Permission gates. Detailed pricing schedules and customer names may be accessible only to short-listed bidders post-LOI; the rest of the room opens earlier.
• Watermarking. Sensitive documents are user-watermarked to discourage unauthorised distribution.
• Activity log. The seller can see which buyers have looked at which documents — useful for gauging genuine engagement.

Diligence timeline

For a private-company sell-side process targeting a 6–9-month close, the diligence sub-timeline typically looks like:

Week	Buyer-side workstream activity
0 (LOI signing)	Buyer issues confirmatory-DD work plan and DRL across all workstreams
1–2	Document collection, initial financial walk-through, kick-off calls in each workstream
3–4	QofE field work; legal contract review; commercial customer interviews begin
5–6	First findings memo; emerging-issues call between buyer and seller leads
7–8	Workstream draft reports; seller-side responses and remediation; revised disclosure schedules
9–10	Final QofE; final legal report; integration-planning session; tax structuring finalised
11–12	Definitive-agreement negotiation incorporating findings; R&W insurance underwriting completes
13+	Signing; remaining closing conditions (regulatory, third-party consents, financing close)

Compressed timelines (4–8 weeks total) are possible in proprietary deals or with sellers who arrive prepared; extended timelines (16+ weeks) are common where major issues surface.

Frequently asked questions

What is due diligence in M&A?

The structured investigation a buyer conducts on a target between the LOI and the definitive agreement, covering financial, legal, tax, commercial, operational, IT/cyber, HR and environmental workstreams. Its purpose is to verify the seller's claims, surface risks the seller may not have disclosed, and convert findings into adjusted price, contractual protections, or a decision to walk.

How long does due diligence take?

In private-company M&A: typically 8–14 weeks between LOI and signing. Compressed timelines are possible in proprietary deals or where the seller has arrived with a sell-side QofE and a clean data room; extended timelines (16+ weeks) are common where major issues surface mid-process.

Who pays for due diligence?

The buyer pays for buy-side diligence (its accountants, lawyers, commercial diligence firm). The seller pays for sell-side diligence (its sell-side QofE and any pre-process clean-up). Each side typically eats its own deal expenses unless the LOI specifies otherwise.

What is the difference between financial due diligence and a quality of earnings report?

The QofE is the primary deliverable of financial diligence. Financial diligence is the broader workstream — including working-capital analysis, debt-like-items schedule, cash-flow build and customer-cohort analysis — of which the QofE report is the most visible component.

What are typical due diligence red flags?

In order of how often they kill or retrade lower-mid-market deals: customer concentration above 25%, owner-dependence, QofE-adjusted EBITDA materially below reported, undisclosed litigation, state-tax nexus exposure, unrecorded liabilities, change-of-control clauses on top customer contracts, environmental Phase II findings.

Can a deal be killed during due diligence?

Yes. Roughly 5–10% of LOIs in lower-middle-market private-company M&A do not reach signing, almost always because of a material adverse finding in diligence. Many more deals retrade — the price drops, structure shifts to earnout, or escrow expands — without breaking outright.

What is sell-side due diligence?

The seller's preparation work upstream of buyer diligence — typically a sell-side QofE, a clean and indexed data room populated before outreach starts, pre-resolution of identified issues, and draft disclosure schedules. A high-quality sell-side process is the single biggest move a seller can make to compress the deal timeline and reduce retrades.