M&A Due Diligence
M&A Intelligence · Verification Layer
How buyers verify what they're actually acquiring — financial, legal, commercial, technology, and cybersecurity diligence, and how findings change deal terms.
M&A Due Diligence is the buyer's investigation into a target company before closing — testing whether the business is what it appears to be, and surfacing risks that valuation alone would miss.
Diligence rarely kills a well-motivated deal outright. More often, its findings reshape the price, the indemnities, the escrow, and the closing conditions — which is why the process matters as much to the eventual deal terms as it does to the buyer's go/no-go decision.
1. Due Diligence Overview
Due diligence typically runs in parallel workstreams after a letter of intent is signed and before the definitive agreement is finalized, giving the buyer access to a data room of the target's financial, legal, operational, and technical records. Each workstream reports findings back to the deal team, who decide whether an issue is a pricing matter, a contractual protection matter, or — rarely — a reason to walk away.
The CODEW Lens: Diligence findings are inputs to negotiation, not a pass/fail test — most issues get priced or papered over, not fixed.
2. Financial Due Diligence
Financial diligence verifies the numbers behind the valuation — historical revenue and margin trends, working capital, debt-like items, and off-balance-sheet obligations. Its centerpiece is usually a quality of earnings (QoE) report, which adjusts reported EBITDA for one-off items, accounting policy choices, and non-recurring revenue to establish a normalized earnings base the price is actually built on.
Financial diligence also sets the target working capital figure used in post-closing purchase price adjustments, making it directly load-bearing for the mechanics of the deal terms, not just a check on historical accuracy.
3. Legal Due Diligence
Legal diligence reviews corporate structure and title to assets, material contracts (including change-of-control clauses that may be triggered by the deal itself), pending or threatened litigation, employment and benefits arrangements, and regulatory compliance. It is the primary source for drafting the representations and warranties in the definitive agreement.
Change-of-control provisions buried in customer or supplier contracts are a particularly common surprise — a key contract that terminates automatically on acquisition can materially change what the buyer is actually getting, even when every other number checks out.
4. Commercial Due Diligence
Commercial diligence tests whether the target's market position is as durable as the growth story suggests — market size and growth, competitive positioning, pricing power, and customer concentration. A business reliant on a small number of large customers, or facing a structurally shrinking market, carries risk that financial diligence alone would not surface.
5. Customer & Market Analysis
Customer analysis goes deeper than commercial diligence's market-level view, examining cohort retention, churn, contract terms, and renewal timing at the individual account level. Buyers pay close attention to revenue concentration — how much of total revenue sits with the top five or ten accounts — since losing even one or two key customers post-close can undermine the deal's underlying economics.
6. Technology Due Diligence
Technology diligence assesses the target's systems architecture, technical debt, IP ownership (including whether code was properly assigned by contractors and employees), and how easily systems can be integrated with — or replaced by — the buyer's own stack. For technology-driven targets, this workstream can be as central to the deal thesis as financial diligence.
7. Cybersecurity & Data Risk
Cybersecurity diligence has become a standalone workstream rather than a subset of technology diligence, covering prior breach history, data governance and privacy compliance, and the security posture of systems the buyer will inherit. An undisclosed prior breach, or data handling practices that don't meet the buyer's regulatory obligations, can surface as a significant post-closing liability if missed.
8. How Findings Change Deal Terms
A diligence finding rarely stays abstract — it typically resolves into one of a few concrete outcomes: a lower purchase price, a specific indemnity carved out for that risk, a larger or longer escrow, a price adjustment mechanism, or, for genuinely serious issues, a walk-away. Representation and warranty insurance has become a common way to shift some of this residual risk from the seller to a third-party insurer, smoothing negotiations over historical liabilities uncovered in diligence.
The CODEW Lens: The size of the escrow and the specificity of the indemnities in a deal are often a more honest signal of diligence findings than anything said publicly about the process.
9. Key Diligence Terms Explained
| Term | What it means |
|---|---|
| Data room | Secure repository of target documents shared for diligence |
| Quality of earnings (QoE) | Adjusted, normalized EBITDA used as the real basis for price |
| Change-of-control clause | Contract term triggered when ownership of a party changes |
| Revenue concentration | Share of revenue tied to a small number of key customers |
| R&W insurance | Insurance shifting breach-of-warranty risk to a third-party insurer |
| Red flag | A diligence finding serious enough to affect price, terms, or the go/no-go decision |
Position in M&A Intelligence
M&A Intelligence
→ M&A Guide — How does M&A actually work?
→ M&A Deal Tracker — What deals are happening?
→ M&A Market Intelligence — What is happening across the market?
→ M&A Target Intelligence — Who could be acquired and why?
→ M&A Buyer Intelligence — Who is buying and with what strategy?
→ M&A Valuation Intelligence — How are deals priced?
→ M&A Deal Terms — How are deals structured?
→ M&A Due Diligence — How is the target verified? ← You are here
FAQ
Q: How long does due diligence usually take?
For a mid-sized private deal, four to eight weeks is common; larger or more complex targets, or deals with multiple international entities, can take considerably longer.
Q: Does a diligence red flag usually kill a deal?
Rarely on its own. Most findings are resolved through price adjustment, a specific indemnity, or a larger escrow rather than termination — deals fail more often over valuation disagreement or financing than diligence findings alone.
Q: What is a quality of earnings report?
An independent adjustment of the target's reported EBITDA to remove one-off and non-recurring items, producing the normalized earnings figure the purchase price is typically built on.
The CODEW Takeaway
Due diligence is the verification layer between an agreed valuation and a signed contract. Financial, legal, commercial, technology, and cybersecurity workstreams each test a different assumption behind the price — and what they find rarely kills a deal outright so much as it reshapes the price, the indemnities, and the escrow that follow.
The CODEW Lens: Read the deal terms, not the diligence process, to find out what diligence actually turned up.
Related in M&A Intelligence
• M&A Intelligence (hub)
• M&A Guide
• M&A Deal Tracker
• M&A Target Intelligence
• M&A Buyer Intelligence
• M&A Valuation Intelligence
• M&A Deal Terms
The CODEW Stat
M&A Due Diligence How buyers verify a target before closing — financial, legal, commercial, technology, and cybersecurity diligence.
No comments: