M&A Due Diligence Checklist: The 47 Items Buyers Verify Before Signing the Purchase Agreement

An M&A due diligence checklist is the structured verification list a buyer works through between signing the Letter of Intent and signing the definitive purchase agreement. It covers 40–50 distinct items across financial, legal, tax, commercial, operational, HR, IT and environmental workstreams, typically takes 30 to 90 days, and costs the buyer between $50,000 and $300,000 in third-party fees on a lower-middle-market deal. Skip an item and you inherit it — HP paid $8.8 billion in writedowns on Autonomy to learn that lesson in public.

This guide breaks the M&A due diligence checklist into the 47 items experienced buyers actually verify before signing, why each one matters, and where the process most often breaks. If you want a plug-and-play spreadsheet model version, the ModelStack IB & M&A kit ships a working Excel template of the full list — but you can implement everything below from scratch using the framework here.

Why the M&A Due Diligence Checklist Exists

Almost 60% of executives who lived through a failed acquisition blame poor due diligence for missing the critical issue, according to Bain & Company's 2020 Global M&A Report analysis. Bain's more recent April 2025 look-back concluded that among large repeat acquirers — the KKRs, Danahers and Constellation Softwares of the world — roughly 70% of deals now succeed, precisely because they run a disciplined checklist every time. The gap between the 70% failure rate cited for first-time buyers and the 70% success rate at serial acquirers is almost entirely process discipline.

The checklist has three jobs: confirm the seller owns and can legally transfer what it says it's selling, validate that the EBITDA and working capital shown in the CIM will survive contact with a Quality of Earnings report, and surface the contracts, liabilities and integration risks that reprice or kill the deal. Every item below serves one of those three jobs.

Financial Due Diligence: 12 Items to Verify

Financial diligence is where the purchase price gets rewritten. A single rejected EBITDA add-back can move price by 5–7x on a lower-middle-market deal — on a $10M deal a rejected $200K add-back is a $1M–$1.4M haircut. The Quality of Earnings report is the single most important artifact here; every buyer running a competitive process gets one from PwC, KPMG, Deloitte, EY or a specialty QoE shop before final bid.

Three years of audited financial statements plus trailing-twelve-month management accounts
Quality of Earnings report validating run-rate adjusted EBITDA and all seller add-backs
Net working capital analysis with a rolling 12-month peg for the closing adjustment
Full capitalization table including options, warrants, SAFEs and convertible notes
All loan and credit agreements, including change-of-control provisions
Capital leases, deferred revenue balances, earn-outs and accrued bonus obligations
Off-balance-sheet obligations — indemnities, guarantees, letters of credit
Customer concentration analysis (revenue by top 10, top 20, cohort retention)
Aged accounts receivable and bad-debt reserve methodology
Inventory obsolescence reserve and physical count reconciliation
Capex history split between maintenance and growth
Budget-to-actual variance for the last three fiscal years

The working capital peg alone routinely moves purchase price by $500K on a $10M deal, per Valutico's 2025 QoE guidance. Sellers instinctively strip working capital before close; a properly built peg gives the buyer the working capital needed to run the business day one without a second capital call. Takeaway: commission the QoE the day the LOI is signed, not the week before closing — three weeks is the minimum realistic turnaround.

Legal, Corporate and IP Verification: 11 Items

Legal diligence answers a simple question: does the seller actually own what it's selling? The HP–Autonomy collapse in 2011–2012, where HP wrote down $8.8 billion of the $11 billion purchase price, was ultimately a financial fraud story — but the CIO magazine timeline and Forbes coverage from Francine McKenna both show the M&A team reported to HP's chief strategy officer rather than the CFO, and Deloitte's diligence work was reviewed by KPMG rather than a specialist forensic accountant. Governance of the diligence function is itself part of the diligence.

Articles of incorporation, bylaws, and all amendments
Board and shareholder meeting minutes for the last five years
Cap table reconciliation with signed stock ledger and 409A valuations
All contracts above a materiality threshold ($100K is a common cut) with change-of-control clauses flagged
Issued patents, pending applications, trademarks and copyright registrations
IP assignment agreements from every employee and contractor who touched code or design
Inbound and outbound license agreements, including open-source usage inventory
Litigation schedule: active, threatened, and settled in the last five years
Regulatory licenses required to operate — and their assignability
Antitrust analysis under HSR thresholds ($126.4M for 2025 filings per the FTC)
Prior M&A activity, including any indemnity survival still running

The Microsoft–Activision deal, closed October 13, 2023, for $68.7B after FTC Judge Jacqueline Scott Corley rejected the preliminary injunction on July 11, 2023, is the modern reference case on the antitrust workstream. Microsoft's remedy package — 10-year Call of Duty commitments to Nintendo, Sony, Nvidia, Boosteroid, Nware and Ubitus — was drafted and negotiated during diligence, not after. If your deal is over the HSR threshold, the regulatory workstream starts in week one. Takeaway: pull a full IP assignment audit even on a "clean" software target; a single unassigned contributor can cloud the entire codebase.

Commercial, Customer and Operations Diligence: 10 Items

About half of deals over $250 million fail to deliver expected returns, and Bain attributes the miss squarely to commercial due diligence — buyers accepting the seller's TAM slide instead of triangulating it. This is where the buyer's operating team, not the deal lawyers, has to lead.

Independent customer reference calls — 15 to 25 across top accounts, at-risk accounts, and lost logos
Win/loss analysis for the trailing 24 months with named competitors
Pipeline coverage ratio and stage-conversion history
Product roadmap with engineering capacity to deliver it
Supplier concentration and single-source dependencies
Manufacturing capacity utilization and unit-economics build
Real estate leases with assignment and change-of-control terms
Insurance policies, claims history, and coverage gaps
Cybersecurity posture: SOC 2, ISO 27001, penetration test results from the last 12 months
Data privacy compliance — GDPR, CCPA/CPRA, HIPAA where applicable

Takeaway: the customer reference call program is the single highest-signal, lowest-cost step in commercial diligence. Buyers who skip it in the interest of speed almost always regret it within 12 months post-close.

People, Tax and Environmental: 8 Items

These three workstreams don't reprice deals as often, but when they do, the numbers are large. Employment-triggered severance stacks fast, tax exposures compound with interest and penalties, and environmental liability is joint-and-several under CERCLA.

Employment agreements for the top 15 executives, including CIC/severance triggers
Equity compensation plans and vesting acceleration on change of control
Benefits plans, 401(k) audits, and any underfunded pension exposure
Independent contractor classification review (post-AB5 and DOL 2024 rule)
Federal, state and international tax returns for the last three to five years
Sales tax nexus study — a step-by-step review of every state where the target has economic nexus under Wayfair
Transfer pricing documentation for any cross-border intercompany activity
Phase I environmental site assessment on every owned real property

Takeaway: the sales tax nexus workstream is the sleeper. A SaaS target that never registered in the 24 economic-nexus states can carry a seven-figure exposure that only surfaces when a state notices the acquired entity's new parent. Quantify it and pull the number out of purchase price or into a specific indemnity.

Integration Readiness and Deal Protection: 6 Items

The Bain finding on serial acquirers hinges on one behavior: integration planning starts during diligence, not after signing. The last block of the checklist is the buyer's own readiness plus the deal-mechanics belt-and-suspenders.

Day-one integration plan with named workstream owners on both sides
Synergy build — cost and revenue — with owner, dollar value, and realization date per line
Retention agreements for the 10–20 employees whose departure would break the thesis
Representations & warranties insurance quote — market rates have compressed to as low as 2.5% of policy limit with retentions down to 0.5% of enterprise value in 2025, per WTW's Insurance Marketplace Realities and AssuredPartners' 2025 update, and coverage is available on deals as small as $25M
Escrow and indemnity terms sized to the RWI retention, not to a legacy 10%-for-18-months default
Working capital true-up mechanics with a defined dispute resolution path

Takeaway: R&W insurance changed the negotiation permanently — a seller who refuses to consider a buyer-side RWI policy in 2025 is signaling something about the reps. Ask why.

How to Actually Run the 47 Items

The tactical structure that works is a virtual data room organized by the same nine workstreams the checklist uses — financial, legal, tax, commercial, operations, HR, IT/cyber, environmental, integration — with a single tracking spreadsheet that has one row per item, an owner name, a status (Not started / Requested / In review / Cleared / Escalated), a materiality flag, and a link to the file in the VDR. Update it weekly. Review the escalated rows in every deal-team standup.

The most common mistake first-time buyers make is treating the checklist as a document-collection exercise. It isn't. It's a hypothesis-testing exercise: for every item, write down what you expect to find, then read the document and record what you actually found and what it means for value. That framing is what separates a diligence process from a diligence performance.

Ready-made spreadsheet models for the full 47-item checklist, the working capital peg calculation, the QoE add-back tracker, the synergy build, and the sources-and-uses model live in the ModelStack IB & M&A template kit. Every model ships as an editable Excel template with example inputs, so you can drop your target's numbers in and be running by the afternoon of the day the LOI is signed. That's the difference between a $200K diligence spend that returns a repriced deal and a $200K spend that returns a folder of PDFs.