Due diligence is how you turn a target into a defended valuation. The goal is not to gather every document ever created: it is to confirm or destroy the thesis behind the deal. This is the step-by-step method we use. The test of good diligence is simple: after it is done, you can say exactly why the price is right or wrong.
Step 1: Write the deal thesis down first
Before requesting a single document, write the thesis: why this deal creates value, and where the value comes from. It might be cost synergies from combining two sales forces, or cross-selling your products into the target's customer base, or the target's technology opening a new market. Every workstream then exists to prove or disprove one part of that thesis. Diligence without a thesis just produces a pile of data and no decision. If you cannot write the thesis in two sentences, stop and work that out before you spend a single hour in a data room.
Step 2: Define the workstreams
Break the diligence into workstreams: financial, commercial, operational, legal, and tax. For each, name the focus, the key questions it must answer, the data required, and the red flags that would make you walk away. In a mid-market deal with a 6-week timeline, a typical split might be financial and commercial run as the two heavy workstreams, operational as the third, and legal and tax handled by advisers in parallel. Agree who owns each workstream before day one, not during week two.
Step 3: Financial diligence: verify the quality of earnings
The core of financial diligence is quality of earnings: are the reported profits real and repeatable? Normalise one-off items, adjust for aggressive revenue recognition, and stress the working capital position. The adjusted EBITDA, not the reported one, is the basis for the valuation.
Work through a concrete example. The target reports EBITDA of US$6.2 million. Adjustments change the picture:
- A US$400,000 one-off gain from selling a warehouse is stripped out.
- US$800,000 of capitalized R&D is reversed into an operating expense.
- The founder's US$600,000 salary is added back as a replacement-cost normalisation, but only US$350,000 is realistic for a hired CFO, so US$250,000 stays as a drag.
- Working capital now absorbs US$1.1 million more cash than the historical average, so the deal price is adjusted down by that amount.
Adjusted EBITDA lands near US$5.6 million, roughly 10% below the reported number. That difference is exactly what this workstream exists to find. If you priced the deal on reported EBITDA, you paid a 10% premium for a number that was not real. Ask the same question about every line: is this profit, one-off, or ordinary operating cash flow?
Step 4: Commercial diligence: prove the market position
Does the company's position in the market hold up? Test customer concentration, contract durability, pricing power, and the competitive response. A target with 40% of revenue in one customer is a concentration risk, not a strength. Check the renewal history, the average contract length, and what happened the last time prices were raised by more than 5%. A useful threshold: if the top five customers account for more than half of revenue, the commercial case depends on a handful of relationships surviving the change of ownership, and the purchase agreement should carry a retention mechanism.
Step 5: Operational diligence: check the assets and the team
Verify the operational reality: the physical assets, the systems, the key people, and the cost structure. Post-acquisition value usually depends on whether operations can run as assumed. A thin management team is often the hidden deal-breaker. If two of the four senior leaders are founders in their late fifties with no succession plan, the target has a key-person problem that no spreadsheet will show. Walk the facility, check the equipment age and the maintenance backlog, and confirm the capacity assumptions in the operational plan. Operating in a facility at 95% of rated capacity looks fine until you map the growth plan onto it.
Step 6: Run the information request process tightly
Issue a prioritised information request list and track it. The critical requests, financials, customer contracts, and legal exposure, get chased aggressively; the nice-to-haves wait. A data room that moves slowly is itself a signal. Set the rule on day one: every request has a requested date, an owner, and a status. If the target cannot produce the last three years of management accounts within two weeks, that is a finding in itself, and it should go straight into the diligence report rather than being quietly absorbed.
Step 7: Build a red-flag and deal-break list
Agree in advance what would break the deal: material undisclosed liabilities, customer concentration beyond a threshold, key-person dependency, unresolved litigation. Writing the thresholds down early makes the decision objective when the diligence turns up a problem. For example:
- Deal-breakers: undisclosed liabilities above 5% of the purchase price, loss of a customer worth more than 15% of revenue, litigation that could realistically reach US$2 million.
- Repricing triggers: adjusted EBITDA more than 8% below the initial estimate, working capital shortfall above US$1 million.
- Warranty items: a customer contract at 10% of revenue with less than 12 months to renewal, a key-person dependency with no agreed transition.
The discipline is that you write these thresholds before you see the evidence. Thresholds written after a problem surfaces are rationalisations, not standards.
Step 8: Set the timeline and the decision gate
A typical diligence runs 4 to 8 weeks depending on size and complexity. Define the timeline, the decision gate, and who decides. Then commission the workstreams in parallel, not serially, or the timeline slips. A workable 6-week plan for a mid-market deal:
- Weeks 1 to 2: set up the data room, issue the request list, complete the management and site visits, and run the initial financial workstream.
- Weeks 3 to 4: full quality-of-earnings analysis, commercial interviews with the top customers, operational review, and the first full working group meeting to surface the open issues.
- Weeks 5 to 6: close out the remaining requests, test the red flags against the thresholds, draft the report, and hold the decision gate with a go, no-go, or reprice outcome.
Leaving a full week for the decision gate is not slack. The gate is where the report gets pressure-tested, and rushed gates are where deals get signed that should not be.
Common mistakes to avoid
- Collecting documents instead of testing the thesis, which produces volume without judgement.
- Pricing on reported EBITDA before the quality-of-earnings adjustments are done.
- Letting the seller's narrative set the agenda for every workstream.
- Treating slow data-room responses as an inconvenience rather than a finding.
- Writing red flags after the evidence arrives, which guarantees the deal gets rationalised through.
- Running workstreams serially, which adds weeks and invites scope creep.
Speed it up
Structure the plan with the Due Diligence planner. It lays out workstreams, key questions, data requests and red flags, and exports to a deck or Word report.