The due diligence process explained

Due diligence is the investigation a buyer carries out on a private company between the letter of intent and the signing of the purchase agreement, and it has three jobs: confirm that the business is what the seller described, find whatever should change the price or the terms, and plan the handover. The buyer's advisers ask for documents, read them in a data room, question management, visit the sites and write reports. Each finding then has to land somewhere in the deal: in the price, in the contract, in the closing conditions or in the decision not to proceed.

The practice described here is the common pattern for the purchase of a private company in the lower and middle market. Contract law, tax, employment rules and merger control differ by country, and the article says so where a rule belongs to one jurisdiction. It is general information, not legal, tax or investment advice.

The figures used throughout come from one illustrative company, not from a real transaction. It is a services business with $18,000,000 of revenue, whose seller presents $4,200,000 of adjusted EBITDA (earnings before interest, tax, depreciation and amortisation), and a buyer who has offered 6.0 times that figure on a cash-free, debt-free basis.

What is due diligence for?

Due diligence serves three purposes for the buyer of a private company: confirming what is being bought, finding what should change the price or the terms, and preparing the handover. A diligence exercise that only produces a long report has missed two of the three.

Confirmation comes first. An offer is built on what the seller has said in a short information memorandum and a few conversations: the revenue, the margin, the customers, the team, the ownership of the assets. Diligence tests each of those statements against documents.

The second purpose is price and terms. A private company has no market price and no regulator checking its disclosures, so the buyer's only protection is what the buyer finds and what the contract says about what was not found. Findings are sorted into three kinds: those that change the value of the business (lower sustainable earnings), those that are a one-off cost (an unpaid tax, a repair, a claim) and those that are a risk with an uncertain outcome (a dispute, a contract that may not be renewed).

The third purpose is often neglected. The teams that read the contracts and met the managers have learned how the company actually runs, and their notes become the integration plan: which customers to call on the day of the announcement, which licences to transfer, which person holds knowledge nobody else has.

Which workstreams does due diligence cover?

Due diligence on a private company is split into workstreams, each led by a specialist adviser or an internal team, and most transactions cover eight of them: financial, tax, legal, commercial, people, technology and intellectual property, operations, and regulatory and environmental. The depth of each is set by the business: a software company needs days on code ownership and almost none on environmental matters, and a manufacturer needs the reverse.

The workstreams feed each other. The legal team finds a change-of-control clause; the commercial team says that customer is the largest; the financial team says how much profit rests on it. One finding seen by three teams is a negotiation point.

The buyer's lead adviser normally holds a single issues list for that reason: each line names the finding, its estimated size and its proposed treatment in the deal.

How does the due diligence process run, step by step?

The due diligence process runs in six stages: a request list, a data room, written questions and answers, management meetings, site visits and reports. The stages overlap in practice, and the questions continue until the day the agreement is signed.

Two documents frame the whole exercise before the first request is sent. The confidentiality agreement, signed before any information is shared, restricts what the buyer may do with it and who may see it. The letter of intent sets the headline price, the basis on which it was calculated and, in most cases, a period of exclusivity during which the seller agrees not to negotiate with anyone else. That period is the buyer's real diligence budget.

Diligence is also staged by sensitivity. Sellers release ordinary material first and keep the most sensitive items, such as customer names, detailed pricing, employee pay and source code, until the deal is likely to sign.

How long does due diligence take?

Due diligence on a private company takes as long as the exclusivity period allows and the state of the seller's records permits, which in practice means some weeks for a small, well-prepared business and several months for a larger or less organised one. No rule fixes the length, and a published average would hide more than it shows, because the range between transactions is wide.

Four things decide the calendar. The first is preparation: a seller with a populated data room and reconciled monthly accounts can answer a request list in days, and one who assembles documents on demand takes weeks. The second is the number of workstreams and jurisdictions. The third is dependencies outside the two parties, such as a lender's own diligence, an insurer underwriting warranty cover, a landlord's or customer's consent, or a merger control filing. The fourth is findings: a serious issue reopens the price, and a price discussion stops the clock on everything else.

The practical lesson is to order the work by what could end or reprice the deal: financial and tax diligence, ownership of the shares and of the key intellectual property, and the largest contracts come first.

What does a quality-of-earnings review change in the price?

A quality-of-earnings review restates the seller's EBITDA to the figure the business can be expected to repeat, and when the price is a multiple of EBITDA every dollar of adjustment moves the price by that multiple. It is the part of financial diligence with the most direct effect on what the buyer pays.

The review differs from an audit. An audit gives an opinion on whether the accounts follow the accounting rules. A quality-of-earnings review asks a commercial question: which of these earnings are recurring, earned in the period, and produced by the business on normal terms?

In the illustrative company, the seller presents $4,200,000 of adjusted EBITDA on $18,000,000 of revenue, and the buyer's offer is 6.0 times EBITDA, a headline value of $25,200,000. The buyer's accountants propose five adjustments.

Adjusted EBITDA falls from $4,200,000 to $3,640,000, and the value at the same multiple falls from $25,200,000 to $21,840,000. Both moved by 13.3%, because the multiple was left untouched.

Three points about this table matter. Adjustments run in both directions: an honest review adds back the legal settlement even though the buyer commissioned it. Each line is an argument, not a fact: the seller will say the owner's role can be covered for less than $250,000, and the price finally agreed usually sits between the two positions. And the multiple magnifies small items: a disagreement over $140,000 of marketing cost is a disagreement over $840,000 of price.

The same review covers two other figures that move cash at closing. Net debt is deducted from the headline value, so the definition of what counts as debt, from overdue tax to customer deposits, is negotiated line by line. Working capital is compared with a target, usually an average over the past twelve months or more: if the example company's normal level is $1,900,000 and the seller proposes a target of $1,600,000, accepting the lower figure hands the seller $300,000, dollar for dollar. How the headline value becomes the amount wired is a subject of its own; diligence supplies the numbers on which that calculation rests.

What does each due diligence finding lead to?

Each due diligence finding leads to one of five outcomes: a price reduction, a specific indemnity, a holdback, a condition to closing, or a decision to walk away. Not every problem is solved by paying less.

A price reduction suits a finding that changes value, as the quality-of-earnings adjustments do. A specific indemnity suits a finding that is known but not yet a cost. Suppose the tax review of the example company finds that sales tax was under-collected in past years, with an estimated exposure of $400,000 that the tax authority may or may not assess. Deducting $400,000 from the price would overpay the buyer if no assessment comes; ignoring it would leave the buyer with the bill. The indemnity is the middle course: the seller promises to reimburse that particular cost in full, outside the caps and thresholds that limit general warranty claims.

A promise is only as good as the seller's ability to pay in two years, which is where the holdback comes in. Using illustrative terms, the buyer keeps back 5% of the $21,840,000 price as general security for warranty claims, $1,092,000, plus the $400,000 tax exposure, for a total of $1,492,000. The seller receives $20,348,000 at closing, before the working capital and net debt adjustments, and the balance when the agreed periods expire without a claim. Whether the money sits with the buyer or with an independent escrow agent, how long it stays, and what warranty insurance can do in its place are questions with their own mechanics. For this article the point is narrower: the size of the holdback should follow from the issues list, not from a habit.

A condition to closing suits a problem that someone other than the buyer must fix. The commercial review finds that the largest customer accounts for 31% of revenue, $5,580,000, and the legal review finds that its contract allows termination on a change of control. The buyer makes that customer's written consent a condition: the agreement is signed, but the buyer is not bound to complete until the consent is delivered.

Walking away is rare and should be decided against a list written before diligence starts. Typical reasons are a seller who cannot prove ownership of the shares or of the core asset, accounts that cannot be reconciled to bank statements, or a pattern of answers that later prove untrue.

What does the seller do: vendor due diligence, the data room and disclosure?

The seller prepares for due diligence in three ways: commissioning its own review before the sale, building the data room, and disclosing known problems against the warranties in the purchase agreement. A seller who does all three controls the timetable and loses less of the price to surprises.

Vendor due diligence is a report commissioned by the seller from independent advisers before the business is offered, most often on financial and tax matters. It gives every bidder the same starting analysis, shortens each buyer's own work and lets the seller correct or explain problems before anyone prices them. The buyer still checks the areas that matter most, and the terms on which the buyer may rely on the seller's report are agreed with the firm that wrote it.

The data room is the seller's work product. A useful one has an index that mirrors a standard request list, complete and signed versions of documents, monthly management accounts reconciled to the annual accounts, and a named person who answers questions within an agreed time.

Disclosure is where diligence meets the contract. In the purchase agreement the seller gives warranties: statements that the accounts are accurate, that there are no undisclosed disputes, that taxes are paid. In many legal systems, including English-law practice, the seller then delivers a disclosure letter listing the exceptions, and a matter fairly disclosed cannot later support a warranty claim. In United States practice the same job is done by disclosure schedules attached to the agreement. The seller wants everything disclosed, specifically and in writing; the buyer reads each disclosure as a finding and decides, before signing, which of the five outcomes it gets. Whether a buyer can claim for something it already knew about depends on the governing law and on the wording of the agreement, a point to settle with counsel before signing.

What limits do confidentiality and competition law place on sharing information before closing?

Two sets of limits apply to information shared during due diligence: the confidentiality agreement between the parties, and competition law, which treats buyer and seller as separate businesses until the transaction closes. The second applies with most force when the two companies compete, and signing a purchase agreement does not suspend it.

The confidentiality agreement is contractual: it restricts use of the information to evaluating the transaction, limits access to named people and advisers, and requires return or destruction if the deal fails.

Competition law is not negotiable between the parties. In the United States, the Federal Trade Commission set out its position in guidance published in 2018 by its Bureau of Competition on pre-merger negotiations and due diligence. Read on the agency's own page, the guidance states that merging parties remain independent businesses right up until the transaction is completed, and that sharing competitively sensitive information, of which it gives current and future prices, strategic plans and costs as examples, can harm competition in the meantime. It notes that such exchanges can be challenged under the antitrust laws on their own, and that they can contribute to what is called gun jumping when a buyer starts to exercise control before the waiting period under the merger notification rules has run. Among the past cases the agency cites is one in which chief executives had exchanged information on price floors, discounting and expansion plans.

The safeguards the Federal Trade Commission lists in that guidance are practical. For the seller: share the least information needed for effective diligence, mask customer identities and aggregate competitive data, check redactions, and stop data room users from downloading or forwarding documents. For the buyer: use a clean team or outside consultants for sensitive material, keep anyone responsible for pricing, competitive planning or strategy off that team, have counsel vet its members, keep diligence material off shared drives, and give business staff only aggregated reports reviewed by counsel.

Other jurisdictions apply the same principle through their own rules, and European Union and national authorities also penalise the early exercise of control before clearance. The detail differs, so a transaction between competitors needs a protocol written by competition counsel in each relevant country before the data room opens.

What are the red flags in due diligence?

The red flags in due diligence are the findings that suggest the reported business and the real one differ, and the most reliable signs lie in how the information arrives as much as in what it says. A single item rarely ends a deal; a pattern does.

• Management accounts that do not reconcile to the annual accounts, the tax filings or the bank statements, with explanations that change from one answer to the next.
• Revenue that rises sharply in the last months before the sale, discounts or extended payment terms granted at period end, and receivables that are growing faster than sales.
• Customer or supplier concentration combined with short contracts, termination on change of control, or a relationship held personally by the owner.
• Intellectual property registered in the name of a founder, a related company or a contractor, with no written assignment to the company being sold.
• Workers treated as contractors who work like employees, unpaid payroll or sales taxes, and tax years that remain open with no reserve.
• Key managers who are not made available, sites that cannot be visited, or sensitive documents that are promised repeatedly and never arrive.
• Related-party arrangements: premises rented from the owner, family members on the payroll, sales to or purchases from companies under common ownership at prices that are not market prices.

Each of these has an innocent version: small companies often have informal records, and an owner renting a building to the business at a fair rent is ordinary. The test is whether the seller can document the innocent version quickly and consistently. If so, the item becomes a line on the issues list; if not, the buyer widens the scope in that area before going further.

What belongs on a first due diligence request list?

A first due diligence request list asks for the documents that could end or reprice the deal, in a form the seller can answer within the first week. The seventeen items below serve most private companies; everything else follows once these have been read.

• The corporate records: constitutional documents, the share register or capitalisation table, shareholder agreements, and board and shareholder minutes for the past three years.
• A group structure chart showing every entity, its owner and its country.
• Annual accounts for the past three years and monthly management accounts for the past twenty-four months, with the trial balance behind the latest period.
• The seller's schedule of adjusted EBITDA, with support for each add-back.
• Bank statements for all accounts for the past twelve months, and a schedule of all loans, leases, guarantees and security granted.
• Aged receivables and payables at the latest month end, and monthly working capital balances for the past twenty-four months.
• Revenue and gross margin by customer and by product or service for the past three years, with customer names masked where competition rules require.
• The contracts with the ten largest customers and the ten largest suppliers.
• Tax returns and correspondence with tax authorities for all open years, covering corporate, payroll and sales taxes.
• A list of employees and contractors with role, start date, pay and notice period, anonymised at this stage, and the standard contract forms.
• A schedule of intellectual property owned or licensed, with the assignments from founders, employees and contractors.
• A list of information systems and the main software licences, with security audits and incidents recorded.
• Leases and title documents for every site, and a register of major equipment.
• A list of current, threatened and recently settled disputes and claims.
• Licences, permits and regulatory approvals needed to operate, and any correspondence with regulators.
• Insurance policies with the claims history, and environmental reports and permits for any owned or industrial site.
• The current budget, the forecast and the sales pipeline, with the assumptions behind them.

The list is a starting point to adapt, not a standard. Ask each adviser to mark the five items they need first, send one consolidated list from a single contact, and agree with the seller a date for each batch.