Due diligence is where deals are won and lost. Not in the negotiation room — in the weeks before it, when your team is deciding whether the story in the management presentation holds up against the reality in the data room.
This checklist is designed for corporate development teams and boutique advisory firms running mid-market acquisitions ($50M–$2B enterprise value). It covers the four core workstreams — financial, legal, operational, and technology — with specific attention to the patterns that experienced deal teams miss most often.
Before you start: what AI has changed about diligence
Three things that looked different in 2026 than they did in 2022:
1. Document review speed is no longer the bottleneck. AI document analysis now flags most financial inconsistencies, earn-out structures, and change-of-control provisions within hours of VDR access, not days. If your diligence workflow is still primarily sequential document reading, you’re leaving time — and risk detection — on the table.
2. The issues you miss are now the ones in the patterns, not the documents. A well-structured AI review will surface the explicit red flags. The misses happen at the intersection of documents: the management accounts that show one revenue figure, the customer contract that shows a different one, and nobody noticing the gap. Cross-document pattern analysis is where AI delivers outsized value in 2026.
3. The timeline hasn’t compressed as much as people expected. AI speeds up document review but not negotiation, management interviews, or regulatory review. A realistic mid-market diligence timeline is still 6–10 weeks for a clean process.
Workstream 1: Financial Due Diligence
Revenue quality
- Verify revenue recognition policy against ASC 606 / IFRS 15 — compare to how revenue appears in management accounts
- Reconcile reported revenue to underlying contracts — flag gaps > 5%
- Identify and quantify one-time or non-recurring revenue included in run-rate
- Analyse top-20 customer concentration — flag if top 3 > 40% of revenue
- Review customer churn and cohort retention for the last 36 months
- Verify that bookings-to-revenue conversion rates are consistent year-on-year
EBITDA normalisation
- Rebuild EBITDA with all owner add-backs properly documented and challenged
- Identify management compensation relative to market — model replacement cost
- Separate recurring vs. non-recurring costs in the P&L
- Review related-party transactions and test at arm’s length pricing
- Audit any one-time items over $100K in the last 24 months
Working capital
- Calculate normalised working capital (NWC) as 12-month average, not period-end
- Identify seasonality patterns that inflate or deflate period-end NWC
- Review accounts receivable ageing — flag receivables > 90 days
- Validate inventory valuation methodology — FIFO vs. LIFO impact on margins
- Review deferred revenue and performance obligation schedules
Balance sheet
- Confirm cash classification — restricted vs. unrestricted
- Review debt schedule — maturity, covenants, change-of-control provisions
- Assess unfunded pension or benefit obligations
- Identify contingent liabilities not reflected on balance sheet
- Review capital lease vs. operating lease classification post-ASC 842
Cash flow
- Reconcile EBITDA to operating cash flow — identify persistent divergence
- Review capex history — classify maintenance vs. growth capex
- Verify free cash flow conversion over 3-year trailing period
Workstream 2: Legal Due Diligence
Corporate structure
- Verify legal entity structure, jurisdiction, and ownership waterfall
- Confirm shares outstanding, option pool, and any convertible instruments
- Review any anti-dilution provisions or preferences
- Confirm there are no undisclosed shareholders or economic interests
Material contracts
- Review all customer contracts > 5% of revenue — flag automatic renewal, termination rights
- Identify supplier contracts with change-of-control provisions
- Review license agreements — IP ownership, exclusivity, territory, term
- Audit any government contracts — transfer restrictions, termination for convenience
- Review and flag any most-favoured-nation (MFN) clauses
Employment and compensation
- Review employment agreements for key personnel — notice periods, non-competes
- Identify change-of-control provisions — cash, acceleration, or required consent
- Audit equity incentive plans — vesting schedules, acceleration triggers
- Review any consulting agreements with founders or former executives
- Confirm compliance with local employment law in all operating jurisdictions
Litigation and regulatory
- Review all pending and threatened litigation — quantify exposure
- Identify any regulatory investigations or consent orders
- Review environmental liabilities — Phase I site assessments, any Phase II triggers
- Confirm no material violations of FCPA, GDPR, CCPA, or sector-specific regulations
- Review insurance coverage — D&O, E&O, cyber, GL — for adequacy and gaps
Intellectual property
- Confirm ownership of all material patents, trademarks, and domain names
- Review any third-party IP incorporated into the product — license terms
- Verify there are no open-source license violations (GPL contamination)
- Audit employee invention assignment agreements
Workstream 3: Operational Due Diligence
Commercial
- Validate pipeline and forward revenue projections against historical accuracy
- Conduct independent win/loss analysis — interview churned customers
- Assess market positioning and competitive differentiation sustainability
- Evaluate sales team structure, quota attainment, and attrition rates
- Review pricing history — identify any unsustainable discounting patterns
Operations and supply chain
- Map the production or service delivery process end-to-end
- Identify single points of failure — suppliers, facilities, systems
- Assess capacity headroom relative to growth projections
- Review quality management systems and defect/return rates
- Audit supplier contracts — terms, concentration, and switching costs
Management and organisational
- Conduct management interviews — assess quality and retention risk
- Review organisational chart — identify key-person dependencies
- Assess cultural alignment with your operating model
- Evaluate HR systems — payroll, benefits, compliance
- Review any prior restructuring, layoffs, or significant personnel changes
Workstream 4: Technology Due Diligence
Technology diligence has grown from a checkbox to a meaningful value driver, especially for platform acquisitions.
Architecture and scalability
- Review system architecture — identify legacy components and technical debt
- Assess scalability — can the platform support 3–5x current volume without a rebuild?
- Review infrastructure — cloud vs. on-premise, vendor dependencies, costs at scale
- Evaluate engineering team quality and retention
Security and compliance
- Review security certifications — SOC 2, ISO 27001, sector-specific
- Assess data handling and privacy compliance — GDPR, CCPA
- Review penetration testing history — when was the last third-party test?
- Evaluate incident response procedures and breach history
Software and IP
- Confirm proprietary code ownership — work-for-hire agreements with contractors
- Audit any third-party components — license compatibility with sale
- Review open-source usage — flag GPL contamination or restrictive licenses
- Assess quality of technical documentation
The issues deal teams miss most often
In a review of 200+ mid-market deals, these were the five patterns that caused the most surprises post-close:
-
Revenue timing games. Management accounts often book revenue at contract signing; GAAP requires recognizing it over delivery. The gap between these two figures — which can be 10–20% in service businesses — is rarely highlighted in the management presentation.
-
Key-person dependencies that weren’t disclosed as such. Legal reviews catch formal change-of-control provisions. They often miss the informal situation where the top three customers would leave if the founder did.
-
Working capital normalisation. Sellers will show you period-end working capital, which is often seasonally favorable. Requiring a trailing 12-month average instead of period-end can significantly change your NWC peg and post-close cash expectations.
-
Environmental phase creep. A Phase I site assessment that came back clean two years ago may not reflect recent activity. For industrial acquisitions, always require a current Phase I — and understand the triggers that require a Phase II.
-
IT infrastructure cost at scale. A legacy system that costs $200K/year to operate at the current scale can cost $1.5M/year at 3x scale — or require a $4M migration first. Technology due diligence that doesn’t model cost-at-scale can create significant post-close surprises.
A note on AI-assisted diligence
The checklist above covers what to look for. Modern AI-native diligence platforms (including Kairos) now automate a significant portion of the document review phase — particularly cross-document inconsistency detection, change-of-control clause extraction, and financial reconciliation flagging.
The right mental model: AI handles the first-pass review at scale and speed. Your experienced team handles the judgment calls — what the risk actually means for your thesis, how to negotiate around it, and whether it’s a deal-breaker or a pricing adjustment.
Teams that use AI well finish diligence faster with better coverage. Teams that either avoid AI or over-rely on it without experienced oversight tend to find the same surprises post-close that deal teams found ten years ago.
Kairos includes AI-native diligence workrooms that flag issues, track open items, and keep your team focused on the decisions that matter — not document administration. See how it works →