M&A Resource

M&A Due Diligence Checklist

171 items organized by category to structure review of an acquisition target, assign the right reviewer, and track follow-up questions.

171
Total Items
104
Critical Items
8
Categories
View Full Checklist Jump to Category

What Is Due Diligence in M&A?

Due diligence is the comprehensive investigation a buyer conducts before completing an acquisition. It's the process of verifying everything the seller has represented about the business-and uncovering what they haven't disclosed.

Think of due diligence as a thorough home inspection before buying a house, except the "house" is an entire business with employees, contracts, legal obligations, and hidden risks. The checklist helps the buyer organize requests and document findings, but it does not replace advisor judgment or transaction-specific follow-up.

Verify Claims

Confirm that the seller's representations about revenue, customers, and operations are accurate.

Identify Risks

Uncover hidden liabilities, pending litigation, customer concentration, and other deal-breakers.

Protect Investment

Inform deal structure, negotiate protections, and know what you're buying before closing.

Assign each workstream

Give each category a named owner, a reviewer, and a deadline for escalating findings. The buyer's deal lead should coordinate the workstreams without asking one advisor to review matters outside that advisor's discipline.

1
M&A counsel
Legal review: ownership, authority, contracts, litigation, and compliance
2
Accounting advisors
Financial and tax review: earnings, working capital, debt, and tax exposure
3
Buyer's team
Operational review: customers, suppliers, facilities, processes, and integration needs
4
Appropriate technical advisor
Specialist review: IT, cybersecurity, environmental, benefits, or industry-specific issues

Jump to Category

Financial Due Diligence (25) Legal Due Diligence (26) Operational Due Diligence (20) Human Resources Due Diligence (25) Technology & IT Due Diligence (25) Commercial Due Diligence (20) Environmental Due Diligence (15) Regulatory & Compliance Due Diligence (15)

Complete Due Diligence Checklist

171 items across 8 categories. Items marked with Critical identify common priorities to evaluate when scoping the review.

Financial Due Diligence

Review financial statements, accounting practices, and fiscal health

25
items
Audited financial statements (3 years)
Critical
Unaudited monthly financials (24 months)
Critical
Federal and state tax returns (3 years)
Critical
Quality of earnings analysis
Critical
Accounts receivable aging report
Critical
Accounts payable aging report
Revenue recognition policies
Critical
Deferred revenue schedule
Working capital analysis
Critical
Capital expenditure history and projections
Debt schedule with terms and covenants
Critical
Bank statements (12 months)
Inventory valuation and aging
Fixed asset register
Chart of accounts
Intercompany transactions and balances
Related party transactions
Critical
Contingent liabilities and off-balance-sheet items
Critical
Insurance policies and claims history
Budget vs. actual variance analysis
Financial projections and assumptions
Critical
Cash flow statements and projections
Critical
Break-even analysis
Gross margin analysis by product/service
EBITDA adjustments and add-backs
Critical

Operational Due Diligence

Review business operations, facilities, and processes

20
items
Organization chart
Critical
Business process documentation
Facilities list with square footage
Critical
Equipment and machinery list
Maintenance and repair records
Production capacity analysis
Quality control procedures
Critical
Product/service delivery processes
Supply chain overview
Critical
Vendor concentration analysis
Critical
Inventory management systems
Logistics and distribution network
Key operational metrics and KPIs
Critical
Capacity utilization rates
Backlog and order pipeline
Critical
Product roadmap and development pipeline
Manufacturing agreements
Warranties and returns history
Critical
Business continuity and disaster recovery plans
Critical
Standard operating procedures (SOPs)

Human Resources Due Diligence

Review employees, compensation, benefits, and workplace matters

25
items
Employee census with titles and tenure
Critical
Executive team biographies
Critical
Employment agreements (key employees)
Critical
Compensation structure and salary ranges
Critical
Bonus and incentive plans
Critical
Commission structures
Health and welfare benefit plans
Critical
Retirement and pension plans
Critical
Stock option and equity compensation plans
Critical
Employee handbook and policies
Offer letter templates
Severance policies and agreements
Critical
Non-compete agreements (employees)
Critical
Non-disclosure agreements (employees)
Independent contractor agreements
Critical
Contractor vs. employee classification review
Critical
Union agreements and labor relations
Critical
OSHA compliance and workplace safety records
Workers' compensation claims history
Employee turnover statistics
Critical
Pending employment claims or litigation
Critical
I-9 and work authorization compliance
Critical
Key person risk assessment
Critical
Succession planning
Training and development programs

Technology & IT Due Diligence

Review technology systems, intellectual property, and cybersecurity

25
items
IT infrastructure overview
Critical
Software and systems inventory
Critical
Software license agreements
Critical
Cloud service agreements (AWS, Azure, etc.)
Critical
SaaS subscriptions and contracts
Data architecture and database documentation
API integrations and dependencies
Source code ownership and access
Critical
Technology development roadmap
Patent portfolio
Critical
Patent applications pending
Trademark registrations
Critical
Copyright registrations
Trade secrets inventory
Critical
IP assignment agreements
Critical
Open source software usage
Critical
Cybersecurity policies and procedures
Critical
Data breach history
Critical
Penetration testing results
SOC 2 or security audit reports
Critical
Data privacy policies (GDPR, CCPA)
Critical
IT disaster recovery plan
Critical
System uptime and reliability metrics
Technical debt assessment
IT budget and spending history

Commercial Due Diligence

Review customers, market position, and competitive landscape

20
items
Customer list with revenue by customer
Critical
Customer concentration analysis
Critical
Customer retention and churn rates
Critical
Customer satisfaction scores (NPS, CSAT)
Sales pipeline and forecasting
Critical
Win/loss analysis
Pricing strategy and history
Critical
Discount policies and practices
Sales compensation and incentives
Marketing strategy and budget
Brand and trademark assets
Critical
Website analytics and traffic data
Market size and growth analysis
Critical
Competitive landscape analysis
Critical
Market share estimates
Industry trends and outlook
Regulatory environment impact
Critical
Geographic market coverage
Channel partner relationships
Customer reference calls (5-10)
Critical

Environmental Due Diligence

Review environmental compliance, permits, and potential liabilities

15
items
Environmental permits and licenses
Critical
Environmental compliance history
Critical
Phase I Environmental Site Assessment
Critical
Phase II Assessment (if triggered)
Critical
Hazardous materials handling procedures
Critical
Waste disposal practices and records
Air and water discharge permits
Underground storage tank records
Critical
Asbestos and lead paint surveys
Contamination remediation history
Critical
EPA or state agency correspondence
Critical
Environmental insurance policies
Sustainability and ESG programs
Carbon footprint and emissions data
Environmental litigation history
Critical

Regulatory & Compliance Due Diligence

Review regulatory compliance, licenses, and government relations

15
items
Business licenses and permits
Critical
Professional licenses (if applicable)
Critical
Industry-specific regulatory compliance
Critical
FDA, FCC, or other agency approvals
Critical
Import/export licenses and compliance
Government contracts and compliance
Critical
Anti-corruption and FCPA compliance
Critical
Anti-money laundering (AML) compliance
Data privacy and protection compliance
Critical
HIPAA compliance (if applicable)
Critical
PCI DSS compliance (if applicable)
Critical
SEC filings and compliance (if public)
Critical
Regulatory examination history
Critical
Consent orders or regulatory settlements
Critical
Lobbying and political contributions

How to Use This Due Diligence Checklist

1

Customize for Your Deal

Not every item applies to every transaction. Remove items that don't apply to your target's industry or size. Add industry-specific items as needed.

2

Prioritize Critical Items

Critical items require early review because they can affect authority, closing feasibility, valuation, structure, or risk allocation depending on the transaction.

3

Record Owners and Deadlines

For each item, record the workstream owner, reviewer, status, open questions, and deadline for a documented resolution.

4

Track in Data Room

Use your virtual data room's checklist feature to track which documents have been provided, reviewed, and flagged for follow-up.

Pro Tip: The Checklist Is Just the Start

A checklist ensures you don't miss obvious items, but thorough due diligence requires follow-up questions, verification of claims, and judgment about what the documents reveal. The checklist gets you documents-analysis turns them into insights.

Prioritize red flags before closing

A flagged item needs more than a note in the data room. Prioritize ownership and authority; liens, litigation, and compliance; contract assignment and consent requirements; and cross-functional exposure. Assign an owner, identify the reviewer, and record a resolution path that can be reflected in the transaction documents.

Ownership and authority

Reviewer: M&A counsel reviews formation records, capitalization, transfer restrictions, and required board or equityholder approvals.

Resolution path: The buyer's deal lead assigns corrective documents or approvals to the seller. Unclear ownership and authority can change price or structure and may become a closing condition.

Liens, litigation, and compliance

Reviewer: M&A counsel reviews lien searches, claims, investigations, licenses, and regulatory correspondence, with a specialist where the industry requires one.

Resolution path: The assigned owner obtains releases, resolves a compliance item, or defines a specific indemnification. The finding may also support a price change or a closing condition.

Contract assignment and change-of-control consent

Reviewer: M&A counsel reviews material customer, supplier, lease, debt, and license agreements for assignment restrictions and consent requirements.

Resolution path: The commercial owner confirms relationship risk while counsel prepares a consent plan. Missing consent can affect structure, become a closing condition, or require price or indemnification protection.

IP, employment, and tax exposure

Reviewer: M&A counsel reviews IP ownership and employment obligations, accounting advisors review tax exposure, and the appropriate technical advisor tests specialist issues.

Resolution path: The workstream owner documents remediation, a purchase price adjustment, a structure change, a closing condition, or tailored indemnification based on the finding.

Related Due Diligence Resources

M&A Due Diligence Process Guide

Complete walkthrough of the DD process from LOI to closing

Due Diligence Red Flags

Warning signs that may require escalation, additional protection, repricing, a closing condition, or termination depending on severity and resolution

Acquisition Timeline Guide

How long DD takes and what happens at each phase

M&A Transaction Risk Factors

Context for evaluating diligence findings and post-closing risk

Frequently Asked Questions

What is a due diligence checklist?
A due diligence checklist is a comprehensive list of documents, information, and questions that buyers use to investigate a target company before completing an acquisition. It ensures systematic review of all material aspects of the business including finances, legal matters, operations, employees, technology, and compliance.

How many items should be on a due diligence checklist?
The right number depends on the target's industry, transaction structure, operating complexity, and known risks. This checklist provides more than 150 starting points, but the buyer and its advisors should add, remove, and prioritize requests for the specific transaction.

What are the main categories of due diligence?
The main due diligence categories are: Financial (statements, taxes, working capital), Legal (contracts, litigation, compliance), Operational (facilities, processes, supply chain), Human Resources (employees, benefits, key person risk), Technology/IT (systems, IP, cybersecurity), Commercial (customers, market, competition), and Environmental (permits, contamination, compliance).

Who is responsible for due diligence in M&A?
The buyer is primarily responsible for organizing due diligence. The seller's information and access obligations depend on the agreed diligence process and transaction terms. Buyers often engage specialists: M&A counsel for legal review, accounting advisors for financial and tax review, and technical advisors for operational or specialist matters. The buyer's deal team coordinates the workstreams.

How long does due diligence take?
The schedule depends on the target's complexity, the seller's responsiveness, regulatory requirements, and the issues found during review. The parties should set a realistic diligence period in the letter of intent and update the work plan as findings create follow-up requests.

What happens if due diligence finds problems?
When due diligence uncovers issues, buyers have several options: renegotiate the purchase price, require seller representations and warranties, demand escrow holdbacks for specific risks, include indemnification provisions, require issues to be resolved pre-closing, or walk away from the deal entirely.

What is a data room in M&A?
A data room (typically a virtual data room or VDR) is a secure online repository where sellers upload documents for buyer review during due diligence. Data rooms track who accesses what documents, maintain version control, and allow Q&A between parties. Common providers include Intralinks, Merrill, and Firmex.

What are common due diligence red flags?
Common red flags include customer concentration, key person dependencies, declining revenue trends, pending litigation, regulatory compliance gaps, off-balance-sheet liabilities, inconsistent financial records, high employee turnover, and reluctance to provide requested documents.

Need Help with Due Diligence?

A checklist is just the start. Acquisition Stars provides legal counsel for buyers navigating the due diligence process-from document review to issue negotiation to closing.

Request Engagement Assessment Read Our DD Guide

This checklist is for educational purposes and general guidance. Every transaction is different-some items may not apply, and industry-specific items may need to be added. Consult with qualified legal, financial, and industry advisors for due diligence specific to your transaction.