M&A Due Diligence Checklist Template

Most acquisitions fail to deliver their intended value. The cause is almost always diligence, not strategy.

Try the live checklistUse this template free

No Credit Card Required

Live demo of the M&A Due Diligence Checklist in CheckFlow

The deal thesis was sound. The strategic rationale was compelling. The target looked right. And yet: the quality of earnings did not hold up to scrutiny. The key customer contracts had change of control provisions nobody reviewed. The pension deficit was larger than disclosed. The technology platform was five years from end-of-life. The HR integration destroyed more value in the first year than the deal created. Every one of these is a due diligence failure — not a strategic failure. A structured, comprehensive M&A due diligence process coordinates every workstream, ensures no material issue is missed, and produces the documented evidence base for the investment committee and board. This free M&A due diligence checklist covers all nine workstreams of a comprehensive acquisition process — from strategic and commercial analysis through financial, legal, tax, operational, technology, HR, ESG, and integration planning.

How M&A Due Diligence Differs From Other Forms of Due Diligence

Venture capital due diligence evaluates forward-looking potential — it tolerates uncertainty and concentrates on team quality and market opportunity. Business partnership due diligence evaluates operational compatibility. M&A due diligence is different from both: it is a backward and forward-looking investigation of everything the acquirer will own at completion — including all liabilities, all contractual obligations, all historical tax positions, all employment relationships, and all technology and operational dependencies. The acquirer is buying the company as it actually is, not as it presented itself.

Several elements are unique to M&A and require specific attention that other diligence types do not: quality of earnings analysis (confirming the reported earnings are real, recurring, and owner-independent); working capital assessment (establishing the normalised working capital basis and the completion accounts mechanism); change of control provisions (identifying contracts that trigger on acquisition and may require third-party consents or terminate automatically); tax due diligence (structuring the transaction to manage tax efficiently and identifying historic tax exposures that transfer to the acquirer); and integration planning (the work that begins in diligence and determines whether the deal ultimately creates or destroys value).

What the M&A Due Diligence Checklist Covers

This checklist covers nine workstreams that together constitute a comprehensive M&A due diligence process. Workstreams typically run in parallel, managed by specialist advisors coordinated by the deal lead. Each workstream should have a named owner — internal or external — and a defined scope before the data room opens.

  1. Phase 1

    Deal Setup & Scope Definition

    10 tasks

    Scope definition is the most important decision made before diligence begins. An undefined or poorly scoped diligence process produces findings that do not address the risks that actually matter for this deal.

    • Confirm the deal structure — share purchase, asset purchase, merger, or other; the structure determines which liabilities transfer and which diligence workstreams are most material
    • Define the diligence scope — which workstreams are required, what depth is appropriate, and what is explicitly out of scope; document the scope before work begins
    • Assemble the deal team — internal corporate development, legal counsel, financial advisors, tax advisors, specialist technical advisors; confirm roles and accountability for each workstream
    • Establish the data room — virtual data room (VDR) access granted to appropriate team members; document review protocols and NDA requirements
    • Define the diligence timeline — key milestones, data room request deadline, management presentations, draft report deadlines, and investment committee date
    • Prepare and issue the initial due diligence information request — a structured list of all documents and information required across all workstreams; issued to the seller at data room opening
    • Confirm the management presentation schedule — Q&A sessions with the target’s management across key workstreams
    • Define the issue escalation process — how material findings are escalated to the deal lead and IC; at what threshold does a finding affect price, structure, or deal certainty?
    • Confirm regulatory pre-clearance requirements — competition authority notification, sector regulator approval, foreign investment review (CFIUS in the US, NSI Act in the UK); identify which are required and timeline implications
    • Confirm confidentiality procedures — who knows about the deal inside and outside both organisations; insider trading protocols for listed entities
  2. Phase 2

    Strategic & Commercial Due Diligence

    10 tasks
    • Validate the strategic rationale — does the target genuinely advance the acquirer’s strategic objectives? Is the deal thesis grounded in independently verified assumptions?
    • Validate market size and growth — independently assess TAM, SAM, and market growth drivers; confirm the opportunity is as large as assumed in the deal model
    • Assess competitive position and moat — is the target’s competitive advantage real and durable? Review through independent customer and competitor interviews, not just management presentation
    • Conduct customer reference calls — minimum five to eight independent customer conversations; include back-channel references not provided by management
    • Assess customer concentration and contract quality — what percentage of revenue is concentrated in the top customers? What are the contract terms, renewal rates, and customer satisfaction scores?
    • Review revenue quality and sustainability — recurring vs non-recurring, cross-sell and upsell potential, pipeline quality and conversion rates
    • Assess go-to-market capability — sales team quality, channel strategy, and whether growth is dependent on individuals who may not stay post-acquisition
    • Identify synergy opportunities — revenue synergies (cross-sell, market expansion) and cost synergies (overhead, procurement, operational efficiencies); document assumptions and validate feasibility
    • Conduct industry expert interviews — engage independent sector specialists to validate market assumptions and competitive positioning
    • Document commercial diligence findings — deal thesis validation, revenue quality assessment, synergy quantification, and key risks
  3. Phase 3

    Financial Due Diligence

    10 tasks

    Quality of earnings is the core of financial due diligence. It answers a single question: are the earnings the model is being built on real, recurring, and owner-independent — or inflated by one-time items, related-party transactions, or accounting adjustments?

    • Review audited financial statements for three to five years — income statement, balance sheet, and cash flow; confirm auditor quality and accounting policy changes
    • Conduct quality of earnings (QoE) analysis — adjust reported EBITDA for one-time items, non-recurring costs, related-party transactions, and accounting adjustments to arrive at normalised earnings
    • Analyse unit economics and management KPIs — customer acquisition cost, lifetime value, gross margin by product or segment, and key operational metrics
    • Review and validate the financial model — assess revenue growth assumptions, margin trajectory, capital requirements, and working capital dynamics
    • Conduct working capital analysis — determine normalised working capital; establish the basis for the locked box or completion accounts mechanism
    • Review net debt position — all debt-like items including finance leases, pension obligations, earnout liabilities, deferred revenue, and off-balance-sheet commitments
    • Assess capex requirements — distinguish maintenance capex from growth capex; confirm capex assumptions in the model are realistic
    • Review cash generation quality — understand the relationship between reported earnings and cash generation; working capital traps and seasonal patterns
    • Review treasury and banking arrangements — committed facilities, covenant compliance, change of control provisions in facility agreements, and hedging arrangements
    • Document financial diligence findings — normalised earnings, working capital assessment, net debt analysis, and key financial risks
  4. Phase 4

    Legal Due Diligence

    10 tasks
    • Review corporate structure and governance — articles of association, shareholder agreements, board minutes, and subsidiary structures in all jurisdictions
    • Review the cap table — ownership, options, warrants, conversion rights, and any pre-emption or drag/tag rights that affect the transaction
    • Identify all change of control provisions — in material customer contracts, supplier agreements, financing documents, licences, and real estate leases; flag all that require consent or trigger termination rights
    • Review all material contracts — customer agreements, supplier agreements, partnership and distribution agreements, and any contracts with unusual terms, obligations, or liabilities
    • Review IP ownership and protection — patents, trade marks, copyright, trade secrets; confirm all IP is properly owned by the target entity and free of encumbrances
    • Review all pending and threatened litigation — current claims, regulatory investigations, and any matters that could affect deal value or timing
    • Review regulatory status — all licences, permits, and regulatory approvals material to the business; confirm they are current and transferable
    • Review real estate — owned and leased properties; title, lease terms, dilapidations, environmental liabilities, and any site-specific obligations
    • Confirm no material undisclosed liabilities — representations and warranties scope to be confirmed through legal review
    • Document legal diligence findings — issues identified, conditions precedent required, W&I insurance scope, and deal structure implications
  5. Phase 5

    Tax Due Diligence

    10 tasks
    • Review the tax structure — confirm the optimal acquisition structure from a tax perspective (share vs asset purchase, jurisdiction, debt push-down); engage tax advisors before the deal structure is finalised
    • Review historical tax returns and compliance — corporation tax, VAT/GST, payroll taxes, and any other material tax obligations; confirm all returns are filed and up to date
    • Identify any open tax years or investigations — any periods under review by tax authorities; any material tax disputes or assessments
    • Review transfer pricing arrangements — intercompany transactions between group entities; confirm documentation and compliance with arm’s length principle
    • Review any deferred tax assets and liabilities — timing differences, tax loss carry-forwards, and any deferred tax positions material to the deal model
    • Assess R&D tax credit claims — confirm claims have been made correctly and are not subject to challenge
    • Review employee share schemes and their tax treatment — options, restricted shares, and any tax-favoured arrangements that may crystallise on a change of control
    • Confirm tax residence and permanent establishment positions — for businesses operating across multiple jurisdictions
    • Review indirect taxes — VAT/GST registration and compliance; any historic indirect tax exposures or assessments
    • Document tax findings — historic exposures, structural recommendations, and any provisions or indemnities required in the transaction documents
  6. Phase 6

    Operational & Technology Due Diligence

    10 tasks
    • Review operational model and processes — core operations, supply chain, production or service delivery; assess efficiency, scalability, and operational risk
    • Assess operational dependencies — key suppliers, single points of failure, and operational resilience
    • Review technology architecture — core technology stack, proprietary systems, cloud vs on-premise, and key technical dependencies
    • Assess technical debt — confirm the scale and cost of legacy systems or code quality issues that will require investment post-acquisition
    • Review cybersecurity posture — security controls, certifications, incident history, and data breach exposure; confirm alignment with acquirer’s security standards
    • Review data assets and data protection — what proprietary data does the target hold? Is it protected, compliant, and transferable?
    • Assess technology integration complexity — how difficult and costly will it be to integrate the target’s systems with the acquirer’s? Are the platforms compatible?
    • Review IT contracts and third-party dependencies — major software licences, SaaS subscriptions, managed service agreements; confirm change of control provisions and transferability
    • Review business continuity and disaster recovery arrangements — confirm adequacy for the acquirer’s requirements
    • Document operational and technology findings — scalability assessment, technical debt quantification, integration complexity estimate, and key operational risks
  7. Phase 7

    HR, People & Culture Due Diligence

    10 tasks

    More acquisitions underdeliver because of people and culture failures than because of commercial or financial ones. HR diligence is the workstream most commonly under-resourced and least frequently followed through to integration.

    • Review the organisational structure — headcount by function, seniority levels, and reporting lines; identify key person dependencies
    • Identify key management and talent retention risks — who are the individuals critical to the deal thesis? What are their retention terms and succession plans?
    • Review employment contracts for key personnel — notice periods, restrictive covenants, change of control provisions, and good/bad leaver terms on equity
    • Review the overall employment terms and conditions — salaries, bonuses, benefits, and pension arrangements across the workforce; identify any material liabilities
    • Review any outstanding or threatened employment claims — wrongful dismissal, discrimination, harassment; confirm all claims are disclosed and quantified
    • Assess pension obligations — defined benefit pension schemes represent some of the largest hidden liabilities in M&A; obtain independent actuarial assessment if applicable
    • Assess cultural compatibility — how do the two organisations compare on decision-making style, risk tolerance, pace, and values?
    • Review HR policies and procedures — handbooks, performance management, grievance and disciplinary procedures; confirm they are compliant and up to date
    • Assess integration HR complexity — TUPE obligations (UK), WARN Act (US), or equivalent transfer of undertakings legislation; redundancy process requirements where restructuring is planned
    • Document HR findings — retention risk assessment, pension liability quantification, employment claim exposure, cultural fit assessment, and integration HR plan requirements
  8. Phase 8

    ESG & Regulatory Due Diligence

    10 tasks
    • Define the ESG scope — which ESG factors are material to this deal, sector, and acquirer’s ESG commitments and investor requirements
    • Review environmental compliance — applicable environmental regulations in all jurisdictions; permits, licences, and any historic or ongoing environmental investigations or liabilities
    • Assess environmental contamination risk — for manufacturing, industrial, or property-intensive businesses; commission Phase 1 or Phase 2 environmental assessments where relevant
    • Review climate and transition risk — the target’s exposure to physical climate risk and transition risk; relevant to industries with high carbon intensity or energy exposure
    • Review ESG reporting and disclosures — what ESG data does the target report? Is it consistent with the acquirer’s ESG reporting framework and investor requirements?
    • Review supply chain ESG exposure — labour practices, human rights due diligence, and conflict minerals or other supply chain ESG risks that may transfer to the acquirer
    • Review sector-specific regulatory requirements — any industry-specific regulatory approvals or notifications required for the transaction to complete
    • Confirm competition clearance requirements — turnover thresholds and market share considerations in all relevant jurisdictions; timeline and risk of remedies
    • Review sanctions and trade compliance — does the target operate in or have customers in sanctioned jurisdictions? Any exposure to export control regulations?
    • Document ESG and regulatory findings — material ESG risks, regulatory clearance requirements and timeline, and any deal-critical conditions
  9. Phase 9

    Integration Planning & Transaction Execution

    10 tasks

    Integration planning must begin during due diligence — not after signing. The due diligence findings directly inform the integration plan, and deals that delay integration planning until post-signing consistently destroy more value than those that begin the work earlier.

    • Define the integration vision — what does the combined business look like? Full integration, partial integration, or standalone operation?
    • Develop the Day 1 plan — what must be in place by completion for the business to operate? Legal entity structure, banking, payroll, and critical IT systems
    • Develop the 100-day integration plan — key integration workstreams, owners, milestones, and dependencies in the first 100 days
    • Quantify integration costs — one-time costs of integration (restructuring, IT migration, rebranding, advisory fees); confirm these are reflected in the deal model
    • Confirm synergy delivery plan — how and when will identified synergies be realised? Assign owners and track against the deal model
    • Address retention arrangements — management incentive plans, retention bonuses, and equity roll-over for key personnel; negotiate and document before signing
    • Compile the investment committee or board paper — synthesising all workstream findings into a structured IC or board presentation; deal thesis, key findings, risks, price rationale, and recommended conditions
    • Negotiate and execute the purchase agreement — SPA, representations and warranties, indemnities, and any specific conditions precedent
    • Consider W&I insurance — warranty and indemnity insurance to cover gaps in seller warranty coverage; increasingly standard in mid-market M&A
    • Complete all conditions precedent and proceed to completion — regulatory clearances, third-party consents, financing drawdown, and completion mechanics

This checklist is available as a free, runnable template in CheckFlow — with tasks assigned across every diligence workstream and advisor, parallel workstreams tracked from a single dashboard, and a complete documented record for the investment committee.

Use this template free

The Checklist From Both Sides of the Transaction

For buyers (acquirers)

The Investigation Framework & Coordination Tool

The checklist is an investigation framework and a coordination tool — ensuring all material workstreams are scoped, resourced, and completed before the investment committee approves the transaction. Structured diligence protects the acquirer from post-completion surprises, supports price negotiation, and informs the deal structure. It also creates an evidence base for representations, warranties, and indemnities in the purchase agreement.

CheckFlow use: Assign each workstream to the relevant internal or external advisor, track progress across all parallel workstreams in real time, and maintain a timestamped record of every finding for the IC and post-deal review.

For sellers (and sell-side preparation)

The Sell-Side Preparation Framework

The same checklist is a preparation framework — a roadmap of exactly what a buyer’s diligence team will investigate. Sellers who prepare systematically — clean data room, pre-identified issues proactively disclosed with remediation plans, management presentations rehearsed — run faster processes, achieve better valuations, and preserve management confidence through a diligence process that does not feel adversarial.

CheckFlow use: Assign data room population tasks to the relevant finance, legal, HR, and operations team members, track which items are ready and which are outstanding, and share progress with the M&A advisor to demonstrate preparation quality.

The Red Flags a Structured M&A Diligence Process Is Designed to Surface

Financial

Quality of earnings adjustment that significantly reduces normalised EBITDA. Working capital that is structurally inflated ahead of the deal period. Revenue recognition policies that accelerate reported earnings. Cash conversion below 80% of EBITDA on a sustained basis.

Legal

Customer contracts with change of control termination rights covering a material portion of revenue. IP ownership gaps — particularly for software or technology businesses where IP assignment agreements are incomplete. Undisclosed litigation or regulatory investigations. Pension deficits larger than disclosed.

Commercial

Customer concentration above 25% in any single customer. Revenue growth driven by one or two sales individuals who are flight risks. NRR below 100%, indicating net customer value decline. Backlog or pipeline that does not hold up to independent verification.

Tax

Open tax years or active investigation by tax authorities. Transfer pricing arrangements that have not been documented or reviewed. Historic R&D credit claims that have not been formally agreed with tax authorities. Off-shore structure with insufficient substance.

HR & Culture

Key management retention entirely dependent on equity rollover with no underlying commitment to the acquirer’s strategy. Pension defined benefit deficit significantly larger than reflected in the management accounts. Cultural incompatibility evidenced through reference calls and employee survey data.

ESG & Regulatory

Environmental contamination liability at owned or formerly owned sites. Regulatory clearance requirement in a jurisdiction with a history of remedies in this sector. Supply chain exposure incompatible with the acquirer’s ESG commitments. Active sanctions screening issues affecting the target’s customer base.

Why Run Your M&A Diligence in CheckFlow?

CheckFlow coordinates the diligence process — workstream assignment, progress tracking, and documentation. It complements, but does not replace, specialist M&A advisors, financial due diligence firms, legal counsel, and tax advisors.

1

Track every workstream from a single dashboard

M&A diligence involves legal, financial, tax, commercial, operational, technology, HR, ESG, and integration workstreams running simultaneously — often across multiple external advisors. The deal lead needs to know, at any given moment, which workstreams are on track and which have outstanding issues that could affect timeline or deal certainty. CheckFlow’s grid dashboard shows every workstream simultaneously — no weekly status calls required to reconstruct progress.

2

Nothing material is missed under deal pressure

M&A timelines compress under competitive pressure and deal momentum. The workstreams that get cut short when time is tight are the ones that produce the most expensive post-completion surprises. CheckFlow’s structured checklist and enforced task sequence ensure every item is completed or explicitly documented as accepted risk before the IC recommendation is made — not discovered after signing.

3

An IC-ready evidence file builds automatically

The investment committee paper requires evidence of what was reviewed, what was found, and what was accepted. Every completed diligence task is logged with a timestamp and the name of the responsible advisor or analyst in CheckFlow. The complete diligence record — findings, open items, risk acceptances, and IC decisions — builds throughout the process and is ready to present without reconstruction.

M&A due diligence frequently surfaces insurance gaps in the target company — inadequate D&O run-off, underinsured property, or missing cyber liability coverage. CheckFlow’s Company Insurance Due Diligence Checklist covers the specific insurance workstream that sits within a broader M&A diligence process. See the Insurance Due Diligence Checklist →

M&A transactions increasingly require review of the target’s information security posture — particularly for technology businesses, financial services targets, or any acquisition involving significant personal data. CheckFlow’s ISO 27001 Compliance Checklist covers the security control framework against which a target’s cybersecurity posture should be assessed. See the ISO 27001 Compliance Checklist →

Other Due Diligence Templates

Due DiligenceLive demo

Post-Merger Integration Checklist

8 phases · 51 tasks
Due DiligenceLive demo

Venture Capital Due Diligence Checklist

8 phases · 80 tasks
Due DiligenceLive demo

Business Partnership Due Diligence Checklist

8 phases · 80 tasks
Due DiligenceLive demo

Financial Due Diligence Checklist

7 phases · 43 tasks
Due DiligenceLive demo

Private Equity Due Diligence Checklist

9 phases · 90 tasks
View all due diligence templates
AI generator

Didn’t find what you need? Describe it.

Describe the process in a sentence and the AI checklist generator drafts the phases and tasks for you.

Frequently Asked Questions

What does M&A due diligence cover?

M&A due diligence is a comprehensive investigation of a target company across nine workstreams: strategic and commercial (market validation, competitive position, customer quality), financial (quality of earnings, working capital, net debt), legal (corporate structure, contracts, IP, change of control provisions, litigation), tax (historical compliance, transfer pricing, deal structuring), operational and technology (processes, systems, technical debt, integration complexity), HR and culture (key personnel, pension obligations, cultural compatibility), ESG and regulatory (environmental liability, regulatory clearances, sanctions), and integration planning (Day 1 readiness, 100-day plan, synergy delivery, retention arrangements). The depth of each workstream is calibrated to the deal size, sector, and the specific risks identified in the earlier stages of diligence.

How long does M&A due diligence typically take?

Due diligence timelines vary significantly by deal size and complexity. For smaller, straightforward acquisitions, four to six weeks is achievable. Mid-market transactions typically run eight to twelve weeks. Larger, more complex deals — particularly those involving regulatory clearance requirements, pension review, or significant technology integration assessment — can run to sixteen weeks or longer. Timelines are frequently compressed under competitive deal pressure, which increases the risk of material issues being missed. A structured checklist with pre-assigned workstreams and defined timelines is the most effective way to maintain pace without sacrificing rigour.

What is quality of earnings analysis and why does it matter?

Quality of earnings (QoE) analysis is the process of reviewing reported financial results and adjusting them for one-time items, non-recurring costs, accounting policy choices, related-party transactions, and other factors that may cause reported earnings to differ from the sustainable normalised earnings that the deal model is based on. It answers the question: are the earnings we are paying for real, recurring, and owner-independent? A QoE adjustment that reduces normalised EBITDA by 20% has a direct and significant impact on the deal valuation. QoE analysis is typically conducted by a specialist financial due diligence firm rather than the acquirer’s internal finance team. The Financial Due Diligence Checklist breaks that workstream down, from normalised EBITDA to the working capital peg and net debt.

What are change of control provisions and why are they critical in M&A?

Change of control provisions are contractual clauses that give one party rights — typically to terminate, renegotiate, or receive payment — when ownership of the other party changes. In an M&A context, they appear most commonly in customer contracts (a major customer may have the right to terminate on change of ownership), banking and financing agreements (lenders may have the right to accelerate debt on change of control), key licences (software, regulatory, or IP licences may not transfer automatically), and real estate leases. Identifying all change of control provisions and assessing whether consents can be obtained is a critical legal due diligence step — an acquisition that triggers termination of a major customer contract can materially change the deal economics.

Why should integration planning begin during due diligence?

Integration planning that begins after signing is almost always too late. Due diligence is the moment when the deal team has the deepest knowledge of both organisations and the most leverage to structure the transaction terms that will govern integration — management retention arrangements, equity rollover, Day 1 legal entity requirements, and IT separation or migration scope. Waiting until post-signing to begin integration planning means starting with no leverage over terms, less access to the target (deal fatigue and confidentiality constraints), and a compressed timeline. Deals where integration planning begins in earnest during diligence consistently outperform those where it begins after signing.

Is CheckFlow free to use for this template?

You can start a free 14-day trial with no credit card required, giving you full access to all features including this template. The Business plan is $10 per user per month after the trial. Full details at checkflow.io/pricing.

Run Every Acquisition Through a Process That Earns the Return

Free trial — no credit card required.

Use this template free

14-day free trial, no credit cardFull refund in your first 30 daysUS hosting, EU on request