Buying or selling a business is one of the biggest decisions a company will ever make. There is a lot of money on the table, a lot of people involved, and a lot that can go wrong. That is exactly why due diligence exists.
Due diligence is the process of checking everything before you commit. It is how buyers make sure they are not walking into a mess, and how sellers make sure they are presenting their business in the best and most accurate light. Done well, it protects both sides of the deal.
But here is the truth: most due diligence processes are slow, messy, and stressful, not because the work is impossible, but because teams are working without the right tools or structure.
This guide covers everything you need to know about due diligence in M&A. From what it means and why it matters, to the exact documents you need, the questions that come up, and how to run the whole process cleanly from start to finish.
What is due diligence?
Due diligence, in the context of mergers and acquisitions, is the process of thoroughly investigating a target company before completing a deal. Think of it as doing your homework before making a big purchase.
When a buyer is considering acquiring a business, they need to know what they are actually getting. What does the company own? What does it owe? Are there any hidden legal problems? Is the financial data accurate? Are key employees likely to stay after the acquisition? These are not small questions. They can change the value of a deal entirely.
Due diligence is the systematic process of answering all of these questions. It involves reviewing documents, asking questions, verifying claims, and building a complete picture of the target company.
The process usually happens after a letter of intent (LOI) has been signed but before the final purchase agreement is executed. The buyer gets access to the seller's confidential information, reviews it carefully, and decides whether to move forward, renegotiate, or walk away.
Due diligence can cover a wide range of areas: financials, legal, tax, operations, HR, IT, intellectual property, regulatory compliance, and more. The scope depends on the size and complexity of the deal.
Why due diligence is important
Skipping due diligence, or doing it poorly, is one of the most expensive mistakes a company can make in an acquisition.
Here is why it matters:
It uncovers hidden risks. A company might look great on the surface but have significant undisclosed liabilities, pending lawsuits, or tax issues that completely change its value. Due diligence surfaces these problems before the deal closes.
It confirms the valuation. The buyer is making an offer based on what they believe the company is worth. Due diligence confirms whether that belief is accurate. If the numbers do not add up, the buyer can renegotiate the price.
It protects both parties. Sellers benefit from due diligence too. A clean, well-organized due diligence process builds trust with buyers and can actually speed up deal closure. It also protects sellers from post-deal disputes about information they supposedly "hid."
It informs integration planning. Even if the deal proceeds, due diligence gives the buyer a detailed understanding of the company they are acquiring. This information is invaluable when planning how to integrate the two businesses after close.
It satisfies legal and regulatory requirements. In many jurisdictions and industries, there are legal obligations around what must be disclosed and verified during an acquisition. Proper due diligence helps both sides stay compliant.
In short, due diligence is not just a formality. It is the foundation of a smart, sound acquisition.
Preparing for due diligence
Good due diligence does not start the day a data room is opened. It starts well before that, with proper preparation on both sides.
For sellers, preparation means getting organized. Before any buyer starts reviewing documents, the seller should have a complete, clean picture of their own business. This means gathering all key documents, making sure financial records are up to date, identifying any issues that might come up, and deciding how to handle them proactively.
Here is a simple preparation checklist for sellers:
- Compile the last 3-5 years of audited financial statements
- Make sure corporate records (articles of incorporation, board resolutions, cap table) are current and accurate
- Identify any pending or ongoing litigation and prepare clear documentation
- Organize all contracts (customer, vendor, employee, leases)
- Review IP ownership, especially if any work was done by contractors
- Check regulatory and compliance status across all jurisdictions the company operates in
For buyers, preparation means defining scope. Not every deal needs the same level of scrutiny. A small acquisition in a straightforward industry needs a different approach than a large cross-border deal in a heavily regulated sector. Buyers should define which areas are highest priority, who on the team is responsible for each workstream, and what the timeline looks like.
Both sides should also agree on the process before it starts. Who has access to what documents? What format will requests come in? Who is the point of contact on each side? These logistics matter more than people think.
And both sides need a secure place to share documents. This is where a virtual data room becomes essential.
Typical questions that arise in M&A due diligence
When a buyer starts reviewing a target company, certain questions almost always come up. Knowing what to expect helps both sides prepare more effectively.
Here are the most common areas where questions arise:
Financial questions:
- Are the revenue numbers real and sustainable? What is the revenue recognition policy?
- What does the working capital position look like?
- Are there any off-balance-sheet liabilities?
- What is the quality of earnings? Are one-time items inflating profitability?
- What is the cash flow situation, and how consistent has it been?
Legal questions:
- Is there any pending or threatened litigation?
- Are all contracts properly signed and enforceable?
- Are there any change-of-control clauses in key contracts that could be triggered by the acquisition?
- Is all intellectual property owned outright, or is any of it licensed?
- Are there any regulatory violations or investigations in progress?
HR and people questions:
- Who are the key people, and are they staying after the acquisition?
- Are there any employment disputes or HR issues?
- What does the compensation structure look like, and are there any golden parachute arrangements?
- Are employment contracts and non-competes in place for key executives?
Operational questions:
- How dependent is the business on a small number of customers or suppliers?
- What are the key risks in the supply chain?
- Are IT systems scalable and secure?
- Are there any significant customer concentration risks?
Tax questions:
- Are there any open tax audits or disputes?
- Are there any deferred tax liabilities?
- What is the tax structure of the deal, and what are the implications?
These questions are not exhaustive, but they represent the core concerns that come up in almost every deal.
M&A due diligence checklist
A due diligence checklist is the structured list of information and documents a buyer requests from a seller. Having a clear checklist keeps the process organized, makes sure nothing is missed, and gives the seller a clear roadmap of what to prepare.
Here is a comprehensive M&A due diligence checklist organized by category:
Corporate and organizational
- Certificate of incorporation and bylaws
- Cap table and ownership structure
- Board meeting minutes (last 3-5 years)
- Shareholder agreements
- Subsidiary structure and related documentation
Financial
- Audited financial statements (3-5 years)
- Most recent management accounts
- Budget and financial forecasts
- Bank statements and credit facilities
- Accounts receivable and payable aging reports
- Debt schedule and repayment terms
Legal and regulatory
- All material contracts (with customers, vendors, partners)
- Employment and consulting agreements
- Licenses, permits, and regulatory approvals
- Any litigation, disputes, or legal proceedings
- Environmental compliance records
Intellectual property
- Patent, trademark, and copyright registrations
- IP ownership documentation, including assignments from employees and contractors
- Software licenses
- Trade secrets and confidentiality agreements
HR and employees
- Organizational chart
- Key employee contracts and compensation details
- Benefits plans and obligations
- Any ongoing HR disputes or claims
Tax
- Filed tax returns (3-5 years)
- Records of any tax audits or disputes
- Tax compliance certifications
IT and technology
- IT infrastructure overview
- Cybersecurity policies and incident history
- Data privacy compliance (GDPR, etc.)
- Key software systems and licenses
Commercial
- Top customer and supplier contracts
- Customer concentration analysis
- Sales pipeline data
- Marketing and go-to-market overview
This checklist gives you the framework. The exact scope will vary depending on the deal.
What documents are required
While the checklist above covers categories, it helps to understand which specific documents carry the most weight in a typical due diligence process.
The most critical documents in M&A due diligence are:
- Audited financial statements - These are the foundation. Three to five years of audited accounts give the buyer a reliable, independently verified picture of the company's financial health.
- Material contracts - Any agreement that significantly affects the business. This includes top customer contracts, key vendor agreements, partnership arrangements, and lease agreements.
- Corporate records - Cap table, shareholder agreements, board resolutions, and any documentation that shows who owns what and who can make what decisions.
- IP ownership records - Particularly important for tech companies or any business where intellectual property is a core asset.
- Employment agreements for key personnel - The buyer wants to know whether the people who make the business work will still be there after the deal closes.
- Regulatory licenses and permits - Depending on the industry, these can be critical to the ability to operate.
- Tax returns and records - To verify the company's tax history and identify any outstanding obligations.
- Litigation records - Any current or potential legal disputes that could become the buyer's problem after close.
How you store and share these documents matters a lot. Emailing PDFs back and forth, using shared Google Drive folders with inconsistent permissions, or managing requests over email chains is a recipe for chaos. This is why serious M&A transactions use a virtual data room.
The specifics of legal due diligence
Legal due diligence deserves special attention because it is one of the most complex, and most consequential, parts of the entire process.
The goal of legal due diligence is to identify any legal risks that could affect the deal, change the valuation, or create future liability for the buyer. It is typically led by legal counsel on both sides, but deal teams need to understand what is being reviewed and why.
Key areas in legal due diligence include:
Corporate structure and governance. Who actually owns the company? Is the ownership structure clean and well-documented? Are there any unusual shareholder rights, drag-along or tag-along provisions, or pre-emption rights that could complicate the transaction?
Contracts and commitments. Does the company have any contracts with change-of-control clauses? These are provisions that allow the other party to terminate or renegotiate when ownership changes hands. If a major customer contract has one of these, it could significantly affect deal value.
Employment law. Are all employees properly classified? Are there any pending employment claims? For international companies, are there local law requirements around employee consultation or consent for the transaction?
Intellectual property. Is the company's IP clearly owned by the company, and not by a founder personally, a past employee, or a contractor? IP disputes discovered after a deal closes can be extremely costly.
Data privacy and compliance. Particularly for companies that handle customer data, legal due diligence will review privacy policies, data processing agreements, and whether the company is compliant with applicable data protection laws.
Litigation and disputes. Any current or threatened legal claims need to be understood. Some disputes are minor and routine. Others could represent material liabilities that need to be reflected in the deal price or structure.
Regulatory approvals. Depending on the deal size and industry, some acquisitions require regulatory approval, for example from competition authorities. Legal due diligence will map out what approvals are needed and what the timeline looks like.
Legal due diligence is thorough, detailed work. Having all relevant documents organized and accessible from the start saves enormous amounts of time and back-and-forth.
Conducting sell-side due diligence
Sell-side due diligence is when the seller prepares for and manages the review process. Rather than waiting for buyers to come in and start asking questions, a well-prepared seller gets ahead of the process.
Why sell-side preparation matters:
A seller who is disorganized during due diligence sends a bad signal to buyers. It raises questions about how well the business is actually run. It also slows everything down, which can introduce deal fatigue and give buyers more opportunities to find reasons to renegotiate.
On the other hand, a seller with clean records, organized documents, and fast responses to requests builds credibility and confidence. It can actually accelerate a deal to close.
Steps for effective sell-side due diligence:
- Conduct an internal audit before going to market. Review your own documents, financials, contracts, and compliance records before any buyer does. Identify the gaps and issues, and deal with them on your own timeline rather than under buyer scrutiny.
- Prepare a data room in advance. Organize all documents in a clean, logical structure before giving any buyer access. Categorize documents the way buyers will expect: financials, legal, HR, operations, IP, etc.
- Set up NDA gating. Before any buyer gets access to sensitive information, they should have signed a non-disclosure agreement. A good virtual data room handles this automatically.
- Control access carefully. Not every potential buyer needs to see everything at the same time. You can give preliminary access to a smaller document set for early-stage conversations and expand access as the deal progresses.
- Track engagement. Knowing which documents a buyer is looking at, and for how long, gives you valuable insight into where their concerns are and how serious they are about the deal.
Conducting buy-side due diligence
Buy-side due diligence is the buyer's investigation of the target company. This is where the buyer verifies the information the seller has provided and builds their own independent understanding of the business.
The buy-side team typically includes:
- M&A deal professionals or investment bankers managing the process
- Financial advisors reviewing accounts and projections
- Legal counsel reviewing contracts, corporate records, and compliance
- Tax advisors looking at the tax structure and history
- Technical or operational experts, especially for tech or specialized industry acquisitions
- HR professionals reviewing the people and compensation picture
How buy-side due diligence typically works:
- Request list. The buyer's team prepares a detailed due diligence request list (often called a DDL or IDR - information/document request). This is sent to the seller and forms the basis of what gets uploaded to the data room.
- Document review. The buyer's team systematically works through the documents, flagging questions, concerns, and items that need clarification.
- Q&A process. Most data room platforms allow buyers to submit questions directly within the platform. This keeps everything organized and gives both sides a clear record of what was asked and answered.
- Expert interviews. In some deals, the buyer will want to speak directly with the seller's management team, key customers, or other stakeholders. These conversations go beyond documents and give a more nuanced picture.
- Risk identification. The buy-side team compiles a list of risks and issues identified during the process. These may affect deal pricing, deal structure, the representations and warranties in the purchase agreement, or the decision to proceed at all.
The goal is not to find reasons to kill the deal. It is to make sure the buyer fully understands what they are buying and has no unpleasant surprises after close.
Virtual data rooms: the backbone of due diligence (and why Ellty is the right choice)
If due diligence is the brain of an M&A transaction, the virtual data room (VDR) is the spine. It is where everything happens, where documents are stored, shared, reviewed, and tracked.
For a long time, VDRs were expensive, complicated, and built for large investment banks running multi-billion-dollar deals. Smaller companies, startups, and growing businesses were left choosing between insecure shared drives and paying thousands of dollars a month for tools they only needed 10% of.
Ellty was built to change that.
What a virtual data room actually needs to do:
- Store and organize large numbers of documents in a structured, searchable way
- Control who can access which documents and what they can do with them (view only, download, print)
- Gate access behind NDAs so no one sees sensitive information without signing first
- Track exactly who viewed what, and when, giving both sides a clean audit trail
- Prevent unauthorized distribution of documents through watermarking and access restrictions
- Keep all Q&A and communication within the platform, so nothing falls through email cracks
What Ellty gives you:
Ellty is a secure document sharing and analytics platform with full VDR functionality. It is built for any deal team that needs to share sensitive documents in a controlled, trackable way.
Whether you are raising a funding round, closing a property transaction, running a consulting engagement, or managing a full acquisition, Ellty gives you the tools that actually matter.
Here is what each plan looks like:
- Free ($0/month): Document tracking, real-time analytics, and secure sharing. A solid starting point for early conversations when you want to see who is opening what.
- Standard ($69/month): Unlimited documents, advanced analytics, eSignatures, custom branding, and full data room features. Works well for smaller deals and ongoing investor or client communication.
- Room ($149/month): Granular permissions, NDA gating, dynamic watermarking, and restricted visitor access. Everything you need to run a controlled due diligence process.
- Room Plus ($349/month): Group visitor permissions, full audit logs, and support for up to 4,000 assets per data room. Built for heavier document loads and multi-party deals.
Where Ellty stands apart:
The biggest frustration with legacy VDR platforms is the pricing model. Per-user fees, per-page fees, custom enterprise quotes that take weeks to negotiate. The result is that by the time you have set up your data room, you have spent a significant amount of money and time on the container, not the work.
Ellty is flat-rate. You know exactly what you are paying. There are no per-user charges, no overage surprises, and no weeks-long procurement processes. You pick a plan, set up your data room, and get to work.
How to conduct a due diligence process effectively
Understanding what due diligence is and having all your documents ready is one thing. Running the actual process smoothly is another. Here is a practical approach to conducting due diligence effectively.
1. Start with a clear plan
Before anything is shared or reviewed, both sides should agree on the timeline, the scope, the format for document requests, and the communication channels. Ambiguity at the start creates confusion later.
2. Use a structured data room from day one
Do not start sharing documents via email or shared drives and migrate to a VDR later. Set up the data room before due diligence kicks off and use it as the single source of truth for the entire process.
3. Prioritize high-impact areas
Not all due diligence items are equally important. Identify the areas that are most likely to affect deal value or reveal material risks, and review those first. This might be financial statements, key customer contracts, or IP ownership depending on the business.
4. Maintain a clear Q&A log
Every question a buyer asks should be logged, tracked, and answered in a documented way. This creates accountability on both sides and prevents disputes later about what was disclosed.
5. Flag issues early
When problems are found, they should be surfaced and discussed promptly. Sitting on a significant finding and hoping it goes away is not a strategy. Issues identified early can often be addressed through deal structure, pricing adjustments, or specific representations in the purchase agreement.
6. Keep the right people in the loop
Due diligence involves a lot of moving parts and a lot of people. Make sure the right experts are reviewing the right materials. A financial advisor should not be trying to assess legal risk, and legal counsel should not be trying to do a financial quality of earnings analysis.
7. Document everything
The due diligence process itself needs to be well-documented. Keep records of what was requested, what was provided, what questions were asked, and what the answers were. This documentation is important if there are post-close disputes about what was known or disclosed.
Final due diligence report
At the end of the due diligence process, the buyer's team typically prepares a due diligence report. This is a formal document that summarizes findings, flags risks, and informs the final decision-making process.
What a due diligence report typically covers:
- Executive summary: A high-level overview of findings and key risk areas
- Financial findings: Summary of financial review, quality of earnings assessment, any anomalies or concerns
- Legal findings: Summary of legal review, flagged contracts, litigation, IP issues
- Tax findings: Summary of tax review, any outstanding obligations or risks
- Operational findings: Assessment of operations, technology, HR, and commercial position
- Risk summary: Consolidated list of material risks identified, categorized by severity
- Recommendations: Whether to proceed, renegotiate, or walk away, and what protections or adjustments to consider
The report is not just a paper exercise. It informs the final purchase price, the representations and warranties in the sale and purchase agreement, and any specific conditions that need to be satisfied before the deal closes.
In many deals, the due diligence report is also shared with advisors, investors, or board members who are not directly involved in the process but need to make an informed decision about approving the transaction.
Best practices for businesses
Whether you are a buyer or a seller, these practices will make your due diligence process smoother and more effective.
Organize before you are under pressure. The best time to get your corporate records, contracts, and financial documents in order is before you are in a deal process. Companies that maintain clean, organized records throughout the year have a massive advantage when due diligence starts.
Be transparent, not just compliant. The goal of due diligence is not to hide things and hope they do not get found. Sellers who proactively disclose known issues build far more trust with buyers than those who appear to be playing hide-and-seek. Transparency typically leads to smoother negotiations.
Use professional tools for a professional process. A due diligence process that runs on email chains and shared folders reflects poorly on your organization. A well-organized virtual data room shows buyers that you are serious and professionally run.
Set realistic timelines. Due diligence takes time. Trying to rush it, or setting unrealistic deadlines that pressure people to cut corners, leads to mistakes. Build in buffer time, especially for complex deals with multiple workstreams.
Get the right advisors involved early. Experienced M&A advisors, whether financial, legal, or operational, have seen hundreds of due diligence processes. Their pattern recognition is invaluable for identifying issues quickly and knowing what is normal versus what is a genuine red flag.
Review your own data room before buyers do. Before opening access to any buyer, have someone on your team do a walkthrough of the data room as if they were the buyer. Are all documents there? Are they organized logically? Are file names clear? This small step can prevent significant embarrassment.
Challenges in conducting due diligence
Even well-prepared deal teams run into challenges. Here are the most common ones and how to address them.
Volume of documents. Large deals can involve tens of thousands of documents. Managing that volume, making sure nothing gets missed, and keeping track of what has and has not been reviewed is genuinely difficult. Solution: use a structured data room with a clear folder hierarchy and a tracking system for review status.
Tight timelines. Deals often move faster than anyone expects, and due diligence teams can find themselves under enormous time pressure. Solution: prioritize ruthlessly and make sure the highest-risk areas get the most attention.
Incomplete or disorganized seller data. Sometimes sellers simply do not have their documents in order. Critical contracts are missing, financial records are incomplete, or historical data is unavailable. Solution: surface these gaps early and agree on a plan to address them.
Multiple bidders. In competitive auction processes, sellers may be running due diligence with multiple buyers simultaneously. Managing access, controlling information flow, and keeping track of who can see what is complex. Solution: a VDR with group-level permissions and detailed audit logs.
Cross-border complexity. International deals add layers of complexity: different legal systems, different accounting standards, different tax regimes, different employment laws. Solution: make sure your advisory team has genuine local expertise in every jurisdiction that matters.
Communication breakdown. With large deal teams spread across multiple organizations and time zones, miscommunication is a constant risk. Solution: keep all communication within the data room platform or a clearly designated channel. Avoid parallel email threads that create conflicting records.
FAQs
What is the typical timeline for M&A due diligence?
It varies significantly by deal size and complexity. A small acquisition might complete due diligence in 2-4 weeks. A mid-market deal might take 6-12 weeks. Large, complex, or cross-border transactions can take several months. The key driver is usually the availability and quality of seller documentation.
What is the difference between buy-side and sell-side due diligence?
Buy-side due diligence is the buyer's investigation of the target company. Sell-side due diligence is when the seller proactively reviews their own business and organizes their documents before a buyer comes in. Both are important for a smooth process.
Does the seller have to provide everything the buyer requests?
Not necessarily. Sellers can decline to provide certain information, particularly if it is commercially sensitive and the deal is still at an early stage. However, withholding material information can create legal liability after close and is generally not in the seller's interest.
What happens if problems are found during due diligence?
It depends on the severity. Minor issues might be noted in the purchase agreement's representations and warranties. More significant issues might lead to a price renegotiation. In some cases, a material finding might cause the buyer to walk away from the deal altogether.
Is due diligence always required in M&A?
There is no universal legal requirement to conduct due diligence in every M&A transaction, but it is strongly advisable in virtually every case. Failing to conduct proper due diligence can expose the buyer to significant financial and legal risk post-close.
What is a virtual data room and why is it used in due diligence?
A virtual data room (VDR) is a secure online platform for storing and sharing confidential documents. In due diligence, it is used to give buyers organized, controlled access to the seller's documents while maintaining security, tracking who views what, and keeping a full audit trail.
How does Ellty differ from traditional VDR platforms?
Ellty offers the same core VDR functionality as traditional platforms, including granular permissions, NDA gating, dynamic watermarking, and audit logs, but without per-user fees or complex enterprise pricing. Plans start at $0/month, and even the most advanced tier is $349/month with no surprise overages. It is designed for deal teams that want a professional, functional VDR without a lengthy procurement process.
Final thoughts
Due diligence is not the most glamorous part of an M&A transaction. It is not the moment when the deal is signed or the press release goes out. But it is, without question, the part of the process where deals are made or broken.
Companies that invest in doing due diligence well, on both the buy side and the sell side, consistently get better outcomes. They close faster, negotiate from a position of knowledge rather than uncertainty, and are far less likely to face painful post-close surprises.
The process does not have to be painful or expensive. With the right structure, the right team, and the right tools, due diligence can be a well-organized, clearly managed process that builds confidence on both sides.
Ellty was built for exactly this. Whether you are running your first acquisition or managing a complex multi-party deal, Ellty gives you a secure, professional data room without the enterprise price tag. From early-stage document sharing to full due diligence management, everything is on one platform, with transparent flat-rate pricing.
Start your due diligence process the right way. Create your free Ellty account and have your data room ready before your next deal conversation.
