Due Diligence Checklist: What to Check, and What Proves It

What a Due Diligence Checklist Is

A due diligence checklist is the deal team's plan of the investigation, written as a list. Each line is a fact that has to be confirmed before the commitment: that the entity chart is complete, that revenue ties to the bank, that the code belongs to the company. The list says who owns each line, what will confirm it, and whether it is done.

The phrase covers three different documents, and search results mix them freely:

• Workstream checklists. Deal teams and their advisers keep one for each workstream: financial, legal, commercial, operational, technology, people. This page is the index to them, and the operational and technology checklists go line by line.
• Request lists. The documents a buyer asks the company to place in the data room. A request list is how most checklist lines get their evidence. The due diligence questionnaire covers how it pairs with written questions.
• Buyers' checklists for a small business. The same workstreams at the scale of one owner and one set of books, set out further down.

Whichever version is in use, a checklist records that a line was checked. It does not record what the check found, or how. That gap is what the rest of this page is about.

How the Checklist Divides the Work

Each workstream answers a different question about the same company, and each already has a list of its own that goes deeper than this one. The types of due diligence map shows who normally runs which.

• Corporate and ownership. What is being bought, and who can bind it. Counsel owns most of these lines.
• Financial. Whether the earnings are real and will survive new ownership. The accountants own the depth, in financial due diligence and the quality of earnings review.
• Customers and revenue. How durable the revenue is, and whether the market will cooperate. See commercial due diligence.
• Operations. Whether the company runs the way the management presentation says it does. The operational due diligence checklist has the full list.
• Technology and data. Whether the product survives the plan. The technology due diligence checklist names where each answer lives.
• People and leadership. Who holds the company together, and what happens if they leave. See human capital due diligence and key person risk.
• Legal, tax and regulatory. What obligations transfer with the company. Counsel and the tax advisers own these lines and the judgment on them. One is easy to miss: the privacy promises a company has made to its customers can still bind the business after the sale, as the Federal Trade Commission told Facebook and WhatsApp when Facebook agreed to buy WhatsApp.
• Integration readiness. What has to hold on the first day of new ownership, and what the findings change afterwards. The 100-day integration plan takes it from there.

The checklist below keeps each workstream to the few lines a deal team confirms itself, and leaves the depth to the pages that own it.

Start From the Thesis

A checklist copied whole from a template asks every company everything, and the lines this deal depends on get the same attention as the rest. The better starting point is the investment thesis: the two or three things that must be true for the deal to work. Bain makes the same point about acquirers: an early, thesis-driven look at a company can help a buyer avoid chasing deals that are a poor fit.

Keep the lines that test the thesis, cut the lines that test nothing in it, and set the depth by the kind of deal. A platform acquisition runs every workstream deep. A bolt-on weighs what breaks on combination. A minority investment weighs what a board seat cannot fix later. A carve-out adds a line for everything that has to separate from the seller. The types of due diligence map covers how each kind of deal changes the scope.

If You Are Buying a Small Business

Buying a small business runs the same workstreams at a smaller scale, usually with fewer advisers. The Small Business Administration's advice to buyers is to look at everything that comes with the purchase, and not to be afraid to ask about contracts, leases, existing cash flow and inventory. In practice a few lines matter more than the rest:

• The books against the bank. The tax returns, the financial statements and the bank deposits should describe the same business. Where they differ, find out why before anything else.
• What the owner does personally. Customers, suppliers and staff who deal only with the owner may not stay with the business. That is key-person risk at its plainest.
• The lease and the licenses. Whether the premises and the permits the business depends on transfer with it, and on what terms.
• Customer concentration. How much revenue depends on a few customers, and whether their agreements survive the sale.
• What is actually being bought. In an asset purchase, the IRS treats the sale of a business for a lump sum as a sale of each individual asset, and buyer and seller must both allocate the price across those assets. Settle the allocation with an adviser before signing, not after.

The checklist below applies at any size. Trim the lines that have no subject in a business this small, and keep the ones about records.

Red Flags That Should Stop the Tick

Every workstream has its own red flags, and the types of due diligence map lists them workstream by workstream. A checklist adds a second kind: signs that the evidence behind a line is weaker than the tick beside it suggests. FINRA, which oversees broker-dealers, sets the rule out plainly for the firms it supervises: when red flags appear, a firm must do more than rely on what management represents. The same rule serves a deal team.

• A yes with nothing attached. A line confirmed on an answer alone was confirmed on trust.
• Numbers that do not tie. Revenue in the management accounts that cannot be traced to the ledger and the bank, or a headcount that does not match payroll.
• A definition that moves. The same metric calculated one way in the management presentation and another in the monthly accounts, or differently from one period to the next.
• Evidence that arrives late, partial or reformatted. A spreadsheet in place of the system export, a summary in place of the contract, a sample the company chose.
• Every answer through one person. When every question in a workstream routes to the same name, that person is a finding in their own right.
• An absence. The contract that is not in the data room, the interview that keeps moving, the month missing from an otherwise complete series.

One flag is a question. Two on the same surface usually share a cause, so before closing either line, ask the other workstreams what they see there.

What a Checklist Structurally Cannot Tell You

A checklist is a record of attention. It shows which questions someone thought to ask and which have been answered. That makes it necessary, and it also sets its limits, which hold however carefully the list is written.

• A tick records that something was checked, not what the check found. Two teams can tick the same line on very different evidence, and the list reads the same.
• It is bounded by what someone thought to ask. FINRA says as much to the firms it supervises: a single checklist will not suffice for every offering, and mechanical reliance on one may result in an inadequate investigation.
• It confirms that things exist, not how they are used. A documented approval policy ticks the line. Whether decisions actually follow it shows only in the records of who approved what, and when.
• It samples a moment. Most lines are checked once, near the end. The drift that matters, a close that slips a little each quarter or attrition that climbs in one team, shows only across the whole period.
• It is worked under deadline, by the people doing the deal. A long list in the last weeks of exclusivity leans toward whichever box can be ticked fastest.

None of this argues for a shorter list or a looser one. It argues for naming, on every line, what will confirm it. A document proves that a thing exists. A record in the company's own systems shows what happened, written before anyone knew there would be a deal. An interview carries the judgment. The checklist below tags every line with one of the three, so anyone reading it can see which lines rest on the record and which rest on someone's word.