M&A Due Diligence Checklist: What Every Deal Team Should Verify

Every deal team runs an M&A due diligence checklist to identify and price risk before close, and to build the strategy for the operating team. Checklists that stop at risk leave the operating team starting the 100-day plan from scratch.

As a private equity service provider, we’ve seen many diligence checklists in use and learned what makes some work while others become box-checking exercises. So we’ve assembled a diligence checklist guide. For each item, we’ve included: what gets verified, what counts as evidence, who owns it, where it falls in the letter of intent (LOI) window, and what finding is serious enough to escalate.

Why a Due Diligence Checklist Falls Short

Working with more than 65 private equity firms, we’ve seen our share of due diligence lists. Most of the checklists in circulation fall short in four ways

1. They're generic. A due diligence checklist for acquisition of a private company has little in common with one built for a public carve-out, and a list that tries to cover both ends up specific to neither.
2. They assume a strategic buyer. Corporate acquirers underwrite synergies against a business they already own, while sponsors underwrite a standalone asset across a defined hold period. That difference changes what matters in nearly every stream.
3. They carry no owners. An item with no name against it belongs to everyone, which is how a deal team gets to day 25 and finds out nobody ran it.
4. They skip the customer side. Most lists cover financial, legal, and operational ground in detail, then treat customers as one line inside market or commercial analysis. Those accounts carry the revenue the price depends on.

The sections below follow the streams a middle-market deal runs. For the wider picture of how those streams fit together in a sponsor deal, see our guide to private equity due diligence.

The Financial Due Diligence Checklist

Start by reconciling what the deal team requested against what the data room holds, because every gap becomes a request-list item that needs a date against it. Most of this stream then sits with a quality of earnings (QofE) provider, and the deal team's job is to confirm the scope covers what the model depends on.

Quality of earnings. Confirm the provider tested revenue and EBITDA adjustments against source documents rather than management schedules.

Evidence: the QofE report with its adjustment bridge. Owner: the QofE provider, reviewed by the deal team. Escalate if: a material adjustment rests on management representation alone.

Working capital. Confirm a normalized working capital level and the peg mechanism that will sit in the purchase agreement.

Evidence: monthly working capital history across whatever period your firm uses to capture seasonality. Owner: QofE provider with deal counsel.

Debt, equity, and off-balance-sheet obligations. Confirm the full capital structure, including earnouts, seller notes, leases, and any guarantee the target has given.

Evidence: debt schedules and the cap table, reconciled to the audited statements.

Revenue recognition. Confirm the recognition policy matches the contract terms, particularly on multi-year, milestone, and usage-based revenue.

Escalate if: recognition timing accounts for a meaningful share of recent growth.

Customer concentration in the P&L. Confirm revenue share by account and whether the largest accounts sit under contract past the expected hold period.

Evidence: revenue by account, plus the contracts themselves. Owner: QofE provider, confirmed by the deal team. Escalate if: concentration runs above your firm's own threshold.

Customer diligence note: whichever accounts drive the concentration belong in the customer interview panel. The share figure shows how much revenue sits in one place. The interview shows whether it will increase or decrease.

M&A financial due diligence confirms what the company earned. It doesn't test whether that revenue repeats, which is why concentration belongs on this list and again in the customer section below.

The Commercial Due Diligence Checklist

This stream answers whether the market supports the model's volume and price assumptions. A provider usually runs it, and the deal team verifies the inputs rather than the conclusions.

Market definition and size. Confirm the market the provider sized is the market the target actually sells into, not the broader category. Evidence: the sizing methodology with its sources. Escalate if: the definition shifts between the teaser and the diligence report.

Growth rate. Confirm the growth assumption comes from third-party data or primary research rather than management's forecast. Owner: the commercial provider, with the deal team checking the source.

Competitive structure. Confirm who the target competes against today and who has entered the category in the last two years. Evidence: the competitive map, tested against what customers and channel partners name independently.

Share trajectory. Confirm whether the target has been gaining or losing share, and against whom. Escalate if: share has moved against the target while revenue grew, which usually means the market grew faster than the business did.

White space. Confirm the adjacencies in the growth plan have identifiable buyers and a route to reach them.

Some sponsors run a separate marketing due diligence checklist covering demand generation, pipeline quality, brand, and sales productivity. On a middle-market deal, those items usually fold into this stream, and the deal team should confirm they are covered rather than assume it.

Customer diligence notes: A. Commercial providers often run a small customer component inside this stream, usually a few reference calls with accounts the target’s management selected. That covers the thesis adequately when it rests on market growth. A separate customer workstream becomes necessary when the thesis rests on retention, pricing power, or cross-sell, because the evidence for those comes from the accounts rather than the market.

B. If market sizing and share data already exist, skip the full commercial study and spend the budget on customer interviews. They answer the demand questions directly, faster and for less.

The Customer Due Diligence Checklist

Customer diligence earns its own stream rather than a subsection inside market analysis. A cross-cohort study that reaches lost accounts, prospects, channel partners, and suppliers alongside current customers can replace commercial due diligence when market size is already known or isn’t what the thesis depends on.

Panel design. Confirm the sample spans the revenue base, and reaches lost and at-risk accounts, prospects, channel partners, and suppliers where the business model warrants them. Escalate if: management picked every account to be interviewed.

NPS, perception and advocacy. Confirm customers named strengths and weaknesses and gave a likelihood to recommend, and probe low scorers for the reasons behind their scores.

Ranking and wallet share. Confirm where the target ranks against the alternatives in each account, and what share of category spend it holds.

Performance ratings. Confirm the rated performance dimensions match what the target sells. This is often delivery and lead times for a product business, and support and escalation for a professional services firm.

Selection and buying behavior. Confirm the research traced how accounts first found the target, who approves the spend, and which providers they evaluated.

Growth and whitespace. Confirm customers were asked about the offerings carrying the growth plan, and about needs they buy from someone else today.

All six depend on a third party running the interviews and the deal team seeing the transcripts rather than only the conclusions. For the method behind them, see the full customer due diligence methodology.

The Operational and Technology Due Diligence Checklist

Deal teams use several names for this stream, including a technology due diligence checklist, a tech due diligence checklist, and a technical due diligence checklist. The items underneath don't change.

Technology stack and technical debt. Confirm what the platform runs on, what's past end of support, and what the roadmap assumes the team can build. Evidence: the architecture overview and the engineering roadmap. Owner: a technical adviser or the fund's operating partner.

Escalate if: the growth plan depends on a rebuild nobody has scoped.

Key people. Confirm which individuals the business depends on, what their agreements say about retention and non-competes, and who would carry their responsibilities if they left at close.

Customer diligence note: ask the customers whose relationship it actually is. A dependency that appears as one named salesperson across several accounts is a different exposure than one that appears only on the org chart, and the customer interviews are where that distinction shows up.

Process maturity. Confirm the target can produce its own operating data without heroics, since a business that can't close its books quickly can't run a 100-day plan on schedule.

Systems and integration risk. Confirm what separates from the seller at close, what the transition services agreement covers, and for how long.

Escalate if: a system the business runs on belongs to the seller and has no stated exit path.

Vendor and supplier concentration. Confirm single-source dependencies, contract terms, and whether any supplier contract contains change-of-control language.

Owner: the operational workstream, with counsel reviewing the clauses. Customer diligence note: suppliers are often an interview cohort. Ask about capacity limits, input cost exposure, whether they’ll keep supplying after an ownership change, and potential issues that customers haven’t felt yet.

An operational due diligence checklist tends to get compressed when the window tightens. Protect the items that take the most time to fix after close.

Legal and Tax: What You Verify Rather Than What You Run

Counsel runs legal diligence, and your accountants run tax. The coordinating reader still needs to know what should come back and when, so a legal due diligence checklist becomes a tracking tool rather than a set of instructions.

Corporate records and the cap table. Confirm the ownership structure, option pool, and any side agreements with holders.

Owner: deal counsel. Timing: early, because a defect here takes the longest to clear.

Material contracts. Confirm counsel has reviewed change-of-control and assignment provisions across customer, supplier, and lender agreements.

Escalate if: a top customer contract requires consent to assign.

Intellectual property (IP). Confirm the target owns what it sells, including assignments from employees and contractors who built it.

Litigation and regulatory exposure. Confirm open matters, insurance coverage against them, and any licensing requirement that transfers with the deal.

On M&A tax due diligence, confirm your accountants have cleared four things: open audits and exam history, state nexus and the exposure that comes with it, transfer pricing where the business operates across borders, and whether the structure in the model survives the transaction as drafted. Each item includes a date and an owner, the same as every other item.

How to Run an M&A Due Diligence Checklist Inside the LOI Window

Thirty days is common in the lower middle market, and sequence matters more than length.

Days 1 to 3. Anything depending on people outside the company starts now. Interviews with customers, suppliers, and references run on other people’s calendars, which no other stream has to work around. A late document request can be chased. A customer who won’t talk until next Thursday can’t be hurried, and time lost here can’t be made up later. Ask any outside research provider how quickly they can field a team. T4 mobilizes in 48 hours, and the answer is worth having before the scope is signed.

Week 1. Financial and legal work through the data room while primary research is in the field. Partial findings arrive before any finished report. T4’s preliminary customer findings, for example, reach the deal team in about 10 days.

Weeks 2 to 3. Reconcile findings across diligence streams. Two findings may look benign apart but can be severe together. For example, an account that’s both large in the QofE and unhappy in the interviews is a bigger exposure than either report shows on its own. This is also the last point where a finding can still change the deal structure rather than only the decision.

Final week. Confirm every escalation has a resolution or a price adjustment behind it. Anything still open becomes a closing condition or a post-close workstream, and the checklist records which.

When a stream reports late, ask whether the finding could change the price, structure, or decision. If it could, extend the window or move the item to a closing condition. If it couldn’t, the item carries into post-close.

When to Bring In a Specialist, and When the Team Handles It

The deal team handles coordination, the data-room review, the model, and the reconciliation across streams. Associates can pull contracts, build the concentration analysis, and check the request list.

A specialist earns their fee where independence or access changes the answer. Quality of earnings is the obvious case, because a buyer-built earnings bridge carries no weight with a lender. Customer research is the other, since customers are guarded with a prospective buyer and candid with a third party running what looks like a routine satisfaction study. T4 runs that stream, and what a customer diligence study covers has the scope.