M&A Due Diligence: Workstreams, Timing and Red Flags
M&A due diligence for acquirers: the five workstreams, how they run against the LOI and exclusivity, and which findings change the price or the structure.
Commercial, financial, legal, tax and operational reviews, each with its own performer and its own effect on the deal.
Diligence runs in two stages, and the fuller review sits inside the exclusivity period that follows the letter of intent.
Each finding adjusts the price, changes the structure of the transaction or ends it.
The target opens the data room, and the acquirer's question log by workstream sets the schedule.
An off-market approach sets its own pace, while a seller-run process sets the timetable and the data room.
M&A due diligence is the acquirer's investigation of a target before it signs: a first look before the letter of intent and a full review between the LOI and signing. Its output is a price and a structure the acquirer can sign, and the commercial, financial, legal, tax and operational workstreams each exist to move one of the two before exclusivity ends.
This guide is for the CEOs, CFOs and corporate development teams acquiring a mid-market company, and for the private equity deal teams behind them.
What is M&A due diligence, and when does it start for an acquirer?
It starts in two stages. The acquirer signs a non-disclosure agreement, reads what the target shares and, if the company still fits, sets out its terms in a letter of intent (LOI). Baker McKenzie's guide to US private M&A places the LOI inside that sequence.
“This is typically signed by the parties following initial due diligence (but prior to completion of a more fulsome diligence review)”
Baker McKenzieGlobal Private M&A Guide, on the letter of intent
The fuller review is the part with the specialists and the schedule. It runs under exclusivity, the period in which the seller negotiates with that acquirer alone.
Completing it is also what slows closings: KPMG's 2025 survey of 300 US M&A professionals puts completing due diligence among the top obstacles to closing, at 41%.
An acquirer that fixes its specialists, its question list and the schedule before exclusivity starts spends the whole period testing the target. The schedule can sit with the deal team or with a buy-side M&A advisory firm that coordinates the specialists and the question list.
Which workstreams does acquisition due diligence cover?
Depending on the transaction structure, an acquirer takes on what the target carries. Baker McKenzie notes that acquirers of US businesses can inherit litigation, anti-bribery, environmental, employment and labor union risks on completion, which is why the review splits into workstreams.
Each workstream works from its own part of the due diligence checklist, and the table shows what each one can change, who works through it and what it tests.
4 columns. Drag the table sideways; the first column stays put.
Workstream | What it can change | Who performs it | What it tests |
|---|---|---|---|
Commercial due diligence | The price, or the decision to proceed | The deal team, or a commercial advisor | Market position, customer concentration, supplier and customer contract terms |
Financial due diligence | The price | The acquirer's accountants | Quality of earnings, net debt, working capital |
Legal due diligence | Indemnities, closing conditions | The acquirer's counsel | Title to shares and assets, litigation, employment terms, change-of-control consents |
Tax due diligence | Indemnities, the deal structure | Tax advisors, or the same accountants | Open exposures, the structure of the transaction |
Operational | The integration plan, the cost to fix, sometimes the price | An operational advisor, with the target's management | Systems, cyber security and data privacy, suppliers, key people |
Commercial and legal diligence both read the customer and supplier contracts, so the deal team and counsel should read them together. Tax tests the structure of the transaction, so it works from the structure in the draft SPA.
Financial due diligence feeds the price most directly, and quality of earnings tests how much of the reported profit repeats. Net debt is the borrowings and debt-like items the acquirer takes on, less the cash that comes with them. Working capital sets the level of stock, receivables and payables the target hands over at closing.
An add-on to an existing platform runs the same five workstreams at lower depth, and the write-up on add-on diligence on a small target shows where a short review still has to look.
How does M&A due diligence run against the LOI and the exclusivity window?
In acquisition due diligence the five workstreams start together once the LOI is signed, because exclusivity is the clock and a workstream that starts late takes time from the others. The question list sent to the target sets the critical path of the due diligence process: a workstream waits for the documents it asked for, so the slowest answer from the target usually decides when the findings land.
Those findings have to be in before the price and structure terms of the share purchase agreement (SPA), the contract that transfers the company, are settled.
| Track | What | When |
|---|---|---|
| Initial diligence | 4 to 30 sequence only, not days | |
| Exclusivity | 30 to 90 sequence only, not days | |
| Question list and data room | 12 to 78 sequence only, not days | |
| Commercial and operational | 30 to 68 sequence only, not days | |
| Financial and tax | 30 to 74 sequence only, not days | |
| Legal | 32 to 76 sequence only, not days | |
| Findings memo | Red flags in | 78 sequence only, not days |
| SPA terms and signing | 78 to 90 sequence only, not days |
In 2022 nearly 40% of private equity exclusivity periods ran 61 days or more, according to Goodwin's deal data, so the review plan has to fit a window that can run past two months.
The exclusivity length is the one term the whole plan rests on, so read what the letter of intent binds before the draft goes back to the seller. Tie the period to the diligence plan and agree in the LOI how it can be extended: asking for more time late in the period puts the acquirer in the weaker position.
Which red flags change the price, and which change the structure?
A finding has three destinations: it adjusts the price, it changes the structure of the transaction, or it ends the transaction. Deloitte's guidance on the diligence phase ties the findings to the pricing mechanism.
“Findings from the due diligence phase inform the overall M&A strategy, including risk mitigation, governance planning, and pricing mechanisms (e.g., completion accounts or locked box)”
Deloitte Netherlandson what diligence findings feed
A finding that can be measured goes into the price. With completion accounts the price is trued up to accounts drawn at closing, and with a locked box it's fixed against an earlier balance sheet, with the seller barred from taking value out before closing.
A finding that can only be bounded goes into the structure. An escrow holds back part of the price, an indemnity makes the seller pay for a named loss, and representations and warranties (R&W) insurance covers a breach of the seller's statements about the company.
A net debt or working capital finding comes from the financial work and goes to the price. A pending claim or an employment liability from the legal work, or an open tax exposure, goes to an indemnity, an escrow or a closing condition. A weakness in the target's systems or key people goes to the integration plan and the cost to fix it, and sometimes to the price.
| Step | Leads to |
|---|---|
| Diligence finding (from any workstream) | Can it be measured? |
| Can it be measured? | Price [yes]; Structure [bounded]; Walk away [no] |
| Price (measurable: net debt, working capital, normalized earnings) | Signed terms |
| Structure (bounded, not measurable: escrow, indemnity, R&W insurance) | Signed terms |
| Walk away (neither: the thesis depends on it) | end |
| Signed terms | end |
Some findings end the transaction. A customer that supplies most of the revenue and holds a consent right over a change of control is one, and a regulatory block is another.
A finding about the target's market position is commercial diligence, and it can end the transaction at thesis level. An AI view of the target's market is one such finding: Bain's report on M&A in 2025 reports that one in five strategic dealmakers told it they have walked away from a deal because of the anticipated impact of AI on the target's business.
How is the data room organized for acquirer diligence?
A data room is the secure online space in which the target shares documents with the acquirer and its advisors. The target's side opens and indexes it, and the acquirer organizes its question list and its diligence tracking around the five workstreams, so each answer reaches the advisor who tests it.
The tracking sheet holds one question log: the question, its owner, the date asked, the date answered and the status. That log is the M&A due diligence checklist the advisors work from, one section per workstream. Each takes the questions in its own section, and the log sets the schedule because it shows which workstream is still waiting for documents.
Who does what in buy-side due diligence, and who pays?
Three roles sit on top of the specialists in the table:
Deal lead. Owns the thesis, signs off the findings memo and decides whether to proceed.
Counsel. Reports on the legal findings, reviews or drafts the SPA depending on the process, and negotiates it with the seller's counsel.
Advisory firm. Coordinates the process: the data room, the question tracking and the schedule between counsel, accountants and the other side.
Each side pays its own advisors. The acquirer should budget its specialists before the LOI is signed, because that work is done whether or not the transaction signs.
How does diligence differ off-market and in a seller-run process?
Off-market, nobody runs a process. There's no data room, no deadline and no competing bidder, so the acquirer sends its request list straight to the owner, decides the pace and can agree exclusivity before diligence costs start to accrue. The acquirer's counsel typically drafts the SPA.
In a seller-run process the seller's advisor sets the timetable and every bidder reads the same data room. The draft SPA comes from the seller and the acquirer's counsel marks it up, and exclusivity comes late, for the preferred bidder only.
Diligence in that process has to be thorough enough to support the bid, and the acquirer agrees its walk-away price in advance.
| Item | Who sets the timetable (0 to 100) | Competing bidders (0 to 100) | Note |
|---|---|---|---|
| Off-market | 12 | 8 | No deadline, no data room, no other bidder. |
| Seller-run, open | 88 | 88 | One timetable and one data room for every bidder. |
| Seller-run, exclusive | 88 | 12 | Alone with the seller, on the seller's timetable. |
In one 2026 transaction, a DACH contract manufacturer joined a sponsor's existing platform as an add-on, in the EUR 10 to 25 million range. It was found against the sponsor's investment thesis, its owner wasn't running a sale process, and spectup acted for the acquirer and was paid by it.
A private equity firm or corporate development team that wants the approach without a process opens it through off-market deal origination.
The write-up on sourcing a target before diligence sets out how that approach works before any document is requested.
What a diligence findings memo needs to say
The deliverable of diligence is a findings memo. Each finding in it names the workstream that found it, its effect and the term it moves.
Illustrative example of three findings:
4 columns. Drag the table sideways; the first column stays put.
Finding | Workstream | Effect | Term it moves |
|---|---|---|---|
Net debt above the figure in the seller's information | Financial | Price, reduced by the difference | The net debt line in the SPA price formula |
A customer claim that is pending and not in the seller's disclosures | Legal | Cost to the acquirer if the claim succeeds | An indemnity or an escrow sized to the claim |
Two managers hold the main supplier relationships | Operational | Integration risk | Retention terms and a closing condition |
The deal lead accepts or declines price effects, counsel turns structure effects into SPA terms, and thesis-level findings go to the investment committee or the owner.
How spectup runs buy-side due diligence
spectup works one side of a transaction, and in buy-side due diligence that side is the acquirer, which also pays it. That rule holds across the $150M+ of M&A spectup has advised, buy-side and sell-side.
In buy-side M&A due diligence, spectup coordinates the data room, the question tracking and the schedule between the client's counsel, its accountants and the other side. It tracks the schedule across the specialists, so each finding reaches the acquirer and its counsel before the terms are settled.
The financial, legal and tax work, quality of earnings included, is done by the client's own advisors, and spectup does not perform it.
Where the target was found off-market, spectup approached the owner directly, so the first request list goes straight to a seller who isn't running a sale.
The acquirer and its counsel negotiate the terms, and spectup prepares both for the negotiation. The fee is a monthly retainer for the process plus a capped transaction fee, paid at closing.
What to settle before you sign the LOI
Five things belong in place before the exclusivity clock starts:
The exclusivity length, tied to the diligence plan, and how it can be extended.
The specialists and the scope each one covers.
The owner of the question log, and how the seller's data room, or the direct request list off-market, maps to the five workstreams.
The walk-away conditions, written down before the first finding arrives.
The price mechanism: completion accounts or a locked box.
Settle them with your counsel and, if you use one, your M&A advisor before the LOI goes to the seller.
Three conclusions
The fuller review runs inside exclusivity, so the plan has to exist before the LOI is signed. An acquirer that asks for more time late in the period asks from the weaker position.
A red flag is useful once it is routed to the price, the structure or the exit. A finding that moves no term in the sale agreement is an observation, and it costs time.
When the seller runs the process, every bidder reads the same data room on the seller's timetable. The acquirer agrees its walk-away price before diligence starts, so each finding is measured against a number.
M&A due diligence: questions readers ask
6 questions on M&A, answered by Edwin Mik, Partner & Head of IR.
01Who pays for due diligence?
Each side pays its own advisors. The acquirer's advisors investigate the target and the seller's advisors prepare and run the data room, so the acquirer budgets its own side, specialists included, before the letter of intent is signed.
02What are the main types of due diligence?
Commercial, financial, legal, tax and operational diligence are the five core types of M&A due diligence. The scope can also include HR, technology and ESG reviews.
03What is a due diligence report?
The written findings of each workstream, with the evidence behind them. The acquirer reads it to set the price and the structure, and to decide whether the transaction goes ahead.
04What is a red flag due diligence report?
A short report limited to the findings that could move a term or stop the transaction. It leaves out everything that passed.
05Why do deals fall apart during due diligence?
Diligence is where the investment thesis meets the target's documents. KPMG's 2025 survey of US M&A professionals ranks completing due diligence level with regulatory hurdles among the obstacles to closing. A finding that can't be priced or put into the structure, such as a regulatory block or a weak market position, leaves the acquirer two options: renegotiate the terms or walk away.
06When should a CFO or corporate development team bring in an M&A advisor to run due diligence?
Before the LOI is signed. Exclusivity starts the clock, and the specialists, the question list and the schedule are easier to fix before it runs than after. A buy-side M&A advisory firm such as spectup coordinates those workstreams for the acquirer, while the financial, legal and tax diligence stays with the acquirer's own advisors.
