70–75% of acquisitions fail to deliver their intended value. The cause is almost always diligence, not strategy.
The deal thesis was sound. The strategic rationale was compelling. The target looked right. And yet: the quality of earnings did not hold up to scrutiny. The key customer contracts had change of control provisions nobody reviewed. The pension deficit was larger than disclosed. The technology platform was five years from end-of-life. The HR integration destroyed more value in the first year than the deal created. Every one of these is a due diligence failure — not a strategic failure. A structured, comprehensive M&A due diligence process coordinates every workstream, ensures no material issue is missed, and produces the documented evidence base for the investment committee and board. This free M&A due diligence checklist covers all nine workstreams of a comprehensive acquisition process — from strategic and commercial analysis through financial, legal, tax, operational, technology, HR, ESG, and integration planning.
How M&A Due Diligence Differs From Other Forms of Due Diligence
Venture capital due diligence evaluates forward-looking potential — it tolerates uncertainty and concentrates on team quality and market opportunity. Business partnership due diligence evaluates operational compatibility. M&A due diligence is different from both: it is a backward and forward-looking investigation of everything the acquirer will own at completion — including all liabilities, all contractual obligations, all historical tax positions, all employment relationships, and all technology and operational dependencies. The acquirer is buying the company as it actually is, not as it presented itself.
Several elements are unique to M&A and require specific attention that other diligence types do not: quality of earnings analysis (confirming the reported earnings are real, recurring, and owner-independent); working capital assessment (establishing the normalised working capital basis and the completion accounts mechanism); change of control provisions (identifying contracts that trigger on acquisition and may require third-party consents or terminate automatically); tax due diligence (structuring the transaction to manage tax efficiently and identifying historic tax exposures that transfer to the acquirer); and integration planning (the work that begins in diligence and determines whether the deal ultimately creates or destroys value).
What the M&A Due Diligence Checklist Covers
This checklist covers nine workstreams that together constitute a comprehensive M&A due diligence process. Workstreams typically run in parallel, managed by specialist advisors coordinated by the deal lead. Each workstream should have a named owner — internal or external — and a defined scope before the data room opens.
Phase 1
Deal Setup & Scope Definition
Scope definition is the most important decision made before diligence begins. An undefined or poorly scoped diligence process produces findings that do not address the risks that actually matter for this deal.
Confirm the deal structure — share purchase, asset purchase, merger, or other; the structure determines which liabilities transfer and which diligence workstreams are most material
Define the diligence scope — which workstreams are required, what depth is appropriate, and what is explicitly out of scope; document the scope before work begins
Assemble the deal team — internal corporate development, legal counsel, financial advisors, tax advisors, specialist technical advisors; confirm roles and accountability for each workstream
Establish the data room — virtual data room (VDR) access granted to appropriate team members; document review protocols and NDA requirements
Define the diligence timeline — key milestones, data room request deadline, management presentations, draft report deadlines, and investment committee date
Prepare and issue the initial due diligence information request — a structured list of all documents and information required across all workstreams; issued to the seller at data room opening
Confirm the management presentation schedule — Q&A sessions with the target’s management across key workstreams
Define the issue escalation process — how material findings are escalated to the deal lead and IC; at what threshold does a finding affect price, structure, or deal certainty?
Confirm regulatory pre-clearance requirements — competition authority notification, sector regulator approval, foreign investment review (CFIUS in the US, NSI Act in the UK); identify which are required and timeline implications
Confirm confidentiality procedures — who knows about the deal inside and outside both organisations; insider trading protocols for listed entities
Phase 2
Strategic & Commercial Due Diligence
Validate the strategic rationale — does the target genuinely advance the acquirer’s strategic objectives? Is the deal thesis grounded in independently verified assumptions?
Validate market size and growth — independently assess TAM, SAM, and market growth drivers; confirm the opportunity is as large as assumed in the deal model
Assess competitive position and moat — is the target’s competitive advantage real and durable? Review through independent customer and competitor interviews, not just management presentation
Conduct customer reference calls — minimum five to eight independent customer conversations; include back-channel references not provided by management
Assess customer concentration and contract quality — what percentage of revenue is concentrated in the top customers? What are the contract terms, renewal rates, and customer satisfaction scores?
Review revenue quality and sustainability — recurring vs non-recurring, cross-sell and upsell potential, pipeline quality and conversion rates
Assess go-to-market capability — sales team quality, channel strategy, and whether growth is dependent on individuals who may not stay post-acquisition
Quality of earnings is the core of financial due diligence. It answers a single question: are the earnings the model is being built on real, recurring, and owner-independent — or inflated by one-time items, related-party transactions, or accounting adjustments?
Review audited financial statements for three to five years — income statement, balance sheet, and cash flow; confirm auditor quality and accounting policy changes
Conduct quality of earnings (QoE) analysis — adjust reported EBITDA for one-time items, non-recurring costs, related-party transactions, and accounting adjustments to arrive at normalised earnings
Analyse unit economics and management KPIs — customer acquisition cost, lifetime value, gross margin by product or segment, and key operational metrics
Review and validate the financial model — assess revenue growth assumptions, margin trajectory, capital requirements, and working capital dynamics
Conduct working capital analysis — determine normalised working capital; establish the basis for the locked box or completion accounts mechanism
Review net debt position — all debt-like items including finance leases, pension obligations, earnout liabilities, deferred revenue, and off-balance-sheet commitments
Assess capex requirements — distinguish maintenance capex from growth capex; confirm capex assumptions in the model are realistic
Review cash generation quality — understand the relationship between reported earnings and cash generation; working capital traps and seasonal patterns
Review treasury and banking arrangements — committed facilities, covenant compliance, change of control provisions in facility agreements, and hedging arrangements
Document financial diligence findings — normalised earnings, working capital assessment, net debt analysis, and key financial risks
Phase 4
Legal Due Diligence
Review corporate structure and governance — articles of association, shareholder agreements, board minutes, and subsidiary structures in all jurisdictions
Review the cap table — ownership, options, warrants, conversion rights, and any pre-emption or drag/tag rights that affect the transaction
Identify all change of control provisions — in material customer contracts, supplier agreements, financing documents, licences, and real estate leases; flag all that require consent or trigger termination rights
Review all material contracts — customer agreements, supplier agreements, partnership and distribution agreements, and any contracts with unusual terms, obligations, or liabilities
Review IP ownership and protection — patents, trade marks, copyright, trade secrets; confirm all IP is properly owned by the target entity and free of encumbrances
Review all pending and threatened litigation — current claims, regulatory investigations, and any matters that could affect deal value or timing
Review regulatory status — all licences, permits, and regulatory approvals material to the business; confirm they are current and transferable
Review real estate — owned and leased properties; title, lease terms, dilapidations, environmental liabilities, and any site-specific obligations
Confirm no material undisclosed liabilities — representations and warranties scope to be confirmed through legal review
Review the tax structure — confirm the optimal acquisition structure from a tax perspective (share vs asset purchase, jurisdiction, debt push-down); engage tax advisors before the deal structure is finalised
Review historical tax returns and compliance — corporation tax, VAT/GST, payroll taxes, and any other material tax obligations; confirm all returns are filed and up to date
Identify any open tax years or investigations — any periods under review by tax authorities; any material tax disputes or assessments
Review transfer pricing arrangements — intercompany transactions between group entities; confirm documentation and compliance with arm’s length principle
Review any deferred tax assets and liabilities — timing differences, tax loss carry-forwards, and any deferred tax positions material to the deal model
Assess R&D tax credit claims — confirm claims have been made correctly and are not subject to challenge
Review employee share schemes and their tax treatment — options, restricted shares, and any tax-favoured arrangements that may crystallise on a change of control
Confirm tax residence and permanent establishment positions — for businesses operating across multiple jurisdictions
Review indirect taxes — VAT/GST registration and compliance; any historic indirect tax exposures or assessments
Document tax findings — historic exposures, structural recommendations, and any provisions or indemnities required in the transaction documents
Phase 6
Operational & Technology Due Diligence
Review operational model and processes — core operations, supply chain, production or service delivery; assess efficiency, scalability, and operational risk
Assess operational dependencies — key suppliers, single points of failure, and operational resilience
Review technology architecture — core technology stack, proprietary systems, cloud vs on-premise, and key technical dependencies
Assess technical debt — confirm the scale and cost of legacy systems or code quality issues that will require investment post-acquisition
Review cybersecurity posture — security controls, certifications, incident history, and data breach exposure; confirm alignment with acquirer’s security standards
Review data assets and data protection — what proprietary data does the target hold? Is it protected, compliant, and transferable?
Assess technology integration complexity — how difficult and costly will it be to integrate the target’s systems with the acquirer’s? Are the platforms compatible?
Review IT contracts and third-party dependencies — major software licences, SaaS subscriptions, managed service agreements; confirm change of control provisions and transferability
Review business continuity and disaster recovery arrangements — confirm adequacy for the acquirer’s requirements
Document operational and technology findings — scalability assessment, technical debt quantification, integration complexity estimate, and key operational risks
Phase 7
HR, People & Culture Due Diligence
More acquisitions underdeliver because of people and culture failures than because of commercial or financial ones. HR diligence is the workstream most commonly under-resourced and least frequently followed through to integration.
Review the organisational structure — headcount by function, seniority levels, and reporting lines; identify key person dependencies
Identify key management and talent retention risks — who are the individuals critical to the deal thesis? What are their retention terms and succession plans?
Review employment contracts for key personnel — notice periods, restrictive covenants, change of control provisions, and good/bad leaver terms on equity
Review the overall employment terms and conditions — salaries, bonuses, benefits, and pension arrangements across the workforce; identify any material liabilities
Review any outstanding or threatened employment claims — wrongful dismissal, discrimination, harassment; confirm all claims are disclosed and quantified
Assess pension obligations — defined benefit pension schemes represent some of the largest hidden liabilities in M&A; obtain independent actuarial assessment if applicable
Assess cultural compatibility — how do the two organisations compare on decision-making style, risk tolerance, pace, and values?
Review HR policies and procedures — handbooks, performance management, grievance and disciplinary procedures; confirm they are compliant and up to date
Assess integration HR complexity — TUPE obligations (UK), WARN Act (US), or equivalent transfer of undertakings legislation; redundancy process requirements where restructuring is planned
Document HR findings — retention risk assessment, pension liability quantification, employment claim exposure, cultural fit assessment, and integration HR plan requirements
Phase 8
ESG & Regulatory Due Diligence
Define the ESG scope — which ESG factors are material to this deal, sector, and acquirer’s ESG commitments and investor requirements
Review environmental compliance — applicable environmental regulations in all jurisdictions; permits, licences, and any historic or ongoing environmental investigations or liabilities
Assess environmental contamination risk — for manufacturing, industrial, or property-intensive businesses; commission Phase 1 or Phase 2 environmental assessments where relevant
Review climate and transition risk — the target’s exposure to physical climate risk and transition risk; relevant to industries with high carbon intensity or energy exposure
Review ESG reporting and disclosures — what ESG data does the target report? Is it consistent with the acquirer’s ESG reporting framework and investor requirements?
Review supply chain ESG exposure — labour practices, human rights due diligence, and conflict minerals or other supply chain ESG risks that may transfer to the acquirer
Review sector-specific regulatory requirements — any industry-specific regulatory approvals or notifications required for the transaction to complete
Confirm competition clearance requirements — turnover thresholds and market share considerations in all relevant jurisdictions; timeline and risk of remedies
Review sanctions and trade compliance — does the target operate in or have customers in sanctioned jurisdictions? Any exposure to export control regulations?
Document ESG and regulatory findings — material ESG risks, regulatory clearance requirements and timeline, and any deal-critical conditions
Phase 9
Integration Planning & Transaction Execution
Integration planning must begin during due diligence — not after signing. The due diligence findings directly inform the integration plan, and deals that delay integration planning until post-signing consistently destroy more value than those that begin the work earlier.
Define the integration vision — what does the combined business look like? Full integration, partial integration, or standalone operation?
Develop the Day 1 plan — what must be in place by completion for the business to operate? Legal entity structure, banking, payroll, and critical IT systems
Develop the 100-day integration plan — key integration workstreams, owners, milestones, and dependencies in the first 100 days
Quantify integration costs — one-time costs of integration (restructuring, IT migration, rebranding, advisory fees); confirm these are reflected in the deal model
Confirm synergy delivery plan — how and when will identified synergies be realised? Assign owners and track against the deal model
Address retention arrangements — management incentive plans, retention bonuses, and equity roll-over for key personnel; negotiate and document before signing
Compile the investment committee or board paper — synthesising all workstream findings into a structured IC or board presentation; deal thesis, key findings, risks, price rationale, and recommended conditions
Negotiate and execute the purchase agreement — SPA, representations and warranties, indemnities, and any specific conditions precedent
Consider W&I insurance — warranty and indemnity insurance to cover gaps in seller warranty coverage; increasingly standard in mid-market M&A
Complete all conditions precedent and proceed to completion — regulatory clearances, third-party consents, financing drawdown, and completion mechanics
This checklist is available as a free, runnable template in CheckFlow — with tasks assigned across every diligence workstream and advisor, parallel workstreams tracked from a single dashboard, and a complete documented record for the investment committee.
The checklist is an investigation framework and a coordination tool — ensuring all material workstreams are scoped, resourced, and completed before the investment committee approves the transaction. Structured diligence protects the acquirer from post-completion surprises, supports price negotiation, and informs the deal structure. It also creates an evidence base for representations, warranties, and indemnities in the purchase agreement.
CheckFlow use: Assign each workstream to the relevant internal or external advisor, track progress across all parallel workstreams in real time, and maintain a timestamped record of every finding for the IC and post-deal review.
For sellers (and sell-side preparation)
The Sell-Side Preparation Framework
The same checklist is a preparation framework — a roadmap of exactly what a buyer’s diligence team will investigate. Sellers who prepare systematically — clean data room, pre-identified issues proactively disclosed with remediation plans, management presentations rehearsed — run faster processes, achieve better valuations, and preserve management confidence through a diligence process that does not feel adversarial.
CheckFlow use: Assign data room population tasks to the relevant finance, legal, HR, and operations team members, track which items are ready and which are outstanding, and share progress with the M&A advisor to demonstrate preparation quality.
The Red Flags a Structured M&A Diligence Process Is Designed to Surface
Financial
Quality of earnings adjustment that significantly reduces normalised EBITDA. Working capital that is structurally inflated ahead of the deal period. Revenue recognition policies that accelerate reported earnings. Cash conversion below 80% of EBITDA on a sustained basis.
Legal
Customer contracts with change of control termination rights covering a material portion of revenue. IP ownership gaps — particularly for software or technology businesses where IP assignment agreements are incomplete. Undisclosed litigation or regulatory investigations. Pension deficits larger than disclosed.
Commercial
Customer concentration above 25% in any single customer. Revenue growth driven by one or two sales individuals who are flight risks. NRR below 100%, indicating net customer value decline. Backlog or pipeline that does not hold up to independent verification.
Tax
Open tax years or active investigation by tax authorities. Transfer pricing arrangements that have not been documented or reviewed. Historic R&D credit claims that have not been formally agreed with tax authorities. Off-shore structure with insufficient substance.
HR & Culture
Key management retention entirely dependent on equity rollover with no underlying commitment to the acquirer’s strategy. Pension defined benefit deficit significantly larger than reflected in the management accounts. Cultural incompatibility evidenced through reference calls and employee survey data.
ESG & Regulatory
Environmental contamination liability at owned or formerly owned sites. Regulatory clearance requirement in a jurisdiction with a history of remedies in this sector. Supply chain exposure incompatible with the acquirer’s ESG commitments. Active sanctions screening issues affecting the target’s customer base.
Why Run Your M&A Diligence in CheckFlow?
CheckFlow coordinates the diligence process — workstream assignment, progress tracking, and documentation. It complements, but does not replace, specialist M&A advisors, financial due diligence firms, legal counsel, and tax advisors.
1
Track every workstream from a single dashboard
M&A diligence involves legal, financial, tax, commercial, operational, technology, HR, ESG, and integration workstreams running simultaneously — often across multiple external advisors. The deal lead needs to know, at any given moment, which workstreams are on track and which have outstanding issues that could affect timeline or deal certainty. CheckFlow’s grid dashboard shows every workstream simultaneously — no weekly status calls required to reconstruct progress.
2
Nothing material is missed under deal pressure
M&A timelines compress under competitive pressure and deal momentum. The workstreams that get cut short when time is tight are the ones that produce the most expensive post-completion surprises. CheckFlow’s structured checklist and enforced task sequence ensure every item is completed or explicitly documented as accepted risk before the IC recommendation is made — not discovered after signing.
3
An IC-ready evidence file builds automatically
The investment committee paper requires evidence of what was reviewed, what was found, and what was accepted. Every completed diligence task is logged with a timestamp and the name of the responsible advisor or analyst in CheckFlow. The complete diligence record — findings, open items, risk acceptances, and IC decisions — builds throughout the process and is ready to present without reconstruction.
M&A due diligence frequently surfaces insurance gaps in the target company — inadequate D&O run-off, underinsured property, or missing cyber liability coverage. CheckFlow’s Company Insurance Due Diligence Checklist covers the specific insurance workstream that sits within a broader M&A diligence process. See the Insurance Due Diligence Checklist →
M&A transactions increasingly require review of the target’s information security posture — particularly for technology businesses, financial services targets, or any acquisition involving significant personal data. CheckFlow’s ISO 27001 Compliance Checklist covers the security control framework against which a target’s cybersecurity posture should be assessed. See the ISO 27001 Compliance Checklist →
M&A due diligence is a comprehensive investigation of a target company across nine workstreams: strategic and commercial (market validation, competitive position, customer quality), financial (quality of earnings, working capital, net debt), legal (corporate structure, contracts, IP, change of control provisions, litigation), tax (historical compliance, transfer pricing, deal structuring), operational and technology (processes, systems, technical debt, integration complexity), HR and culture (key personnel, pension obligations, cultural compatibility), ESG and regulatory (environmental liability, regulatory clearances, sanctions), and integration planning (Day 1 readiness, 100-day plan, synergy delivery, retention arrangements). The depth of each workstream is calibrated to the deal size, sector, and the specific risks identified in the earlier stages of diligence.
How long does M&A due diligence typically take?
+
Due diligence timelines vary significantly by deal size and complexity. For smaller, straightforward acquisitions, four to six weeks is achievable. Mid-market transactions typically run eight to twelve weeks. Larger, more complex deals — particularly those involving regulatory clearance requirements, pension review, or significant technology integration assessment — can run to sixteen weeks or longer. Timelines are frequently compressed under competitive deal pressure, which increases the risk of material issues being missed. A structured checklist with pre-assigned workstreams and defined timelines is the most effective way to maintain pace without sacrificing rigour.
What is quality of earnings analysis and why does it matter?
+
Quality of earnings (QoE) analysis is the process of reviewing reported financial results and adjusting them for one-time items, non-recurring costs, accounting policy choices, related-party transactions, and other factors that may cause reported earnings to differ from the sustainable normalised earnings that the deal model is based on. It answers the question: are the earnings we are paying for real, recurring, and owner-independent? A QoE adjustment that reduces normalised EBITDA by 20% has a direct and significant impact on the deal valuation. QoE analysis is typically conducted by a specialist financial due diligence firm rather than the acquirer’s internal finance team.
What are change of control provisions and why are they critical in M&A?
+
Change of control provisions are contractual clauses that give one party rights — typically to terminate, renegotiate, or receive payment — when ownership of the other party changes. In an M&A context, they appear most commonly in customer contracts (a major customer may have the right to terminate on change of ownership), banking and financing agreements (lenders may have the right to accelerate debt on change of control), key licences (software, regulatory, or IP licences may not transfer automatically), and real estate leases. Identifying all change of control provisions and assessing whether consents can be obtained is a critical legal due diligence step — an acquisition that triggers termination of a major customer contract can materially change the deal economics.
Why should integration planning begin during due diligence?
+
Integration planning that begins after signing is almost always too late. Due diligence is the moment when the deal team has the deepest knowledge of both organisations and the most leverage to structure the transaction terms that will govern integration — management retention arrangements, equity rollover, Day 1 legal entity requirements, and IT separation or migration scope. Waiting until post-signing to begin integration planning means starting with no leverage over terms, less access to the target (deal fatigue and confidentiality constraints), and a compressed timeline. Deals where integration planning begins in earnest during diligence consistently outperform those where it begins after signing.
Is CheckFlow free to use for this template?
+
You can start a free 14-day trial with no credit card required, giving you full access to all features including this template. The Business plan is $10 per user per month after the trial. Full details at checkflow.io/pricing.
Run Every Acquisition Through a Process That Earns the Return
Free trial — no credit card required.
Do you like cookies? 🍪 We use cookies to ensure you get the best experience on our website. Learn more
