Due Diligence Before Acquiring a Company: A Comprehensive Checklist

Due diligence is the independent review of a target company’s financial, tax, legal, operational and commercial position before an acquisition is signed. It serves three purposes: to verify the information the seller has provided, to surface risks that should be reflected in the price, and to carry the findings into the share purchase agreement (SPA) as protective terms. Well-designed due diligence is not meant to stop a transaction; it is meant to complete it at the right price and on the right terms.

Why is due diligence performed, and how is its scope set?

A buyer always knows less about the target than the seller does. Due diligence narrows that information gap. Scope depends on deal size, sector, the maturity of the target and the buyer’s investment thesis. For a technology company, intellectual property and software security come to the fore; for a manufacturer, environmental liabilities and inventory valuation may matter more.

The process usually begins after a term sheet or letter of intent. The parties sign a confidentiality agreement, the seller opens a virtual data room, and the buyer’s advisers work from an information request list. Agreeing the scope in writing keeps both time and cost under control, and the concept of materiality should be settled at this stage, so that the team knows what level of finding is worth escalating.

What does financial due diligence cover?

Financial review tests how far reported profit reflects sustainable profit. The key concept is normalised EBITDA, stripped of one-off and non-recurring items, because most valuations are built on it.

• Quality of revenue: split by customer, product and contract, revenue recognition policies, and cut-off at period end.
• Normalised profitability: related-party transactions, non-recurring income and expense, and owner remuneration adjusted to market levels.
• Net working capital: seasonality, ageing of receivables and inventory, and the normal level of working capital to be delivered at closing.
• Net debt and debt-like items: bank borrowings, leases, shareholder loans, unpaid bonuses, deferred payments and off-balance-sheet commitments.
• Cash flow and capital expenditure: the split between maintenance and growth investment.
• Consistency of budgets and projections with historical outcomes.

What do tax, legal, HR and IT reviews look at?

Tax review covers filing and payment compliance for open periods, transfer pricing documentation, related-party dealings, the continuing eligibility for incentives and exemptions, and any pending audits or disputes. In a share deal the target keeps its history of tax liabilities, so this workstream is particularly relevant to price and indemnity design.

Legal review examines the corporate and ownership structure, restrictions on share transfers and any pre-emption rights, change-of-control and assignment clauses in key customer and supplier contracts, licences and permits, security and pledges, pending litigation, intellectual property and competition law compliance. Compliance with personal data protection rules is now a standard review item.

HR review looks at employment contracts, provisions for severance and other employee entitlements, benefits, collective agreements and union relations, pending labour disputes, subcontracting practices and the retention risk around key executives. Dependence on a few individuals is a risk that should be seen before it appears in the numbers.

IT review assesses system architecture, licence compliance, cybersecurity maturity, backup and continuity arrangements, dependence on a single person or vendor for critical systems, and the likely cost of integration. The post-closing integration plan often rests on these findings.

Why is commercial due diligence a separate workstream?

Financial statements describe the past; commercial due diligence asks how durable the future is. It looks at market structure, competitive position, customer concentration and churn, pricing power and supply chain dependencies. Heavy reliance on one customer or one supplier is a risk that never appears as a line in the accounts but directly affects value.

How is the due diligence process managed?

The process typically runs in four stages: agreeing scope and materiality; requesting information and reviewing the data room; management meetings and site work; and finally reporting and handing findings over to the negotiation. Management sessions provide context that documents cannot, but oral explanations must always be corroborated by evidence.

In a well-run process the buyer’s team shares findings with the deal steering group on a rolling basis, so price and contract negotiation does not wait for the final report. An early finding can trigger deeper work or change negotiation strategy. On the sell side, vendor due diligence can speed up the process and reduce surprises by assembling information in advance. For both parties, confidentiality, data room access logs and personal data rules need careful handling throughout.

Which findings count as red flags?

• A persistent, unexplained gap between reported profit and operating cash flow.
• Sales concentrated at period ends, or rising returns and cancellations in the following period.
• Recent changes to accounting policies with weak justification.
• Related-party transactions that depart from market terms.
• Large receivable, payable or inventory balances that have not been reconciled.
• Termination rights on change of control in important contracts.
• Late, incomplete or inconsistent information in the data room.
• Uncertainty about whether key executives will stay after closing.

A red flag is not in itself a reason to walk away. What matters is whether the issue can be quantified, whether it will recur, and whether the contract can manage it.

How do the findings feed into price and the SPA?

Findings are handled in one of four ways. Quantifiable effects are deducted directly from the price, for example by adjusting normalised EBITDA or adding debt-like items to net debt. Uncertain but plausible liabilities are addressed through seller warranties and specific indemnities. Steps that must be completed before closing, such as obtaining a consent, renegotiating a contract or completing reconciliations, become conditions precedent. Finally, risk can be shared through escrow, deferred consideration or earn-out structures.

This is why the due diligence team and the contract negotiators need to work in step throughout. A finding that sits on the last page of a report but never reaches the SPA remains an unprotected risk for the buyer.

If you are planning a transaction and would like to discuss the right due diligence scope and how findings should translate into price and contract terms, Hector Kurumsal would be glad to talk. This article is for general information and does not constitute legal or tax advice.