A due diligence report is the written record of every material risk a buyer has identified in a target company before closing an acquisition, covering financial, tax, legal, intellectual property, HR, operational, technology, environmental, and regulatory findings. Each finding is tied to evidence pulled from the seller’s records, management interviews, and independent verification, and each one has a job: verify what the seller represented, quantify what they didn’t, and give the buyer the information needed to negotiate the price down, tighten the contract, or walk away.
The exact contents vary with the target’s industry, size, and deal structure. But the categories below appear in almost every transaction, and leaving any of them out either leaves money on the table or transfers hidden liability to the buyer at closing.
Financial Findings and Quality of Earnings
The financial section is the backbone because it directly determines what the buyer is willing to pay. Its centerpiece is a Quality of Earnings analysis, which strips accounting noise out of the seller’s reported EBITDA to arrive at a normalized figure that reflects sustainable performance.
Normalization adjustments fall into three buckets. Non-recurring adjustments remove one-time events like lawsuit settlements, pandemic-related costs, or gains from selling equipment. Pro forma adjustments account for changes expected after closing, such as combination synergies or the removal of above-market owner compensation. Accounting policy adjustments correct for aggressive revenue recognition or inconsistent expense timing. Every adjustment is documented, and the gap between reported and normalized EBITDA is one of the most contentious points in any negotiation.
The section also includes a working capital analysis. Analysts calculate the normalized level of working capital the business needs to operate day-to-day, known as the target or “peg.” Buyer and seller agree on that number before closing, and the purchase agreement includes a true-up mechanism that adjusts the final price dollar-for-dollar based on whether the working capital actually delivered exceeds or falls short of the target. A third-party accountant typically verifies the final figures within 60 to 120 days after closing.
Finally, the financial section identifies all debt and debt-like items. Bank loans and credit lines are obvious. Less visible items include accrued bonuses, deferred rent, unfunded pension obligations, and capital lease commitments. Each is deducted from enterprise value to calculate the equity value the buyer actually pays. Missing even one significant debt-like item means overpaying.
Tax Exposure
Undiscovered tax liabilities transfer directly to the buyer at closing, and in many cases the statute of limitations on the seller’s past filing positions hasn’t expired. The tax section covers federal, state, local, and international compliance.
At the federal level, analysts verify that the target has filed accurate corporate returns and that its reported tax positions are defensible. Transfer pricing gets particular attention for companies with related-party or international transactions, because weak documentation of intercompany pricing can trigger penalties and retroactive adjustments. The report also evaluates tax attributes, such as net operating loss carryforwards and research credits, to determine whether they survive the acquisition or are limited by ownership change rules.
State and local exposure is harder to pin down because it depends on where the target has created “nexus,” a sufficient connection to a state to trigger tax obligations. Companies routinely underreport state nexus, particularly for sales tax, and the buyer inherits the exposure. The report should document every state where the target has employees, property, or significant sales, and flag any jurisdiction where the target has not been filing.
One liability that catches buyers off guard is unclaimed property. Every state requires companies to turn over dormant financial obligations, including uncashed vendor checks, stale customer credits, and abandoned gift card balances, after a holding period. Companies that haven’t been remitting accumulate liability that can stretch back 10 to 15 years under audit, and states can use estimation methods to calculate liability for years where records don’t exist. The buyer inherits this obligation regardless of deal structure.
Legal Review and Material Contracts
The legal section identifies risks that could trigger lawsuits, block the ownership transfer, or create ongoing regulatory problems after closing. Findings here often drive the most aggressive contractual protections in the purchase agreement.
Change-of-Control Clauses
Every significant customer agreement, supplier arrangement, lease, and loan document gets reviewed. The primary concern is change-of-control provisions that let the counterparty terminate the contract or renegotiate terms when the company changes hands. A target whose three largest customers can walk away after closing is worth considerably less than one with locked-in contracts. The report flags these provisions and assesses the practical likelihood that counterparties will exercise them.
Corporate Structure and Litigation
Corporate structure review confirms the entity is in good standing, has maintained governance formalities, and has obtained necessary shareholder or board approvals for past transactions. Missing approvals for prior equity issuances or related-party deals can cloud the buyer’s ownership rights.
Pending and threatened litigation gets its own analysis, with each matter categorized by likelihood and estimated cost of an adverse outcome. The report quantifies potential exposure for each active case and flags any regulatory investigations, even those at an early stage. Compliance gaps, such as missed regulatory filings or unremitted sales tax in nexus states, are documented with estimated remediation costs.
Intellectual Property
For any company where intangible assets drive value, the IP section is as important as the financial analysis. It verifies that the target actually owns what it claims to own.
Patent ownership requires a complete chain of title from each inventor to the company. That means locating signed assignment agreements for every patent and patent application, because under U.S. law the inventor is the default owner until they formally assign their rights. Public USPTO records can mislead; a company listed as the “Assignee-Applicant” may still have gaps if the underlying inventor assignment was never properly executed or recorded. The report flags any patent where the chain of title is incomplete.
For software companies, open source license compliance is now a central part of the IP review. If the target has embedded code governed by a copyleft license (such as the GPL) into a proprietary product and distributed that product without complying with the license, the license holder can demand release of the proprietary source code or an end to distribution. Replacing offending components is expensive and slow, and in industries like medical devices, any code change can trigger a lengthy recertification process. A software composition analysis, which scans the codebase for open source components and their license obligations, is now standard in technology transactions.
Human Resources and Employee Benefits
People-related liabilities are easy to underestimate because they don’t always sit on a balance sheet. The HR section covers benefit plan compliance, worker classification, key employee retention, and change-of-control compensation.
Benefit Plan Compliance
If the target sponsors a 401(k) or other retirement plan, the report reviews whether the plan has been operated in compliance with federal rules. Common problems include missed amendment deadlines, failure to include eligible employees, and prohibited transactions between the plan and company insiders. The initial excise tax on a prohibited transaction is 15% of the amount involved for each year it remains uncorrected, escalating to 100% if never fixed.1Office of the Law Revision Counsel. 26 U.S. Code 4975 – Tax on Prohibited Transactions These penalties compound for a plan out of compliance for years, and the buyer inherits the liability if it acquires the sponsoring entity.
Worker Misclassification
The report assesses whether workers the target treats as independent contractors are functionally employees. Misclassification creates liability for unpaid employment taxes, overtime, and benefits, and enforcement has grown more aggressive. The analysis looks at how much control the company exercises over each worker’s schedule, tools, and methods, because a contractor who works exclusively for one company under close supervision looks like an employee no matter what the contract says.
Golden Parachute Exposure
Change-of-control payments to executives can create real tax costs for both the executive and the buyer. When the total value of compensation triggered by an ownership change equals or exceeds three times an executive’s average annual compensation (the “base amount”), the excess above one times the base amount becomes nondeductible for the acquiring company.2GovInfo. 26 USC 280G – Golden Parachute Payments The executive also owes a 20% excise tax on that excess, on top of regular income tax.3Office of the Law Revision Counsel. 26 USC 4999 – Golden Parachute Payments The report quantifies this exposure for every executive and key employee with change-of-control agreements, because the lost deduction increases the buyer’s after-tax cost of the acquisition.
Operational and Commercial Assessment
The operational section tests whether the business can actually deliver on the growth projections built into the purchase price. Financial models are only as good as the commercial assumptions behind them.
Customer concentration is usually the first thing examined. A business that derives 40% of revenue from a single customer carries a fundamentally different risk profile than one with a diversified base. The report quantifies revenue by customer, identifies contracts approaching renewal, and assesses relationship strength through direct outreach where possible. Supply chain analysis applies the same logic on the cost side, flagging dependence on sole-source suppliers or vendors with short-term agreements that could be renegotiated after closing.
Management team assessment matters because most acquisitions depend on existing leadership staying in place through at least a transition. The report evaluates whether key employees have non-compete agreements, what their compensation expectations look like, and whether critical institutional knowledge lives in one person’s head rather than in documented processes. Structured interviews with department heads also surface risks that don’t appear in financial statements, such as aging equipment, deferred maintenance, or informal workarounds masking broken processes.
Technology and Data Privacy
Data privacy has become one of the most consequential areas of due diligence. When Verizon discovered two massive data breaches during its acquisition of Yahoo, it negotiated a $350 million reduction in the purchase price, and regulatory and litigation exposure continued for years after closing.
The technology section assesses the target’s cybersecurity posture: history of data incidents, maturity of security controls, and adequacy of cyber insurance. For companies that handle personal data, the analysis extends to privacy regulations. Under the EU’s General Data Protection Regulation, fines for serious violations can reach 4% of global annual revenue. A growing number of U.S. states have enacted their own comprehensive privacy laws with enforcement mechanisms that create real financial exposure.
The report should document what personal data the target collects, where it’s stored, who has access, how long it’s retained, and whether the company obtained proper consent for its processing activities. Undisclosed incidents or systemic noncompliance become the buyer’s problem immediately after closing, and a pre-signing discovery can save multiples of the purchase price in post-closing liability.
Environmental Liabilities
Any transaction involving real estate or industrial operations needs an environmental review. The standard tool is a Phase I Environmental Site Assessment conducted under ASTM E1527-21, the accepted U.S. practice for evaluating the environmental condition of commercial real estate.4ASTM International. ASTM E1527-21 – Standard Practice for Environmental Site Assessments: Phase I Environmental Site Assessment Process The goal is to identify “recognized environmental conditions,” meaning evidence of contamination from hazardous substances or petroleum products that could trigger cleanup liability under federal law.
A Phase I is largely a records review and site inspection; it doesn’t involve sampling soil or groundwater. If it identifies potential contamination, a Phase II with actual testing follows. Completing a proper Phase I matters beyond risk understanding, because it’s a requirement for qualifying as a protected buyer under federal environmental liability law. A buyer who skips this step and later discovers contamination has a much harder time arguing it shouldn’t pay for cleanup.
Regulatory and Antitrust Compliance
Depending on deal size, the transaction itself may require government approval before closing. The Hart-Scott-Rodino Act requires buyers and sellers to file a premerger notification with the Federal Trade Commission and the Department of Justice when the transaction exceeds certain value thresholds.5Office of the Law Revision Counsel. 15 U.S. Code 18a – Premerger Notification and Waiting Period For 2026, the minimum filing threshold is $133.9 million, and transactions valued above $535.5 million require a filing regardless of party size.6Federal Trade Commission. Current Thresholds The report should assess whether the deal triggers an HSR filing and identify antitrust concerns that could delay or block approval.
For companies with international operations or dealings with foreign governments, the report should evaluate compliance with the Foreign Corrupt Practices Act. Red flags include payments routed through intermediaries in high-corruption jurisdictions, unusually large commissions to agents with government connections, and third parties who refuse to disclose ownership or accept anti-bribery provisions. The buyer can inherit criminal and civil liability for the target’s past violations.
Industry-specific compliance rounds out this section. A healthcare target needs a review of billing practices and fraud-and-abuse compliance. A financial services company needs an assessment of licensing and examination history. The report identifies any regulatory actions, consent orders, or ongoing investigations that could constrain the business or require expensive remediation after closing.
How the Information Gets Gathered
The process typically takes 30 to 90 days. Smaller transactions with clean records can close in a month; complex deals with multinational operations can stretch well beyond 90 days.
The seller makes documents available through a virtual data room, a secure online platform that lets multiple buyer teams review sensitive materials at once. The VDR tracks every document viewed and downloaded, creating an audit trail that matters later if there’s a dispute about what was disclosed. A poorly organized or deliberately sparse data room is itself a red flag, and completeness of production often correlates with the quality of the target’s internal controls.
Specialized teams work in parallel. Lawyers focus on contracts and corporate governance. Accountants dig into general ledgers, supporting schedules, and source documents like invoices and bank statements. Operational analysts review customer data, equipment records, and organizational charts. Each team generates follow-up questions submitted through formal Q&A logs, and the answers (or non-answers) feed directly into the report. Financial analysts trace material line items back to underlying documentation; when a revenue figure doesn’t reconcile to invoices, or an expense category shows unexplained spikes, those discrepancies become agenda items for management interviews.
Interviews with the target’s leadership serve two purposes: verifying what the documents show and uncovering what they don’t. Conversations with the CFO focus on accounting policies, internal controls, and the rationale behind unusual entries. Operational leaders explain supply chain dependencies, customer relationships, and workflow bottlenecks that financial data can’t reveal. Any inconsistency between verbal description and documentation gets flagged for deeper investigation, and those contradictions often produce the most material findings.
External sources provide independent validation. Industry experts assess market growth assumptions. Customer and supplier surveys gauge relationship strength and renewal likelihood. Phase I environmental assessments come from qualified environmental professionals. Background checks on senior executives and key employees, when conducted through a third-party agency, require compliance with the Fair Credit Reporting Act: the buyer must provide the individual a standalone written disclosure that a background report may be obtained, and the individual must authorize it in writing before the report is ordered.7Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports Skipping this step creates litigation risk from the first day of ownership.
Clean Team Protocols
When buyer and seller are competitors, sharing customer data, pricing strategies, and expansion plans during diligence creates antitrust risk. The standard safeguard is a “clean team”: a small group of individuals, typically outside counsel and dedicated analysts with no operational decision-making role, who review the sensitive information in a restricted data room and cannot share what they’ve seen with anyone involved in day-to-day business decisions. In some deals, a third-party firm aggregates the data so even clean team members don’t see individual customer details. All competitively sensitive data must be destroyed if the deal falls through.
How the Report Is Assembled
The finished report is designed for senior decision-makers who need to act on it, not study it. Speed of comprehension governs the structure.
The executive summary is the most-read section and often the only section some decision-makers finish. It presents the two or three most significant findings, the normalized EBITDA alongside a bridge showing exactly how the buyer’s team arrived at it from the seller’s reported number, and a clear conclusion about whether the target can support the proposed price. If there’s a deal-breaking issue, it appears on the first page.
A risk matrix organizes every finding by severity and estimated financial impact, typically in three tiers of high, medium, and low. Each item includes a recommended mitigation strategy. Some risks call for a purchase price reduction. Others are better addressed through specific contractual protections, an escrow holdback, or a post-closing remediation plan with a cost-to-cure estimate. The matrix turns a sprawling investigation into a prioritized negotiation agenda.
Appendices contain the detailed work product supporting the main report: complete Quality of Earnings adjustment schedules, working capital calculations, contract summaries, litigation exposure estimates, and excerpts from key legal documents. This section lets the buyer’s internal finance and legal teams independently verify the report’s conclusions without requesting the underlying data twice.
How the Report Shapes the Deal
Every finding translates into a specific action during the final negotiation. Buyers who don’t use the report aggressively leave value on the table.
Purchase Price Adjustments
The most direct impact comes from the Quality of Earnings analysis. If normalized EBITDA is lower than what the seller represented, enterprise value drops by the difference multiplied by the valuation multiple. A $500,000 earnings adjustment at a 7x multiple reduces enterprise value by $3.5 million. Undisclosed liabilities identified during diligence, such as an unfunded severance obligation or a pending regulatory fine, are typically deducted dollar-for-dollar from equity value.
Working Capital True-Up
Because the exact working capital balance on closing usually can’t be determined for weeks, most purchase agreements include a two-step mechanism. The seller provides an estimate of closing working capital, and the price is initially adjusted based on that estimate. After closing, the buyer has a defined window, usually 60 to 120 days, to calculate the actual figure and compare it to the agreed target. If actual working capital falls short, the price decreases; if it exceeds the target, the price increases. Disputes go to an independent accountant, not a court, which keeps resolution focused on accounting rather than legal arguments.
Representations, Warranties, and Indemnification
Diligence findings drive the representations and warranties section of the purchase agreement. For every significant risk identified in the report, the buyer requests that the seller make a specific, legally binding representation about the state of affairs. If that representation turns out to be false, the seller owes the buyer money under the indemnification provisions.
Indemnification obligations are typically secured by an escrow account that holds back part of the purchase price for a defined survival period, usually 12 to 24 months for general representations and longer for tax and fraud claims. The report’s quantification of potential liabilities directly informs the size of the escrow and the cap on the seller’s total indemnification exposure.
Representations and Warranties Insurance
Buyers increasingly supplement contractual indemnification with representations and warranties (R&W) insurance, a policy that covers losses from breaches of the seller’s representations. This shifts risk from the seller to an insurance carrier, making deals possible where the seller refuses a large escrow or where the buyer wants recourse beyond the seller’s financial capacity. As of mid-2025, premiums run roughly 2.5% to 3% of policy limits, with retentions as low as 0.5% of enterprise value for clean deals. The due diligence report is the primary document the insurer reviews when pricing the policy and deciding what exclusions to impose, so a thorough report directly affects both coverage and cost.
The Go/No-Go Decision
Sometimes the report’s conclusion is that the deal shouldn’t happen. If the magnitude of identified risks fundamentally changes the investment thesis, if normalized earnings can’t support the asking price even after adjustments, or if the legal exposure is uninsurable and unquantifiable, the right move is to walk away. That outcome doesn’t mean the diligence failed. It means it worked.