First-time acquirer? Founder preparing for an exit? Here's the practical M&A due diligence checklist you actually need—plus how to organize everything in a data room that won't drive buyers crazy.
There's a particular kind of panic that sets in when you realize your company is about to go through due diligence. Maybe you're selling the business. Maybe you're raising a growth round with real institutional investors. Either way, someone just sent over a document request list with 147 line items, and you're staring at it thinking: "Where do I even start?"
I've seen this moment play out dozens of times. And here's what I've learned: the companies that survive due diligence with their sanity intact aren't the ones with perfect documents. They're the ones with organized documents.
Let me show you how to build a due diligence checklist that actually works—and how to structure your data room so buyers can find what they need without peppering you with questions every five minutes.
Before we dive into the checklist, let me share a quick story.
Two companies, similar size, same industry, both selling for roughly $40 million. Company A had a beautifully organized data room. Clean folder structure. Consistent naming conventions. Everything indexed and cross-referenced.
Company B had... a pile. Documents scattered across shared drives, personal folders, email attachments. Important contracts buried in someone's inbox from three years ago.
Company A's due diligence took six weeks. Company B's took fourteen weeks—and the buyer ultimately reduced their offer by $2 million, citing "discovery risk" from incomplete documentation.
Organization isn't just about convenience. It's about deal certainty and valuation protection.
Let's start with what you'll actually need. I've broken this into the core categories that virtually every M&A transaction requires.
This is your company's legal DNA. Buyers need to understand exactly what they're acquiring.
Essential Documents:
Folder Structure:
1.0 Corporate Documents/
├── 1.1 Formation Documents/
├── 1.2 Governance Documents/
├── 1.3 Capitalization/
├── 1.4 Board Materials/
└── 1.5 Shareholder Materials/
The numbers tell the story. This section gets the most scrutiny from buyers and their accountants.
Essential Documents:
Folder Structure:
2.0 Financial Information/
├── 2.1 Historical Financials/
│ ├── 2.1.1 Audited Statements/
│ └── 2.1.2 Monthly Financials/
├── 2.2 Projections/
├── 2.3 Tax Documents/
├── 2.4 Banking/
└── 2.5 Working Capital/
Pro Tip: Create a summary document at the top of this section explaining any unusual items, accounting policy changes, or one-time events. Buyers will find them anyway—better to address proactively.
Contracts are where deals get complicated. Buyers are looking for revenue stability, termination risks, and hidden obligations.
Essential Documents:
Change of Control Provisions: Flag any contract that requires consent for change of control or that can be terminated upon an acquisition. These are deal-critical.
Folder Structure:
3.0 Material Contracts/
├── 3.1 Customer Agreements/
├── 3.2 Vendor Agreements/
├── 3.3 Partnership Agreements/
├── 3.4 Leases/
├── 3.5 Financing Agreements/
└── 3.6 Change of Control Summary/
For tech companies and many others, IP is the core value driver. Buyers need confidence that you actually own what you're selling.
Essential Documents:
Folder Structure:
4.0 Intellectual Property/
├── 4.1 Patents/
├── 4.2 Trademarks/
├── 4.3 Copyrights/
├── 4.4 Trade Secrets/
├── 4.5 IP Agreements/
└── 4.6 Open Source/
People are usually a company's biggest asset—and biggest liability. This section reveals both.
Essential Documents:
Sensitive Information Note: Some HR data (specific salaries, performance reviews) may be staged for later-phase diligence with appropriate access restrictions.
Folder Structure:
5.0 Human Resources/
├── 5.1 Employee Information/
├── 5.2 Employment Agreements/
├── 5.3 Compensation and Benefits/
├── 5.4 Equity Plans/
├── 5.5 Policies and Handbooks/
└── 5.6 Contractor Agreements/
The section nobody wants to talk about—but everyone needs to see.
Essential Documents:
Folder Structure:
6.0 Legal and Regulatory/
├── 6.1 Litigation/
├── 6.2 Regulatory Matters/
├── 6.3 Compliance Documentation/
├── 6.4 Insurance/
└── 6.5 Privacy and Data Protection/
For any company with significant tech components, buyers need to understand the infrastructure.
Essential Documents:
Folder Structure:
7.0 Technology/
├── 7.1 Architecture and Documentation/
├── 7.2 Security/
├── 7.3 Infrastructure Agreements/
└── 7.4 Development/
Understanding revenue generation is critical for valuation and growth projections.
Essential Documents:
Folder Structure:
8.0 Sales and Marketing/
├── 8.1 Sales Performance/
├── 8.2 Marketing Materials/
├── 8.3 Customer Analysis/
└── 8.4 Competitive Intelligence/
Not everyone should see everything. Here's how to think about permission levels:
Users: All potential buyers and their advisors Access: General corporate, public financials, high-level summaries
Users: Selected buyer(s), legal counsel, accountants Access: All of Phase 1 plus: detailed financials, material contracts, IP details
Users: Winning bidder's full deal team Access: Everything, including: HR details, customer names, litigation specifics
| Permission Level | Who | What They See |
|---|---|---|
| Level 1 | All bidders | Corporate overview, public information, teaser materials |
| Level 2 | Serious bidders | Financials, contracts (redacted names), general HR |
| Level 3 | Final bidder | Complete materials, unredacted, including sensitive items |
Financial advisors typically need broad access—they're coordinating the entire diligence process.
Legal counsel needs everything eventually, but you can stage access based on workstream.
Accountants focus on sections 2 (Financial) and 3 (Contracts), often need Level 3 access earlier than others.
Technical diligence teams need section 7 (Technology) and section 4 (IP), may not need HR or legal.
HR diligence happens late-stage with very restricted access due to sensitivity.
Here's a realistic timeline for a typical middle-market M&A process:
Modern virtual data rooms aren't just file storage—they have specific features designed for due diligence:
Automatically generate numbered indices that buyers can reference in Q&A and purchase agreements.
When you update a document, the system tracks versions and can notify users of changes.
Formalize the question-and-answer process with routing, tracking, and response workflows. Questions link to specific documents. Responses become part of the permanent record.
See who's looking at what. If a buyer is spending hours on your contracts section but ignoring financials, that tells you something. If a supposedly interested party hasn't logged in for two weeks, that tells you something too.
Every action logged. Essential for regulatory compliance and reconstructing the diligence record if questions arise later.
Systematically redact sensitive information (customer names, pricing) for early-stage access, then reveal as appropriate.
Mistake 1: Starting Too Late Document gathering takes longer than you think. Start at least 6-8 weeks before you need the data room live.
Mistake 2: Disorganized Naming "Contract_final_v3_FINAL.pdf" tells nobody anything. Use consistent naming: "3.1.001 - Customer Agreement - Acme Corp - 2024.pdf"
Mistake 3: Incomplete Documents Missing signature pages, outdated versions, partial documents. Buyers notice. It raises questions about organizational rigor generally.
Mistake 4: Over-Restricting Access Some sellers are so paranoid that they make diligence impossible. If buyers can't review materials efficiently, they get frustrated and deals die.
Mistake 5: Ignoring Q&A Unanswered questions signal disorganization or evasiveness. Set response time targets (48-72 hours) and stick to them.
Mistake 6: Forgetting About Closing Your data room becomes a historical record. Organize it well enough that you can reference it years later if disputes arise.
If you're staring at this guide feeling overwhelmed, here's the 80/20 version—the absolute essentials to get started:
Get these seven categories together and you have the foundation. Everything else builds from there.