Every significant investment or acquisition is preceded by a systematic investigation process designed to answer one central question: is this business what the seller says it is? Due diligence is how investors transform the seller’s narrative into verified fact — or discover the material divergences that that narrative glossed over.

This guide provides a complete buy-side due diligence framework organized by workstream, with the specific questions, red flags, and document requests that uncover the issues that matter most.

The Due Diligence Architecture

A comprehensive due diligence process has five parallel workstreams, each led by a different specialist:

Workstream Lead Advisor Primary Objective
Financial Accounting firm (QofE) Verify reported financials, normalize EBITDA
Legal M&A counsel Identify legal risks, review contracts
Commercial Strategy consultant Assess market position, growth prospects
Tax Tax counsel Identify tax exposures, structure acquisition
HR/People HR advisor Assess team, compensation, retention risk
Operational/IT Operations advisor Assess infrastructure, cybersecurity

Workstream 1: Financial Due Diligence (Quality of Earnings)

The QofE analysis is the financial heartbeat of the process. Its output — a normalized, maintainable EBITDA figure — directly anchors the valuation multiple and purchase price.

The Normalization Process

EBITDA Adjustment Type Example Add-Back or Remove?
Owner’s discretionary compensation excess CEO paid $500K vs market $350K Add-back $150K
One-time legal settlement $200K lawsuit settlement expense Add-back
One-time revenue from expired contract $500K non-recurring government contract Remove
Non-arm’s-length related party transaction Below-market rent from owner entity Adjust to market
Capitalized opex (GAAP violation) R&D costs capitalized as software Remove, expense
COVID-related benefit (PPP forgiveness) $300K loan forgiveness income Remove

The difference between seller-reported EBITDA and QofE-normalized EBITDA drives the negotiation. In contested processes, the parties’ advisors often argue over $500K–$2M in adjustments that translate directly to $3M–$12M in purchase price at a 6x EBITDA multiple.

Key Financial Documents Requested

  • Audited or reviewed financial statements (3 years)
  • Tax returns (3–5 years)
  • Monthly management accounts (last 24 months)
  • Accounts receivable aging report
  • AR and AP detail by customer/vendor
  • Bank statements (12 months)
  • Capitalization table and debt schedule
  • Budget vs actual comparison

Legal diligence uncovers contingent liabilities and contractual restrictions that don’t appear on the balance sheet.

Priority Document Review List

Corporate:

  • Certificate of incorporation, bylaws, operating agreement
  • Board and shareholder meeting minutes (5 years)
  • Capitalization table and all outstanding options, warrants, convertible notes

Contracts:

  • Top 20 customer contracts (change-of-control provisions are critical in M&A)
  • Top 10 supplier/vendor contracts
  • All real estate leases
  • All financing agreements and compliance certificates

Employment:

  • Executive employment agreements
  • Non-compete and non-solicitation agreements for key personnel
  • Separation agreements for recent departures (may reveal disputes)

IP:

  • Patent portfolio (filed and issued)
  • Trademark registrations (US and international)
  • Software license agreements (open source usage — GPL contamination risk)
  • IP assignment agreements for all founders and contractors

Litigation:

  • All pending and threatened claims
  • Products liability claims (manufacturing businesses)
  • Environmental contamination (any owned/operated real property)

The Change-of-Control Review

Every material customer contract must be reviewed for change of control provisions — clauses that allow the customer to terminate or renegotiate if the company’s ownership changes. In software and services businesses, a 30%+ customer that has a change-of-control termination right represents a significant acquisition risk.

Workstream 3: Commercial Due Diligence

Commercial diligence answers: Why does this business win, and will it keep winning?

Customer Interview Protocol

Request reference conversations with the top 5–10 customers, representing 40%+ of revenue. Key questions:

  • Why do you use [Company] vs. competitors?
  • How likely are you to renew/expand at contract end?
  • What would cause you to switch?
  • What does [Company] do especially well, and where do they fall short?
  • Have you recently evaluated alternatives?

Revenue Quality Assessment

| Revenue Characteristic | Why It Matters | |—|—| | % of revenue under contract (recurring) | Higher = more defensible | | Average contract term | Longer = more predictable | | Net Revenue Retention >100% | Expansion offsets churn | | Customer concentration (>20% in one customer) | Exit risk, renegotiation risk | | Geographic concentration | Regulatory or macro risk | | New product % of revenue | Mixed signal — growth potential or customer confusion |

Key Red Flags Across Workstreams

Always investigate further if you see:

🚩 Audited financials that differ materially from management accounts
🚩 Revenue accelerating in Q4 before a sale process (channel stuffing)
🚩 Multiple CFO or controller changes in recent years
🚩 Significant customer contracts with near-term expiration and uncertain renewal
🚩 Founder or key executive unwilling to sign meaningful non-competes
🚩 Open IP ownership gaps (contractors who wrote core code without assignment agreements)
🚩 Environmental issues at owned or formerly-owned properties
🚩 Prior M&A earnout disputes or representations and warranties claims

Conclusion

Due diligence is not a box-checking exercise — it is the investor’s primary mechanism of price discovery and risk identification. The deals that go wrong are almost always deals where time pressure, seller pressure, or overconfidence led the investor to shortcut a critical workstream. No financial model, regardless of sophistication, can price a risk you haven’t discovered. Invest fully in the process; the cost of a thorough QofE analysis is trivially small compared to the cost of buying a business that misrepresented its revenue quality.

Frequently Asked Questions (FAQ)

What is due diligence in investing?
Comprehensive investigation before a transaction to verify seller representations, uncover undisclosed liabilities, and identify material risks across financial, legal, commercial, operational, and HR dimensions.

What is a Quality of Earnings (QofE) analysis?
Central financial diligence workstream analyzing 3 years of financials to normalize EBITDA — adding back one-time items and removing non-recurring revenue to arrive at maintainable, deal-basis EBITDA.

What are the most common financial red flags?
Customer concentration >20%, rising AR/revenue ratio, large unexplained EBITDA add-backs, tax returns inconsistent with financial statements, and unusual related-party transactions.

What legal documents are reviewed?
Corporate docs, material contracts, IP registrations, litigation history, employment agreements, and real estate leases. Change-of-control provisions in customer contracts are a priority.

What is commercial due diligence?
Assessment of market position, competitive advantages, customer concentration and churn, pricing power, and pipeline quality. Often includes direct customer interviews.

How long does due diligence take?
Small deals: 2–4 weeks. Mid-market: 4–8 weeks. Large transactions: 8–16 weeks. VC diligence for early-stage: 2–6 weeks.

What is HR due diligence?
Review of org structure, compensation benchmarking, equity plans, employment agreements, benefit compliance, and culture assessment. Key risk: losing critical people post-close.

What is a virtual data room?
Secure online repository (Intralinks, Datasite, Ansarada) where sellers organize documents for buyer review. Includes access controls, Q&A management, and audit trails.

What is buy-side vs. sell-side due diligence?
Buy-side: acquirer investigates the target. Sell-side (VDD): seller proactively commissions a report before going to market to accelerate the process and control issue framing.

What happens after due diligence?
Proceed at negotiated price, request price reduction for identified issues, require specific indemnities, require R&W insurance, or terminate if material undisclosed problems are found.