Due Diligence

Definition: The investigative process investors or acquirers conduct to verify a company’s financials, legal standing, and business claims before finalizing a deal.

How It Works

The Diligence Timeline

Formal due diligence typically begins once both sides sign a Term Sheet or letter of intent, which grants the investor or acquirer a window of exclusivity to investigate before money changes hands
Informal diligence often starts earlier than founders realize — investors quietly check customer references, product reviews, and public metrics before ever sending a term sheet
A venture round’s diligence window commonly runs two to six weeks for a Seed or Series A; a strategic acquisition can stretch to two to six months given the depth of legal, financial, and technical review involved
The process ends one of two ways: a clean pass that moves the deal to closing, or a “diligence kill,” where discovered issues are serious enough that the buyer walks away or forces a repriced deal
Sophisticated founders run a light internal diligence pass on themselves before ever raising, fixing obvious gaps — missing IP assignments, informal equity promises — before an outside party finds them
Deadlines matter: a diligence period with no end date tends to drift, so experienced founders push for a fixed window written into the term sheet itself

What Gets Reviewed

Financial: revenue recognition practices, historical statements, bank records, outstanding debt, and burn trajectory (see Runway and Burn Rate)
Legal: corporate structure, the full Cap Table, prior financing paperwork such as SAFE (Simple Agreement for Future Equity) and Convertible Note agreements, pending or threatened litigation, and intellectual property assignments from every founder, employee, and contractor
Commercial: customer contracts, revenue concentration risk (how much comes from the top few accounts), retention and Churn Rate trends, and the durability of the company’s Unit Economics
Technical: codebase quality, security posture, accumulated technical debt, and whether any open-source licenses in use would impose obligations on the acquirer
Team and HR: employment agreements, Vesting and Cliff schedules, non-compete and non-solicit terms, and a candid read on whether key employees will actually stay through and after closing
Regulatory and compliance: industry-specific licenses, data privacy practices, and tax filings, which matter disproportionately in regulated sectors like fintech, healthtech, and consumer lending

Technical Diligence Deep Dive

Architecture review: whether the system can plausibly scale to the growth the company is projecting, or whether it was built for a much smaller user base
Test coverage and deployment practices: how confidently the team can ship changes without breaking production, and how often they actually do
Security posture: past incidents, how customer data is stored and encrypted, and whether basic practices like access controls and audit logs exist
Key-person risk: whether critical systems are understood by more than one engineer, sometimes called the “bus factor”
Dependency and licensing review: whether any open-source components carry licenses (like AGPL) that could create obligations for an acquirer
Infrastructure cost trends: whether hosting and tooling costs are scaling in line with usage, or quietly outpacing revenue growth

Reverse Diligence: What Founders Should Check Too

Diligence isn’t one-directional — founders should investigate an investor before signing, since a bad investor is a decade-long relationship, not a single transaction
Talk to founders of the investor’s other portfolio companies, especially ones that struggled, to learn how the investor behaves when things go badly
Check whether the investor has capital reserved for follow-on rounds, since a fund that can’t participate later sends a negative signal to future investors
Ask directly about board behavior: how often the investor intervenes operationally versus staying at a governance level (see Board of Directors)
Review whether the investor has any portfolio conflicts — a competing investment in the same space can create friction or information leakage
Confirm the fund itself is in good standing; a fund near the end of its investment life may push for a faster exit than the founder wants

Depth of Diligence by Deal Stage

Stage	Typical duration	Who conducts it	Primary focus
Pre-seed / Angel	Days	The angel personally, informal reference calls	Founder credibility, market size, basic legal hygiene
Seed	1–3 weeks	Lead investor plus outside counsel	Cap table cleanliness, IP assignment, early metrics
Series A	2–6 weeks	VC associates, outside counsel, sometimes a technical reviewer	Unit economics, customer contracts, technical debt
Growth / Late stage	4–10 weeks	Investment bank, accounting firm, outside counsel	Full financial audit, legal, tax, regulatory review
M&A / Acquisition	2–6 months	Acquirer’s internal M&A team, outside counsel, auditors	Everything above, plus integration risk and indemnification basis

Common Diligence Requests, By Function

Function	What they typically request
Finance	P&L, balance sheet, bank statements, accounts receivable/payable aging
Legal	Cap table, IP assignments, material contracts, litigation history
Product / Engineering	Architecture docs, security audit results, uptime and incident history
HR	Org chart, employment agreements, equity grants, hiring plan
Sales	Customer contracts, pipeline data, cohort-level churn

The Data Room Checklist

A well-prepared data room typically includes:

Certificate of incorporation, bylaws, and historical board consents and minutes
The full Cap Table alongside every financing document — SAFEs, convertible notes, and stock purchase agreements
Financial statements and bank records for the trailing twelve to twenty-four months
All material customer and vendor contracts, especially any with unusual termination or exclusivity terms
IP assignment agreements for every founder, employee, and contractor, plus any registered patents or trademarks
Employment agreements, offer letters, and documentation of every equity grant and its Vesting and Cliff schedule
Insurance policies and a record of any pending, threatened, or resolved litigation
A key metrics dashboard covering revenue, Churn Rate, CAC/LTV, and burn rate

Buy-Side vs. Sell-Side Diligence

	Buy-side (investor / acquirer)	Sell-side (founder)
Primary goal	Confirm the company is what it claims to be	Present an organized, defensible story
Who runs it	Lawyers, accountants, sometimes technical auditors	Founders, general counsel, finance lead
Typical output	A diligence memo flagging risks and open questions	A data room that answers likely questions before they’re asked
Main leverage	Can walk away or reprice the deal	Can lose weeks of momentum and investor confidence if unprepared
Best-case outcome	No material surprises found	Diligence becomes a formality rather than a renegotiation

Why It Matters

Protects investors and acquirers from fraud, undisclosed liabilities, or a business that is materially weaker than its pitch suggested
A clean, well-organized diligence process is itself a signal to investors — it says the company is run with discipline, which builds trust that outlasts the transaction
Findings routinely reshape deal terms: a discovered liability, a messy cap table, or customer concentration risk can trigger a lower valuation or added protective provisions rather than an outright walk-away
For founders, anticipating likely diligence questions before they’re asked — through a well-organized data room — preserves negotiating leverage and keeps the deal on schedule
Sloppy diligence prep is one of the most common reasons a signed term sheet fails to convert into a closed, funded round; momentum and investor confidence erode with every unanswered request
In M&A specifically, diligence findings often become the factual basis for post-closing indemnification claims, so what is found — or missed — has consequences long after the deal closes
For employees and early investors, thorough diligence indirectly protects their equity too, since it lowers the odds of a deal collapsing or being repriced downward late in the process
A founder who treats diligence requests as an adversarial audit, rather than a collaborative verification process, tends to slow their own raise and erode goodwill right when they need it most

Common Pitfalls

Treating the data room as an afterthought: scrambling to assemble contracts, cap table history, and IP assignments only after diligence begins — rather than keeping them current continuously — signals disorganization and slows everything down
Undisclosed side agreements: verbal promises made to early employees or advisors that were never formalized in writing tend to surface during diligence and can damage trust even when the dollar amounts involved are small
Messy or inconsistent cap tables: informally tracked equity grants are one of the most common diligence red flags, especially when founder or advisor equity was never properly documented (see Cap Table)
Customer concentration surprises: disclosing late in the process that a large share of revenue comes from one account, rather than surfacing it upfront, damages credibility even when the underlying business is sound
Missing IP assignments: work performed by early contractors or co-founders without a signed IP assignment agreement can create genuine ownership disputes that stall or kill a deal entirely
Underestimating the time cost: founders who don’t dedicate real bandwidth to answering diligence requests can inadvertently slow their own raise, burning runway while the process drags on
Confusing a signed term sheet with a done deal: term sheets are typically non-binding on price and most terms; diligence is where deals actually fall apart, so founders shouldn’t ease off other fundraising conversations until funds are actually in the bank

Red Flags That Kill Deals

Revenue that doesn’t reconcile between what was pitched in the Pitch Deck and what the bank statements actually show
Founders or key employees with unresolved IP or non-compete conflicts carried over from a previous employer
A cap table with more equity promised on paper than actually exists — an over-allocated option pool or side letters that don’t match the official record
Undisclosed related-party transactions, such as a founder’s other company acting as a major customer or vendor
Pending or threatened litigation that was never mentioned during earlier conversations with the investor
A pattern of key employees departing right before or during the diligence window, suggesting internal problems the founder hasn’t disclosed
Inconsistent metrics between what’s shown in investor updates and what the raw underlying data actually supports

Diligence Questionnaire: Common Investor Asks

Founders preparing for diligence should be ready to answer, in detail and with documentation:

What percentage of revenue comes from your largest customer, and your top five combined?
Walk me through every equity grant on the cap table and its current vesting status
Has any founder, employee, or advisor ever threatened legal action against the company?
What happens to the business if your top two engineers left tomorrow?
Show me monthly burn and runway for the last twelve months, not just the current snapshot
Are there any contracts with change-of-control clauses that would be triggered by this deal?
What’s your actual, cohort-based Churn Rate, not just the headline retention number?
Has the company ever missed a tax filing, payroll run, or regulatory deadline?
Who else has looked at this deal, and did anyone pass — and if so, why?

After Diligence: Common Outcomes

Clean close: no material issues found, and the deal proceeds on the terms in the original term sheet
Repriced deal: discovered risk (customer concentration, weaker margins than claimed) leads the investor to renegotiate valuation downward
Added protective provisions: the investor keeps the price but adds terms like a holdback, milestone-based tranches, or stronger board rights
Escrow or indemnification holdback: in M&A, a portion of proceeds is held back for a set period to cover any liabilities that surface post-closing
Deal termination: a serious enough finding — fraud, major undisclosed liability, IP that isn’t actually owned by the company — causes the buyer to walk away entirely

Who Pays for Diligence

Investors and acquirers typically bear their own diligence costs — legal fees, accounting review, and any technical audit they commission
Founders bear the opportunity cost of the time spent responding, which can be substantial for a small team mid-raise
In M&A, the target company sometimes pays a “diligence retainer” toward the acquirer’s legal fees if the deal falls through after a certain point, so founders should read break-up terms in the letter of intent carefully
Larger rounds increasingly involve founders hiring their own counsel to run a pre-emptive internal diligence pass, treating it as insurance against a slower, costlier process later
Technical diligence firms hired by growth-stage investors are usually paid by the investor, but their findings directly shape the price the founder ultimately receives

Preparing for Diligence as a Founder

Keep a running, always-current data room from the earliest fundraising stage rather than assembling one under deadline pressure — it turns diligence from a fire drill into a formality
Get every contractor, advisor, and early employee to sign IP assignment and confidentiality agreements at the time they start work, not retroactively when a deal is already underway
Reconcile the Cap Table against actual signed documents at least once a year so there’s never a gap between what’s promised and what’s recorded
Flag known weaknesses — customer concentration, a pending hire’s departure, a messy early SAFE stack — to the investor proactively, since surprises discovered independently are far more damaging than the same fact disclosed upfront
Assign one internal owner (often the founder or a finance lead) to coordinate diligence requests so nothing falls through the cracks across a small team
Run a mock diligence pass with your own lawyer before a raise starts, treating it as a rehearsal for the real thing

Example

A Series A investor sends a term sheet to a startup after two strong partner meetings, kicking off a four-week diligence window. The investor’s lawyers request the full data room: incorporation documents, the complete cap table history, every SAFE (Simple Agreement for Future Equity) issued during the seed round, current customer contracts, and IP assignment agreements for all four co-founders.

Midway through the process, the lawyers discover that one early contractor who built the original prototype never signed an IP assignment — a gap that, left unresolved, would mean the company doesn’t cleanly own part of its own codebase. The founders scramble to track down the former contractor and get a retroactive assignment signed and notarized.

Diligence closes a week later than planned, but cleanly, and the round funds on the original terms. Meanwhile, the founders run their own reverse diligence in parallel — calling two portfolio companies of the same investor to ask how the fund behaves during a down year — and come away confident enough to sign. A single unresolved gap could easily have become a dealbreaker or a repriced round had it surfaced after closing instead of before it.

Referenced by

Dig deeper

Spot an error in this note?