M&A due diligence is a comprehensive investigation process for target company verification before you sign, finance, and close a deal. This checklist is built for a 30 to 90 day diligence period, with the documents, questions, and workstreams you need to test the target company's business before finalizing terms.
It's written for PE/VC associates, corporate M&A teams, boutique consultants, and founders doing buy-side work. It's not law school theory. It's a working template for a virtual data room, Q&A tracker, and final due diligence report.
Start here
A due diligence checklist typically includes 20 essential items, but lower-mid-market control deals usually need more detail. This version assumes a private company acquisition with enterprise value around $20M to $300M, and can be trimmed for small tuck-ins or expanded for public-company mergers and acquisitions.
A comprehensive checklist covers financial, legal, and operational areas. Due diligence serves as the primary barrier against failed M&A investments.
Use this checklist if you're:
- A PE or VC associate building an investment memo
- A corporate development analyst running a diligence investigation
- A founder or operator assessing an acquisition target
- A consultant supporting both the buyer and client team
- A diligence lead coordinating advisors and diligence materials
Throughout the process, expert calls through FieldSignal help test assumptions that documents don't prove — churn, pricing power, management quality, supplier risk, and customer sentiment.
Deal timeline: 30/60/90-day process
M&A due diligence typically lasts 30 to 90 days, with milestones tied to financing, regulatory compliance, and the purchase and sale agreement.
The process includes five key steps: scope the workstreams, request diligence materials, verify the evidence, quantify findings, and negotiate deal terms.
| Phase | Main objective | Workstreams |
|---|---|---|
| Day 0 to 30 | Build fact base and flag red issues | Financial, legal, tax, commercial, HR, IT, real estate, ESG/compliance |
| Day 31 to 60 | Run detailed diligence review | Financial due diligence, legal due diligence review, operational due diligence, commercial due diligence, technology, tax |
| Day 61 to 90 | Confirm findings and document protections | Disclosure schedules, stock purchase agreements, financing agreements, price adjustments, escrow, closing conditions |
Practical constraints matter. Audited financials may lag. A Phase I environmental site assessment often takes 1 to 2 weeks; Phase II testing can take 4 to 6 weeks. Antitrust inquiries can add months.
For deals with material property exposure, run a separate real estate track in parallel with core corporate diligence — title, zoning, leases, property condition, capex, environmental.
Core types of M&A due diligence
Key areas include financial, legal, operational, and HR assessments. Most deals also include tax, commercial, technology/IP, real estate, ESG, and compliance workstreams. Each workstream has an owner, but every matter feeds into one integrated due diligence report.
Financial due diligence checklist
Financial DD examines income statements and cash flow, balance sheets, working capital, revenue quality, and debt. See our deeper commercial due diligence guide for the buyer's framework.
Checklist items:
- Historical financial statements for 3 to 5 years
- Audited or reviewed financial statements
- Monthly income statements, balance sheets, and cash flow
- Revenue by customer, product, geography, and channel
- Churn, retention, cohort, and renewal data
- AR aging, AP aging, bad debt, write-off history
- Debt schedules, lease schedules, off-balance sheet commitments
- Budget vs. actuals and current-year forecast
- Normalized working capital schedule and seasonality
- Quality of earnings report
- Customer concentration and margin by segment
- Financial records supporting add-backs and adjustments
Quality of earnings tests recurring profit, owner expenses, unusual revenue, accounting policies, and cash conversion. Former finance staff, former customers, and suppliers can help verify whether revenue is recurring or one-time.
Legal and regulatory checklist
Legal DD tests whether you're actually buying what you think you're buying. Reviews contracts, litigation history, pending or threatened litigation, contractual obligations, and legal compliance.
Core items:
- Organizational documents and bylaws
- Corporate governance documents and board minutes
- Cap table, shareholder agreements, option plans, warrants
- Material contracts, customer agreements, vendor agreements
- Licensing agreements, permits, approvals
- Change-of-control clauses and anti-assignment terms
- Non-compete, non-solicit, exclusivity, termination rights
- Pending or threatened litigation summaries
- Settlement agreements and arbitration files
- Sector rules, applicable laws, relevant regulations
Specialist counsel needed for antitrust, export controls, financial services, healthcare approvals, employment, IP, and regulated cross-border deals.
Tax checklist
Tax DD assesses compliance with tax laws and liabilities. Tests deal structure — asset vs. stock purchase, elections, foreign subsidiaries, transfer pricing, tax basis outcomes.
- Corporate income tax returns for the last 3 to 5 years
- VAT, GST, sales tax, indirect tax filings
- Payroll, withholding, employment tax records
- Open audits and correspondence with tax authorities
- Advance rulings, tax opinions, uncertain tax positions
- Tax loss carryforward schedules and limitation analysis
- Structure memos for stock purchase agreements or asset deals
Red flags: recurring late filings, aggressive transfer pricing, loss utilization schemes, large reserves not in the model.
Operational and commercial checklist
Operational DD evaluates efficiency and processes. Commercial DD tests whether the market thesis is real.
Operational items:
- Org charts and process maps for core workflows
- Supplier SLAs, logistics contracts, fulfillment data
- Manufacturing, service delivery, customer support KPIs
- Site visit notes and facility-level capex plans
- ERP, CRM, billing, workflow system dependencies
Commercial items:
- Market size estimates and share by segment
- Win/loss reports and pricing history
- Marketing strategies and channel performance
- Pipeline quality, conversion rates, renewal calendars
- Competitive intelligence and industry trends
- Business plans and forecast assumptions
FieldSignal interviews former customers, competitors, suppliers, and channel partners to confirm what's real — share-of-wallet, churn, pricing, competitor pressure before the IC memo is locked.
Technology & IP checklist
Tech DD assesses IT infrastructure and cybersecurity risks. IP DD tests value — whether the company owns the intellectual property, source code, trademarks, patents, domains, and licensing.
- Software, infrastructure, network inventory
- Source code ownership and contractor assignment records
- Open-source software policies and usage logs
- SOC 2, ISO 27001, penetration tests, audit reports
- Breach logs, incident response plans, cyber insurance
- Patents, trademarks, domains, registrations, applications
- License-in, license-out, co-ownership, encumbrance files
- Customer DPAs, privacy policies, retention policies
For software-heavy deals, add code quality and architecture reviews from an external specialist.
Human capital & culture checklist
HR DD covers human resources, compensation, benefits, classification, claims, and whether key employees will stay.
- Full employee roster by role, comp, bonus, location, tenure
- Key person dependencies and retention risk
- Employment and contractor agreements
- Equity and incentive plans, vesting, acceleration, change-of-control
- Health insurance, benefit plans, pension obligations
- Collective bargaining agreements and works council matters
- Harassment, discrimination, wage, hour, classification claims
- Voluntary attrition and engagement survey results
Cultural differences can hinder integration. Former employee interviews help you understand management style, morale, attrition drivers, and whether retention bonuses or rollover equity make sense.
Real estate & environmental checklist
Run as a separate track when the target owns or leases plants, warehouses, data centers, labs, offices, or retail sites.
- Owned property deeds, title policies, surveys
- Lease agreements, rent rolls, options, expiration dates
- Zoning confirmations and use restrictions
- Sale-leaseback documents and landlord consents
- Property condition assessments and deferred maintenance
- Environmental assessments, Phase I ESA reports, Phase II reports
- Historic contamination, remediation, violation records
- Local environmental permits and compliance files
Asset-heavy targets often need third-party inspections. Findings can change capex assumptions, asset values, debt terms, and indemnities.
Building and managing your diligence team
On a typical $50M to $250M deal, the team includes an internal deal owner, M&A counsel, tax advisor, financial diligence provider, and workstream leads for tech, HR, commercial, and real estate.
Use one master checklist, one virtual data room, and one Q&A channel. Virtual data rooms enhance document sharing. Diligence software can automate document review and data extraction.
A simple weekly cadence:
- Monday: workstream standup and risk refresh
- Wednesday: data room and Q&A cleanup
- Friday: red/yellow/green summary to investment committee
Communication gaps lead to misunderstandings. Assign one lead to own status, blockers, and decisions.
50+ item checklist by workstream
Designed to copy into a spreadsheet or data room index. Customize by deal size, sector, jurisdiction, and regulatory profile.
Financial workstream
- 3 to 5 years of audited financial statements
- Last 24 months of monthly management accounts
- Current-year forecast and assumptions
- Budget vs. actuals for last 3 years
- Revenue by customer, product, SKU, and service line
- Gross margin by segment and customer cohort
- Churn, retention, renewal, expansion metrics
- AR and AP aging reports
- Cash flow statements and cash conversion analysis
- Debt, lease, and covenant compliance certificates
- Normalized working capital and seasonality schedules
- Quality of earnings analysis
- Off-balance sheet commitments and contingent liabilities
Legal & corporate workstream
- Articles of incorporation, bylaws, amendments
- Organizational documents
- Current cap table with fully diluted ownership
- Shareholder agreements, option documents, warrants
- Board and shareholder minutes for the last 3 to 5 years
- Material contracts and key termination rights
- Licenses and permits by jurisdiction
- Litigation, settlement, arbitration, threatened litigation
- Compliance policies and legal compliance evidence
- Disclosure schedules
Commercial & market workstream
- Market size and share studies
- Top 20 customer list with revenue, margin, tenure
- Customer concentration analysis
- NPS, CSAT, support tickets, complaint data
- Win/loss reports and competitor mapping
- Pricing history by SKU or service line
- Renewal calendar and expansion pipeline
- Pipeline reports by stage and probability
- Share-of-wallet estimates from customer interviews
- Channel partner feedback and site visit notes
Tax workstream
- Corporate tax returns in principal jurisdictions
- Indirect tax filings (VAT, GST, sales tax)
- Payroll tax and withholding records
- Tax audits, assessments, authority correspondence
- Tax loss carryforwards and limitation analysis
- Deal structure memo and basis or goodwill treatment
HR & people workstream
- Employee roster with role, comp, bonus, location
- Key executive tenure and retention risks
- Template employment and contractor agreements
- Benefit plan documents and health insurance summaries
- Collective bargaining agreements and works council files
- Employment claims, inspections, penalties, complaints
- Voluntary attrition for 3 years and engagement survey results
Technology, data & IP workstream
- Full IT infrastructure and software inventory
- Network diagrams, vendor list, major SLAs
- ERP, CRM, billing, data warehouse architecture
- Patent, trademark, domain, copyright records
- License-in and license-out agreements
- Open-source software usage policy
- SOC 2, ISO, penetration tests, incident logs
- Data privacy policies, DPA templates, retention schedules
Operations, supply chain & real estate
- Supplier list with spend, terms, concentration
- Logistics contracts and manufacturer agreements
- On-time delivery, defect rate, service-level KPIs
- Capex history and forward capex plan by facility
- Owned property deeds and lease agreements
- Sale-leaseback documentation
- Phase I environmental site assessments and Phase II reports
- Environmental violations, remediation, permits
Compliance, ESG & risk workstream
- Anti-bribery and anti-corruption policies
- Sanctions, AML/KYC, code of conduct policies
- Whistleblower procedures and investigation history
- Sustainability reports and health and safety records
- Public ESG commitments or targets
- Sector filings, consents, licenses, monitoring agreements
- Vendor and intermediary diligence files for higher-risk geographies
ESG now affects deal decisions. Deloitte's 2024 ESG M&A survey found that 72% of large firms had walked away from deals due to ESG red flags.
Using external experts without blowing the budget
Most buyers need outside expertise, but don't want a six-figure annual retainer with GLG, AlphaSights, Third Bridge, Guidepoint, Tegus, AlphaSense, Capvision, ProSapient, Coleman Research, Atheneum, Mosaic Research Management, or Inex One just to diligence one deal.
Expert calls fit across the process:
- Former customers validate churn, pricing, product gaps
- Ex-employees explain culture, tech debt, process quality
- Suppliers test bargaining power and concentration risk
- Competitors confirm industry trends and market pressure
- Specialists assess data security, IP, regulatory issues
FieldSignal uses pay-per-use pricing, no annual retainer, no minimum commitment, and pass-through call costs with no markup on expert honoraria. Compliance controls include NDAs, vetted experts, restricted topics, and call protocols that keep research inside confidentiality and regulatory boundaries.
Example: a PE associate testing a SaaS deal can speak with five former customers in one week, validate a churn assumption, and update the financial model before final bids.
Turning findings into a clear due diligence report
A DD report should include a 1-2 page executive summary, risk matrix by workstream, and appendices with supporting detail. Quantify impact through price adjustments, escrow recommendations, covenants, closing conditions, or walk-away triggers.
Structure:
- Deal thesis recap
- Methodology and diligence period covered
- Findings by diligence area
- Red/yellow/green risk matrix
- Financial impact and fair market assumptions
- Recommended changes to the purchase agreement
- Conditions to close and open diligence matters
Separate facts from judgment calls. Expert interview findings should appear as anonymized themes, not unsupported anecdotes.
Common pitfalls
M&A failure rates indicate 70% to 90% of transactions do not meet projected value, a range cited by Harvard Business Review. Poor diligence isn't the only cause, but weak diligence increases the odds of overpaying, missing liabilities, or inheriting problems.
Common pitfalls:
- Over-reliance on seller-provided data
- Insufficient commercial due diligence
- Ignoring integration risks until after signing
- Pushing hard contract questions to the last week
- Treating cybersecurity as an IT footnote
- Missing contractor misclassification and benefit liabilities
- Under-scoping regulatory compliance
Late red flags look specific: undisclosed churn from top accounts, manual billing processes that won't scale, hidden change-of-control clauses, IP assigned to founders personally, unresolved antitrust inquiries.
Front-load critical items in the first 30 days — revenue quality, customer concentration, material contracts, liquidity, legal standing, key management retention. Don't overbuild diligence for a $5M tuck-in; don't under-scope a $200M platform.
Next step
FieldSignal helps M&A teams run focused expert interviews and surveys that backstop financial DD, commercial DD, operational DD, technology DD, and culture checks.
You get:
- Transparent pricing
- No annual retainer
- Pay-per-use access
- Pass-through expert call costs
- Compliance standards built for regulated diligence work