Due Diligence Checklist: Complete Guide for Business and M&A Transactions
Use this due diligence checklist to review financial, legal, commercial, HR, IT, operational, and compliance risks before a business transaction or M&A deal.
Last updated: 2026 Scope: Business transactions, investment reviews, and M&A due diligence Use case: Buyer due diligence, seller preparation, advisor review, and virtual data room document organisation
Due diligence is the process of reviewing a business before a transaction, investment, or acquisition. A due diligence checklist is the structured list of documents, questions, and review areas used to verify the company’s financial position, legal exposure, operations, customers, workforce, technology, and compliance status.
This guide explains what a due diligence checklist includes, how due diligence works in M&A, which red flags matter most, and how to organise sensitive information securely in a virtual data room.
At a glance
A due diligence checklist is a structured framework used to assess a business before an acquisition, investment, partnership, or sale. In M&A, it helps buyers, sellers, investors, and advisors review financial, legal, tax, operational, commercial, HR, technology, intellectual property, and compliance risks in a consistent way.
Most due diligence processes are designed to answer five core questions:
- Is the business financially sound?
- Are there legal, tax, or regulatory liabilities?
- Are customers, suppliers, operations, and employees stable?
- Are systems, data, contracts, and intellectual property properly controlled?
- Do any findings justify a price adjustment, revised deal terms, added protections, or a decision not to proceed?
For most mid-market transactions, due diligence is used to verify value, identify material risks, prioritise follow-up questions, and decide whether to proceed, renegotiate, or walk away.
Key takeaways
- Due diligence is the investigation of a business before a transaction or investment.
- A due diligence checklist is the structured list of documents, questions, and review areas used to manage that investigation.
- In M&A, due diligence usually covers financial, legal, tax, operational, HR, commercial, IT, cybersecurity, intellectual property, and compliance workstreams.
- The purpose of due diligence is to verify value, identify risk, and support deal decisions.
- Common red flags include customer concentration, hidden liabilities, weak contracts, litigation, poor cybersecurity controls, and unclear IP ownership.
- A virtual data room helps manage due diligence by supporting secure file sharing, permission controls, document governance, and audit trails.
What is a due diligence checklist?
A due diligence checklist is a structured framework used to assess a business before a transaction, investment, acquisition, or partnership. It lists the documents, questions, and review areas needed to evaluate the company’s financial condition, legal position, operational stability, commercial performance, workforce obligations, technology environment, intellectual property, and compliance risks.
In M&A, the checklist acts as a control document for the review process. It helps the parties identify what information is required, which specialists should review it, what follow-up questions need to be answered, and which issues may affect valuation, deal terms, or completion.
Most due diligence checklists include:
- Financial statements and tax records
- Corporate and legal documents
- Customer, supplier, and commercial contracts
- Operational processes and business continuity plans
- Employee contracts, benefits, and HR policies
- IT systems, software licences, and cybersecurity controls
- Intellectual property and asset records
- Regulatory, compliance, and insurance documents
What is due diligence in M&A?
Due diligence in M&A is the structured review of a target company before a merger, acquisition, or business sale is completed. Its purpose is to verify the accuracy of the seller’s information, identify liabilities and operational risks, test the sustainability of earnings and customer relationships, and determine whether the agreed valuation and deal structure remain appropriate.
In practice, M&A due diligence usually covers financial, legal, tax, operational, commercial, HR, IT, cybersecurity, data protection, and intellectual property matters. The depth of review depends on the size of the transaction, the sector, the jurisdictions involved, and the risk profile of the target business.
Most M&A due diligence processes take 30 to 90 days, depending on the size and complexity of the transaction. Smaller deals may move faster, while regulated businesses, cross-border transactions, or companies with complex ownership structures usually require deeper review.
There are three common types of M&A due diligence:
- Buy-side due diligence: completed by the buyer to verify the target company’s value, risks, and obligations
- Sell-side due diligence: completed by the seller before going to market so documents, risks, and disclosures are prepared in advance
- Enhanced due diligence: used for higher-risk transactions, such as regulated industries, overseas operations, complex ownership structures, or sensitive data environments
Core definitions
Due diligence: A structured investigation of a business, asset, or counterparty before a transaction or investment.
Due diligence checklist: A documented list of review areas, required documents, and follow-up questions used to manage the due diligence process.
M&A due diligence: Due diligence conducted in connection with a merger, acquisition, or business sale to verify value, identify liabilities, and support transaction decisions.
Virtual data room: A secure digital workspace used to store, organise, permission, and track access to confidential transaction documents.
Audit trail: A timestamped record showing who viewed, downloaded, edited, or shared a document.
Permission controls: Rules that define which users can view, download, upload, print, edit, or share specific files or folders.
Why due diligence matters
Due diligence matters because transaction decisions are made on the basis of incomplete information unless claims are tested against evidence. A structured review helps buyers and investors verify performance, identify legal and financial exposure, understand operational dependencies, and assess whether material risks are already reflected in the proposed price.
Due diligence also affects transaction execution. Findings may lead to a price adjustment, revised completion conditions, additional disclosures, specific indemnities, retention arrangements, or a decision not to proceed. For sellers, early preparation can reduce delays, improve response quality, and make the review process more controlled.
Without proper due diligence, buyers may inherit risks that were not visible during early negotiations. These can include unpaid tax liabilities, weak contracts, pending litigation, employee disputes, customer concentration, cybersecurity issues, supplier dependencies, or inaccurate financial reporting.
For sellers, due diligence preparation is just as important. Organising documents in advance helps reduce delays, answer buyer questions faster, and build confidence during the review process.
When to use a due diligence checklist
A due diligence checklist is commonly used in:
- business acquisitions
- mergers
- private equity investments
- minority investments
- joint ventures
- strategic partnerships
- vendor or seller preparation
- regulated or high-risk commercial relationships
The checklist should be adapted to the size of the transaction, the industry, the jurisdictions involved, the sensitivity of the data, and the level of regulatory oversight.
The complete due diligence checklist
A due diligence checklist should cover every area that could affect the value, risk, or future performance of the business. For most transactions, this includes financial records, legal documents, commercial contracts, operations, employees, IT systems, intellectual property, assets, tax, and compliance.
The checklist below is designed for business acquisitions, investment reviews, and M&A transactions. Use it as a practical starting point, then adapt it based on the company’s size, sector, location, and deal structure.
How to prioritise due diligence findings
Not every issue discovered during due diligence has the same impact. A practical way to assess findings is to classify them by financial impact, legal exposure, operational disruption, regulatory risk, remediability, and likely deal impact.
Due diligence workstreams compared
Financial due diligence checklist
- Three to five years of audited financial statements (UK GAAP or IFRS)
- VAT returns and HMRC correspondence (last three years)
- PAYE records and National Insurance compliance
- Corporation tax filings and payment history
- Management accounts and cash flow statements
- Bank statements and loan agreements
- Working capital analysis
- Debt schedules and covenant compliance
- Profit-sharing arrangements and other agreements
Financial due diligence is used to test the quality of earnings, cash generation, debt exposure, working capital needs, and the reliability of the company’s reported performance. Buyers should review accounting policies, unusual transactions, and any restatements that may indicate underlying reporting or control issues.
Tax and financing records matter because liabilities may survive the transaction. Financing agreements should be reviewed carefully for covenants, repayment triggers, and change-of-control clauses that could affect the deal.
Legal and regulatory due diligence checklist
- Companies House filings and good standing confirmation
- Articles of association and shareholders’ agreements
- Material contracts (anything over 5% of revenue/expenses)
- Employment contracts and TUPE Employee Liability Information
- Intellectual property registrations (UK IPO)
- FCA authorisations (if applicable)
- GDPR compliance and data privacy documentation
- Litigation history and pending claims
- Insurance policies and claims history
- Property taxes and real property ownership records
- Trading permits and regulatory licences
Legal due diligence is used to confirm ownership, corporate authority, contract enforceability, regulatory status, and exposure to disputes or claims. Particular attention should be paid to the ownership chain, material contracts, licences, and any restrictions that may be triggered by a sale or acquisition.
Employment and transfer obligations are also important. Under TUPE, for example, the outgoing employer must provide Employee Liability Information in writing within the required timeframe before transfer. This includes employment terms, disciplinary actions, grievances, and legal proceedings where relevant. An enterprise document management system can help organise large volumes of agreements and maintain a clear record of supporting documentation.
Verify the legal structure and ownership chain, particularly for group companies. Review all permits required for business operations and confirm they are transferable. A well-organised document management platform can also help teams understand how complex diligence records are typically structured and indexed. Where the transaction involves regulated activity or sensitive personal data, the scope of review should also cover permissions, privacy controls, and sector-specific compliance obligations.
Operational due diligence checklist
- Organisational structure and reporting lines
- Key operational processes and systems
- Supply chain agreements and dependencies
- Quality certifications (ISO standards)
- Brexit impact assessments
- Business continuity and disaster recovery plans
- Key customer contracts (at least top 10 by revenue)
- Competitor analysis and market position
- Equipment and physical assets inventories
- Customer satisfaction metrics and reviews
Operational due diligence tests whether the business can continue to perform as expected after the transaction. This includes reviewing supplier dependencies, internal controls, service delivery, continuity planning, production capacity, and the resilience of key operating processes.
Customer and supplier concentration can materially affect risk. A business that depends heavily on a small number of customers, suppliers, or logistics routes may face disruption that is not obvious from the financial statements alone.
Technology and IP due diligence checklist
- IT infrastructure and security assessments
- Software licences and SaaS agreements
- Cybersecurity policies and incident history
- Patents, trademarks, and copyrights
- Trade secrets and confidential information
- Source code and technical documentation
- GDPR compliance for data systems
Technology due diligence reviews the systems, applications, data controls, and security practices that support the business. The goal is to determine whether the company’s technology environment is reliable, supportable, secure, and legally compliant.
Software licensing should be verified carefully, especially where core systems depend on third-party tools or long-term SaaS contracts. Buyers should also review past security incidents, access control practices, backup arrangements, and whether documented policies match actual technical controls. Storing diligence files in secure cloud storage built for confidential documents is especially important where the review includes personal data, commercially sensitive technical information, or confidential contracts.
Intellectual property review should confirm that key trademarks, patents, copyrights, domain names, trade secrets, and technical materials are properly owned, assigned, and protected. Unclear ownership or missing assignments can become a material transaction issue.
Human resources due diligence checklist
- Employee contracts and handbooks
- TUPE implications and consultation requirements
- Pension schemes
- Share option schemes and stock options
- IR35 compliance for contractors
- Health and safety records
- HR policies and procedures documentation
- Training and development programmes
- Key person dependencies
HR due diligence helps assess workforce stability, employment obligations, change-of-control exposure, and retention risk. The review should cover contractual terms, pensions, benefits, contractor arrangements, equity schemes, disputes, and the company’s reliance on key personnel.
Share schemes and contractor arrangements deserve particular attention. Some equity plans accelerate vesting on a change of control, while poor IR35 assessments may create tax exposure. HR policies should also be reviewed because they may affect compliance, employee relations, and post-transaction integration.
Commercial due diligence checklist
- Customer concentration analysis
- Sales pipeline and forecasts
- Marketing strategies and budgets
- Brand value and reputation
- Market share and growth trends
- Pricing strategies and margins
- Distribution channels and partnerships
Commercial due diligence is used to evaluate revenue durability, market position, pricing strength, customer relationships, and growth assumptions. It helps buyers assess whether recent performance is sustainable and whether forecasts are supported by evidence.
In practice, this usually means reviewing revenue concentration, churn, margins, forecast accuracy, customer contract terms, channel performance, and competitive pressures. If a large share of revenue depends on a small number of customers or contracts, the valuation may need closer scrutiny.
Due diligence checklist template
The table below summarises the main documents and review areas commonly included in a business or M&A due diligence checklist. It can be used by buyers, sellers, investors, lawyers, accountants, and advisors as a starting point for organising the due diligence process.
Due diligence process: step by step
A due diligence checklist is most useful when it is connected to a clear process. Most business and M&A due diligence reviews follow the same broad stages, although the depth of review will depend on the company, sector, and transaction structure.
1. Define the scope of due diligence
Start by deciding which areas need to be reviewed. A small transaction may only require financial, legal, and operational checks, while a larger acquisition may also need detailed tax, HR, IT, cybersecurity, environmental, and regulatory review.
2. Request and organise documents
The buyer, investor, or advisor sends an information request list to the seller. The seller then collects the required documents and organises them by category, usually in a secure virtual data room.
3. Assign reviewers
Different specialists should review different parts of the checklist. Accountants usually review financial records, lawyers review contracts and legal documents, HR teams review employee obligations, and IT specialists review systems, software, and cybersecurity risks.
4. Ask follow-up questions
Due diligence rarely ends with the first document request. Buyers and advisors often need clarification on missing documents, unusual financial movements, unclear contract terms, customer concentration, employee liabilities, or technical risks.
5. Identify risks and red flags
Each workstream should summarise its findings and highlight material risks. These may affect the valuation, deal structure, warranties, indemnities, completion conditions, or the decision to proceed.
6. Resolve issues before completion
If risks are discovered, the parties can decide how to handle them before completion. This may involve price adjustments, additional disclosures, contract changes, holdbacks, indemnities, or seller actions to resolve specific issues.
Common due diligence red flags
A due diligence checklist is not only used to gather documents. It is also used to identify warning signs that could change the valuation, the legal protections required, or the decision to proceed with the transaction.
Common red flags include:
- Missing or inconsistent financial records
- Unpaid tax liabilities or disputes with tax authorities
- Revenue that depends heavily on a small number of customers
- Change-of-control clauses in key contracts
- Pending or threatened litigation
- Unclear ownership of intellectual property
- Material regulatory gaps or expired licences
- Weak data protection or cybersecurity controls
- Supplier concentration or operational dependency
- Poor working capital management
- Incomplete employment records or unresolved employee disputes
- Outdated software licences or unsupported IT systems
- No clear audit trail for sensitive document sharing
Important: A red flag does not always mean the transaction should stop. It should trigger further review, clearer disclosure, and a decision about whether the risk should affect valuation, deal structure, warranties, indemnities, or completion conditions.
Common due diligence red flags and likely deal impact
Buyer vs seller due diligence
Due diligence looks different depending on which side of the transaction you are on. Buyers use the checklist to verify risk and value, while sellers use it to prepare documents and reduce friction during the review.
Buy-side due diligence
Buy-side due diligence is completed by the buyer, investor, or acquiring company before committing to the transaction.
- Verify financial performance and forecasts
- Review legal, tax, HR, and compliance risks
- Assess customers, suppliers, and market position
- Identify red flags that may affect valuation
- Decide whether to proceed, renegotiate, or walk away
Sell-side due diligence
Sell-side due diligence is completed by the seller before or during the sale process to prepare the business for buyer review.
- Collect key financial, legal, and commercial documents
- Resolve obvious gaps before buyer review begins
- Prepare answers to common buyer questions
- Organise documents in a secure virtual data room
- Reduce delays and improve buyer confidence
How virtual data rooms speed up due diligence
Due diligence involves large volumes of confidential information, including financial statements, contracts, employee records, tax files, customer data, supplier agreements, and intellectual property documents. Multiple parties often need access to these materials at the same time, which creates risks around version control, permissions, traceability, and secure sharing.
A virtual data room is designed to address those issues in transaction settings. It provides a structured environment for storing, organising, permissioning, and monitoring access to sensitive documents during an acquisition, investment, or other high-stakes review.
Compared with email attachments or general-purpose shared drives, a virtual data room is typically better suited to due diligence because it supports granular permissions, document indexing, activity logging, controlled Q&A, and stronger auditability. For a deeper look at how these rooms are typically built and structured for transactions, see everything you need to know about M&A data rooms.
Security and compliance
Security matters in due diligence because transaction materials often include confidential financial, legal, employee, customer, and technical information. A virtual data room should therefore provide strong encryption in transit and at rest, multi-factor authentication, role-based permission controls, watermarking, and detailed activity logging.
For regulated or privacy-sensitive transactions, buyers and sellers may also assess whether the platform aligns with relevant standards and obligations, such as ISO 27001, SOC 2, GDPR, sector-specific controls, and data residency requirements where relevant.
These controls reduce the risk of accidental disclosure, unauthorised access, and poor handling of sensitive information during a live transaction. When comparing virtual data rooms vs file sharing services, the main difference is usually control. A purpose-built data room is generally better suited to confidential transactions because it supports stronger permissions, audit trails, and document governance.
If you are evaluating the best virtual data room for a transaction, compare security controls, access management, usability, auditability, and support for deal workflows.
Document organisation and access control
Structured document repositories make information easier to find and review. In practice, folders should mirror the due diligence checklist, with separate workstreams for financial records, legal documents, employment files, commercial agreements, operational documentation, and technology materials.
Granular permissions allow different stakeholder groups to access only the information relevant to their role. Financial advisors may need accounting records, legal counsel may require contracts and corporate documents, and operational specialists may need process and supplier information. Version control helps prevent confusion about which file is current.
Indexing, search, and Q&A tools can also make the process more efficient. Buyers should be able to submit questions against specific documents, and sellers should be able to respond within a controlled record of the review process. Understanding virtual data room pricing can help teams budget for due diligence more accurately, especially where access needs, storage requirements, or deal timelines vary.
Virtual data room vs generic file sharing
If you are comparing virtual data rooms vs file sharing services, the practical difference is usually control. General-purpose tools can help with storage and collaboration, but they are often not designed for confidential deal workflows where permissions, auditability, and governance matter.
If you are evaluating the best virtual data room for a transaction, the most useful criteria are usually security controls, access management, usability, auditability, workflow support, and suitability for the sensitivity of the deal.
Audit trails and integration
Audit trails are important in due diligence because they create a record of document activity, including views, downloads, uploads, edits, and permission changes. This helps teams monitor access to sensitive information, investigate anomalies, demonstrate process discipline, and retain evidence of how documents were handled during the transaction.
Collaboration between solicitors, accountants, internal teams, and external advisors also requires controlled information sharing. Document version control becomes more important when multiple firms are reviewing different aspects of the same transaction at the same time.
Integrations can improve efficiency when they support secure workflows across document storage, e-signature, productivity tools, and collaboration systems. In practice, the priority should be control and traceability rather than convenience alone.
Choosing infrastructure for due diligence
The quality of due diligence depends not only on the checklist, but also on the infrastructure used to manage sensitive information. For most transactions, the core requirements are secure file sharing, clear permission controls, structured document governance, searchable records, Q&A management, and reliable audit trails.
When evaluating an M&A workspace, buyers and sellers should compare security controls, access management, usability, auditability, compliance posture, and support for transaction workflows. The right choice depends on deal complexity, data sensitivity, user volume, and regulatory requirements.
If your process requires a dedicated M&A data room solution, this is the point where a provider-specific section can sit naturally without weakening the educational value of the article. Some teams may also be reviewing broader needs such as paperless document management or wider cloud collaboration for enterprise requirements alongside transaction-specific tools.
How to organise due diligence documents in a virtual data room
Due diligence involves sensitive documents such as financial statements, contracts, employee records, tax files, customer information, supplier agreements, IP records, and compliance evidence. Sharing these through email or generic file-sharing tools can create issues with version control, permissions, audit trails, and data security.
A virtual data room helps buyers, sellers, and advisors manage due diligence documents in one secure workspace. It allows teams to control access, organise files by checklist category, manage Q&A, and track document activity throughout the transaction.
A practical due diligence data room should include:
- Folder structures that mirror the due diligence checklist
- Granular permissions for buyers, sellers, lawyers, accountants, and advisors
- Secure document upload, storage, and sharing
- Version control and full-text search
- Watermarking and download controls
- Q&A tools for buyer questions and seller responses
- Audit trails showing who viewed, downloaded, or updated documents
For M&A transactions, this makes the review process faster, more organised, and easier to control without relying on scattered email threads or unsecured links.
Document governance checklist for due diligence
A practical document governance process should:
- Define a folder taxonomy aligned to the diligence workstreams
- Apply role-based permission controls before documents are uploaded
- Restrict download, print, and resharing rights for the most sensitive files
- Keep one current version of each core document
- Record Q&A against the relevant document where possible
- Review access logs regularly
- Archive final diligence records and disclosures for post-deal reference
Document governance matters because due diligence is not only about document collection. It is also about controlling access, preserving context, and maintaining a reliable record of how information was reviewed and shared.
FAQs
What is included in a due diligence checklist?
A due diligence checklist usually includes financial records, tax documents, corporate filings, contracts, employee information, customer and supplier agreements, IT systems, cybersecurity policies, intellectual property records, litigation history, insurance documents, and compliance evidence.
Who prepares the due diligence checklist?
A due diligence checklist is usually prepared by the buyer, investor, lawyer, accountant, M&A advisor, or internal deal team. Sellers may also prepare one before going to market to organise documents and reduce delays during buyer review.
What is the difference between due diligence and a due diligence checklist?
Due diligence is the full investigation of a business before a transaction, investment, or acquisition. A due diligence checklist is the structured list of documents, questions, and review areas used to guide that investigation.
What are the main types of due diligence?
The main types of due diligence include financial, legal, commercial, operational, HR, IT and cybersecurity, tax, regulatory, and intellectual property due diligence. M&A transactions often involve several of these reviews at the same time.
How long does due diligence take?
Due diligence usually takes 30 to 90 days, depending on the size, complexity, and risk level of the transaction. Smaller deals may move faster, while regulated businesses, cross-border transactions, or complex ownership structures often require more time.
What are common due diligence red flags?
Common due diligence red flags include missing financial records, unpaid tax, weak contracts, customer concentration, pending litigation, employee disputes, cybersecurity gaps, unclear IP ownership, supplier dependency, unsupported software, and poor audit trails.
What documents should be reviewed first in due diligence?
Start with the documents most likely to affect value, legal exposure, and deal certainty. In most transactions, the first review set includes historical financial statements, management accounts, debt and tax records, corporate documents, material customer and supplier contracts, litigation history, key employee arrangements, cybersecurity policies, and any licences or permits required to operate.
What is a due diligence data room?
A due diligence data room is a secure digital workspace used to store and review confidential transaction documents. In M&A, buyers, sellers, lawyers, accountants, and advisors use it to organise files, control access, track document activity, and manage questions during the review process. Learn more in our guide to what a virtual data room is and how it’s used.
How should due diligence documents be organised?
Due diligence documents should be organised by category, such as financial records, legal documents, contracts, tax, HR, commercial information, operations, IT, cybersecurity, intellectual property, insurance, and Q&A. In M&A, these folders are usually managed in a secure virtual data room.
Why use a virtual data room for due diligence?
A virtual data room is used in due diligence because it provides more control than email or generic file-sharing tools. Its main advantages are granular permission controls, document governance, audit trails, version control, structured indexing, and secure collaboration across multiple review parties.
What is the difference between a data room and secure file sharing for M&A?
A data room is purpose-built for confidential transaction workflows, while secure file sharing is usually designed for broader document access and collaboration. In M&A, the main differences are typically granular permissions, audit trails, Q&A workflows, watermarking, and stronger document governance.
What happens if due diligence finds problems?
If due diligence finds problems, the buyer may request more information, renegotiate the price, ask for warranties or indemnities, adjust the deal structure, delay completion, or decide not to proceed. The outcome depends on the seriousness of the issue and whether the risk can be managed.
Can due diligence findings affect the final deal price?
Yes. Due diligence findings can affect valuation if they reveal hidden liabilities, overstated revenue, weak contracts, customer concentration, compliance risks, employee obligations, or unresolved disputes. Buyers may use these findings to renegotiate price or request additional protections.
Disclaimer
The information provided is for general informational purposes only and does not constitute legal advice. You should consult a qualified lawyer or other appropriate professional before making decisions based on this information.
Related Reading
- What is a virtual data room?
- M&A Data Room: Checklist, Structure & Best Practices
- Compare virtual data room pricing across leading providers
- What is a client portal? Complete guide
