Business Due Diligence: A Step-by-Step Guide for Company Acquisitions

What is due diligence and why does it determine the real price of an acquisition?

Due diligence is the structured investigation process any responsible buyer must conduct before closing a company acquisition. Far from being a legal formality, it is the only tool that confirms you are paying a fair price — or gives you grounds to renegotiate. Studies of M&A transactions in mid-market companies show that the majority of post-closing disputes involve liabilities that a rigorous due diligence process would have surfaced before signing.

In practice, due diligence means weeks of coordinated work by specialist teams — lawyers, financial auditors, tax advisors and sector consultants — scrutinising every corner of the business: contracts, accounts, employees, customers and regulatory risks. The output shapes not just the price but the entire deal structure: warranties, indemnities, escrow arrangements and earnout provisions.

This step-by-step guide covers the five phases of due diligence for company acquisitions, with particular focus on the areas where buyers most commonly miss hidden value destroyers.

Step 1: Setting up the data room before due diligence begins

Before the buyer's team analyses anything, the seller must organise all relevant documentation into a virtual data room (VDR). Leading platforms include Intralinks, Datasite and Ansarada, though smaller transactions often use SharePoint or Google Drive with restricted permissions.

Minimum documentation for the data room

• Articles of incorporation, bylaws and board minutes for the past three years
• Audited annual accounts for the past three years and current-year management accounts
• Key commercial contracts: customers, suppliers, distributors, and lease agreements
• Employee records: applicable collective agreement, headcount, payroll, and any union agreements
• Tax compliance: VAT returns, corporate tax, withholdings and any open inspection procedures
• Licences, permits and regulatory approvals relevant to the sector
• Intellectual and industrial property: trademarks, patents, bespoke software
• Insurance policies and outstanding claims

A seller who restricts access to the data room without clear justification is itself a warning signal worth taking seriously.

Legal due diligence: the contracts that define deal viability

Legal due diligence examines the legal validity of the company and the robustness of its contractual relationships. The goal is to identify contingencies that could become liabilities after closing or restrict the buyer's ability to operate the business normally.

Key areas of the legal audit

1. Corporate structure: Confirming that the shares or participations being transferred are exactly those the seller represents, free of encumbrances, liens or third-party pre-emption rights.
2. Customer and supplier contracts: Change of control clauses that allow counterparties to terminate if ownership changes. This is critical in businesses with one or two major customers.
3. Litigation and proceedings: Pending claims, labour authority investigations, competition regulator proceedings, or data protection complaints. Each open matter is quantified as a contingency.
4. Intellectual property: Confirming that trademarks are registered in the company's name (not the founder's personally), that key software is company-owned, and that no third-party licences carry restrictive conditions.
5. Real estate and leases: Duration and renewal options of leases, assignment conditions, and any landlord consent required on a change of control.

Legal findings are classified by probability of crystallisation and economic impact. A probable, quantifiable contingency typically results in a price escrow or a direct reduction of enterprise value.

Financial due diligence: the numbers that never appear in the accounts

Financial due diligence is the core of any M&A process. It goes far beyond reviewing audited accounts: the goal is to determine normalised EBITDA, identify hidden net debt, and stress-test the seller's projections.

Normalised EBITDA: the figure that drives the multiple

The EBITDA in the statutory accounts rarely reflects the true recurring earnings of the business. The financial auditor must identify and strip out extraordinary items, owner expenses run through the company (personal insurance, vehicles, family holidays), compensation paid to relatives with no real function, and related-party transactions priced at non-market rates. In owner-managed businesses, normalised EBITDA can be materially different from the reported figure.

Net debt and working capital

M&A pricing is usually anchored to enterprise value, then adjusted for net debt and normalised working capital at closing. Financial due diligence must:

• Identify all financial debt: bank loans, finance leases, shareholder loans and deferred payment obligations
• Surface hidden liabilities: overdue payables, outstanding litigation provisions, pension commitments
• Establish the normalised working capital level so the buyer does not find an undercapitalised business on day one

Quality of earnings and revenue recurrence

Not all revenue is equal. A company that billed strongly in a prior year thanks to a one-off contract that will not renew presents low quality of earnings. Financial due diligence disaggregates revenue by customer, product and recurring versus non-recurring nature.

Tax and employment due diligence: the hidden liabilities that reshape price

Tax due diligence covers the open inspection risk across all statute-of-limitations periods. A buyer acquiring the shares of a company inherits all pre-closing tax liabilities, making this area a frequent source of post-closing disputes.

Critical points in the tax audit

• Review of corporate tax returns for the open years and analysis of deductions that could be challenged
• Related-party transactions between the company and its shareholders or family members, which must be priced at arm's length
• VAT: correct rate application, input tax deductions, and compliance with electronic reporting obligations
• Payroll taxes and social contributions: confirming all workers are properly registered and that no undeclared benefit-in-kind arrangements exist

Employment due diligence focuses on the workforce: potential unfair dismissal claims, verbal arrangements that differ from written contracts, redundancy obligations and collective agreement compliance.

Operational and commercial due diligence: the value that never appears on the balance sheet

The most important assets of many businesses are invisible on the balance sheet: recurring customer relationships, management talent, brand positioning and operational processes. Operational due diligence evaluates exactly these.

Customer base analysis

A business where 50% of revenue comes from one customer is more fragile than its accounts suggest. The buyer must analyse customer concentration, average relationship tenure, the split between contracted and informal arrangements, and historical churn rates.

Founder dependency risk

In many owner-managed businesses, the owner is the lead salesperson, the technical expert and the person with whom clients have a personal relationship. An abrupt departure after closing can trigger customer attrition that destroys a significant portion of the value paid. Operational due diligence must quantify this risk; if it is high, transition service agreements or earnout structures tied to retention become essential.

Acting on findings: price adjustments, warranties and indemnities

Due diligence findings rarely kill a transaction. What they do is recalibrate it. The final report is structured into deal-breaker findings, quantifiable contingencies (retained in price or escrow) and lower-impact observations captured in the representations and warranties of the purchase agreement.

• Price adjustment: Each probable, quantifiable contingency is deducted from the price agreed in the letter of intent. A potential tax liability not included in disclosed net debt reduces the consideration or is placed in escrow.
• Representations and warranties: The seller declares, under liability, that all information provided in the data room is accurate and complete. If an undisclosed liability surfaces post-closing, the buyer can claim indemnification.
• W&I insurance: Warranty and indemnity insurance is now common in mid-market transactions. It covers the buyer against undetected contingencies that the seller cannot or will not indemnify.

The most common due diligence mistakes buyers make

1. Cutting corners on advisor fees: A thorough due diligence on a mid-size business requires experienced professionals. Buyers who try to halve the advisory budget typically pay for it in post-closing surprises.
2. Accepting unrealistic timelines: Four weeks is the minimum reasonable timeline for a focused due diligence. Buyers who accept ten-day timelines under seller pressure access the deal with incomplete information.
3. Not reading customer contracts: Many buyers focus entirely on the accounts and never open the key customer agreements. Change of control clauses can halve the value of the business on the first day of ownership.
4. Overlooking intangible assets: Trademarks, software licences, web domains and customer databases must be owned by the company. Founders who hold these assets personally create a serious structural problem.
5. Relying on the seller's auditor: The audit firm that signed the accounts works for the seller. Buyers must engage their own independent financial and legal advisors.

Frequently asked questions about due diligence in company acquisitions

How long does due diligence take?

For a mid-market company, typically four to eight weeks from data room opening. Complex transactions involving regulated businesses or multiple jurisdictions can extend to three months.

Who pays for due diligence?

The buyer covers the cost of their own advisors. The seller bears the cost of preparing and maintaining the data room. In some cases, if the process breaks down due to seller fault, an expense reimbursement mechanism can be agreed in the letter of intent.

Can the seller refuse to provide information?

Technically yes — but it is a serious warning sign. The buyer can make signing of the purchase agreement conditional on delivery of specific documentation under confidentiality agreement. A seller who refuses access to tax returns or key customer contracts is likely concealing a problem.

What happens if something serious surfaces during due diligence?

It depends on the severity. A quantifiable finding leads to a price adjustment. A finding that affects business viability — fraud, criminal proceedings, undisclosed critical customer concentration — can be legitimate grounds for walking away without penalty under the exclusivity or LOI terms.

Is due diligence legally required?

There is no legal obligation, but any responsible M&A advisor will always recommend it. Skipping it is like buying a property without a structural survey: possible, but imprudent.