Business Finance

M&A due diligence

PE & M&ADifficulty: ★★★☆☆

Which bets to make. Capital allocation, M&A due diligence, portfolio construction.

You're evaluating a $18M acquisition of a SaaS company. The Financial Statements show $3M ARR, $2.5M EBITDA, and 25% year-over-year Revenue growth. The Valuation looks reasonable on paper. But Financial Statements only tell you what already happened - they don't tell you if the seller is hiding a customer who just gave notice, recurring costs disguised as one-time expenses, or Compliance Risk that hasn't surfaced yet. You have 45 days and access to every document the company has ever produced. Somewhere in that pile is either confirmation that your Valuation holds - or evidence you're about to overpay by millions.

TL;DR:

M&A due diligence is the systematic investigation you run before committing Capital to an acquisition - stress-testing the seller's Financial Statements, operational reality, and hidden risks against your Valuation model so you pay for the business that actually exists, not the one the seller is pitching.

What It Is

M&A due diligence is the investigation phase between agreeing on a price and actually wiring the money. Your Valuation model made assumptions about Revenue growth, Cost Structure, Churn Rate, and Cash Flow. Due diligence tests whether those assumptions are true.

It has three workstreams that run in parallel:

  • Financial diligence - verify the numbers in the Financial Statements are real and repeatable
  • Operational diligence - verify the business engine behind the numbers will keep running post-acquisition
  • Legal and compliance diligence - verify there are no hidden liabilities, regulatory exposure, or contract review landmines

You already know Financial Statements are a system - Balance Sheet, P&L, and Cash Flow read together. Due diligence is where you pressure-test that system against source documents: contracts, bank statements, customer records, employment agreements. The seller's Financial Statements are their argument for the price. Due diligence is your cross-examination.

Why Operators Care

If you're the Operator, you inherit what gets bought - including every problem due diligence should have found but didn't.

A financial analyst might flag that EBITDA looks aggressive. But only an Operator will notice that Revenue depends on Tribal Knowledge locked in the founder's head, that the Pipeline is full of one-time projects being reported as recurring, or that the Cost Structure assumes a team that's already interviewing elsewhere.

Every due diligence finding maps directly to your P&L on Day 1. Overstated Revenue becomes your Revenue shortfall. Hidden costs become your Cost Structure. Undisclosed Compliance Risk becomes your legal bill. The cost of thorough diligence is measured in weeks. The cost of skipping it is measured in millions.

For PE portfolio companies, due diligence also determines whether the Capital Allocation decision was sound. The Allocator decides where to deploy capital. The Operator decides whether the specific target is worth it. Due diligence is the Operator's veto.

How It Works

Financial Diligence: Are the Numbers Real?

Start with Revenue Recognition. How does the company recognize Revenue? Pull every customer contract and reconcile it against reported ARR. Look for:

  • Customer concentration - if 3 customers represent 40% of Revenue, that's not a diversified business, it's three relationships
  • Churn masking - the seller may report a low Churn Rate by netting customer departures against Expansion Revenue from remaining accounts. Decompose the number: how many customers actually left?
  • One-time items in EBITDA - sellers will present expenses as one-time to inflate EBITDA. Your job: check whether those same 'one-time' costs appeared last year, and the year before. If they did, they're recurring costs misclassified to make the P&L look better
  • Cash Flow vs Profit - a P&L can show Profit while Cash Flow tells a different story. Check whether Revenue is actually being collected (look at the Balance Sheet for growing receivables)

Operational Diligence: Will the Numbers Persist?

Financial Statements describe the past. Operational diligence predicts the future:

  • Tribal Knowledge risk - if key relationships, processes, or institutional knowledge live in a few people's heads, the Operating Value of the business walks out the door when they leave. Document who knows what, who talks to which customers, who maintains critical systems
  • Competitive Advantage durability - is there a real competitive moat (Data Moat, switching costs, Informational Advantage), or is the company simply in a market without much competition yet?
  • Unit Economics under new ownership - the seller's Cost Structure may not be yours. If the founder does sales, engineering leadership, and customer support, your Cost Structure will include three salaries the current P&L doesn't show
  • Pipeline quality - is the sales Pipeline real opportunities with committed Buyers, or a list of anyone who ever replied to an email?

Legal and Compliance Diligence: What's Hidden?

  • contract review - read every material contract. Look for change-of-control clauses (contracts that terminate on acquisition), exclusivity terms, and unfavorable renewal conditions
  • Contingent Liabilities - pending lawsuits, warranty claims, customer disputes. These are liabilities that don't appear on the Balance Sheet until they trigger
  • Off-Balance-Sheet Risks - operating leases, guarantees, commitments not captured in Financial Statements
  • Compliance Risk - regulatory exposure in areas like data privacy, licensing, product certifications. This is Tail Risk: low probability but potentially catastrophic

For technology acquisitions, M&A Technical Due Diligence adds a fourth workstream: code quality, infrastructure, security posture, and engineering team retention risk.

Every finding is a lever. It either confirms your Valuation, forces a Valuation adjustment, triggers a Closing Adjustments mechanism (where part of the price is held back against specific risks), or activates your Exit Criteria to walk away.

When to Use It

Every acquisition needs due diligence. The scale matches the deal:

  • Small acquisitions ($1-5M): 2-4 weeks. You and maybe one financial analyst. Focus on the top 3 risks: Revenue quality, key-person dependency, and hidden liabilities.
  • Mid-market ($5-50M): 30-60 days. Dedicated team covering financial, operational, and legal workstreams. External auditing for Financial Statements. M&A Technical Due Diligence if it's a technology business.
  • Large deals ($50M+): 60-90 days. Full diligence teams per workstream. Third-party verification of EBITDA. Sensitivity Analysis on every major assumption. LBO Modeling stress-tested against diligence findings.

The decision framework is a decision tree: before you start, define your Exit Criteria. What would you need to find to kill the deal? What findings would reduce your bid by 10%? By 25%? By 50%? If you don't define these thresholds upfront, you'll rationalize away bad findings because of sunk cost and deal momentum.

Rule of thumb: if due diligence costs 1-2% of the deal value, and it prevents even one material overpayment, it has infinite ROI. The opportunity cost of skipping it is a bad acquisition you're stuck operating for years.

Worked Examples (2)

SaaS Acquisition: The Seller's EBITDA Was a Fiction

You're evaluating a SaaS company for $18M. The seller presents: $3M ARR, $2.5M EBITDA, 25% year-over-year Revenue growth, 5% annual Churn Rate. The price implies roughly 7.2 times EBITDA. You begin 45 days of due diligence.

  1. Revenue concentration analysis. Pull the customer list with contract values. You find 3 customers represent $1.26M of ARR (42% of total Revenue). The largest customer at $600K/year has a contract expiring in 4 months - and the renewal conversation hasn't started. If that customer churns, ARR drops to $2.4M overnight.

  2. Churn Rate decomposition. The seller's 5% Churn Rate is net of Expansion Revenue. Decomposing the data by cohort: 15% of customers by count leave each year, but upsells to remaining accounts mask the departures. True customer departure rate is 3x the reported figure, meaning the business needs aggressive Expansion Revenue just to hold flat.

  3. EBITDA verification. The P&L shows $400K in 'one-time consulting fees' that the seller excludes from the EBITDA calculation. Checking the prior 3 years: the same line item appears every year at $350-$450K. This is a recurring cost. Adjusted EBITDA: $2.5M - $400K = $2.1M.

  4. Cash Flow cross-check. Balance Sheet shows accounts receivable grew 40% year-over-year while Revenue grew 25%. The company is booking Revenue faster than collecting it. Cash Flow from operations is only $1.6M despite $2.5M reported EBITDA.

  5. Revised Valuation. Using Discounted Cash Flow with adjusted EBITDA of $2.1M, a 15% true Churn Rate, and customer concentration risk, the NPV over a 5-year Investment Horizon at a 12% Discount Rate comes to approximately $13.5M. You present the seller with a revised offer of $14M with Closing Adjustments: $2M held back for 12 months, released only if the top customer renews.

Insight: The difference between the seller's $18M ask and your $13.5M Risk-Adjusted Value came from three findings that took days, not months, to uncover. The Financial Statements weren't falsified - they were framed. Due diligence strips the frame away.

Services Firm: Clean Financials, Dangerous Operations

A PE firm evaluates an $8M acquisition of a 15-person consulting firm. Financial Statements show $5.3M Revenue, $1.5M EBITDA growing 10% annually. Balance Sheet is clean: no debt, $400K in quarterly Cash Flow, positive working capital.

  1. Financial diligence passes. Revenue Recognition is straightforward - time-and-materials billing with monthly invoices. EBITDA holds up under scrutiny. No reclassifications needed. On paper, this looks like a clean deal.

  2. Operational diligence reveals the trap. The founder personally manages all 8 enterprise client relationships. There is no documented sales process, no system of record for client history, and no second contact at any account. This is pure Tribal Knowledge - the Revenue is attached to a person, not the firm.

  3. Key-person risk assessment. Two of the five senior engineers have no employment agreements restricting them from leaving and starting a competing firm. They hold the institutional knowledge for the firm's three largest client engagements. If they leave, the clients follow.

  4. Probability-weighted Revenue risk. Based on comparable acquisitions, there's roughly a 30% chance the founder disengages within 18 months post-close. Revenue at risk if that happens: 60% of $5.3M = $3.18M. Expected Value of annual Revenue loss: 0.30 x $3.18M = $954K. That's 18% of total Revenue in expected annual risk.

  5. Restructured offer. Instead of $8M upfront, you propose $5.5M at close plus $2.5M released over 24 months, contingent on Revenue retention above 90% of the base case. The Closing Adjustments convert a hidden operational risk into a contractual protection.

Insight: Financial Statements told you the business was healthy. Operational due diligence told you the health depended on one person. Without the restructured deal, you'd have paid $8M for a business whose Operating Value could collapse by 60% in 18 months.

Key Takeaways

  • Due diligence exists to close the gap between what the seller presents and what's actually true. The Financial Statements are the seller's best argument for their price - your job is to verify every assumption underneath.

  • Financial diligence verifies the numbers; operational diligence verifies whether the numbers will persist. A business with perfect Financial Statements and a single key-person dependency is a fragile Asset, not a strong one.

  • Every finding is a lever - it either confirms your Valuation, adjusts the price, triggers Closing Adjustments to share risk with the seller, or activates your Exit Criteria to walk away. Define those thresholds before you start, not after you're emotionally invested in closing.

Common Mistakes

  • Treating due diligence as a checkbox exercise instead of a Valuation stress-test. Teams that run through a standard checklist without connecting each finding back to the financial model miss the point. Every diligence item should answer: does this change what I'm willing to pay? If you can't map a finding to a dollar impact, you're doing paperwork, not analysis.

  • Anchoring on the seller's EBITDA without independent verification. Sellers have every incentive to present the most favorable version of their financials - excluding recurring costs as 'one-time,' netting Churn against Expansion Revenue, recognizing Revenue aggressively. If you build your Valuation on the seller's EBITDA without adjusting, you've already fallen for the winner's curse: you'll pay the highest price because you believed the most optimistic story.

Practice

easy

You're reviewing a target company's P&L during due diligence. Reported EBITDA is $1.2M. The seller wants you to exclude three items from the EBITDA calculation to show 'true profitability': (a) a $200K legal settlement the company received this year, (b) $80K the founder paid himself above market-rate salary, (c) $50K for emergency equipment replacement. What is your adjusted EBITDA, and why?

Hint: For each item, ask: will this line appear again next year under new ownership? Items that inflate EBITDA should be removed; items that won't recur under new ownership can be legitimately excluded.

Show solution

(a) The $200K legal settlement is one-time income that inflated EBITDA. It won't happen again. Subtract it: EBITDA drops by $200K. (b) The $80K above-market salary is legitimate to exclude: under new ownership, you'd hire a replacement at market rate, so EBITDA would be $80K higher. Add it back. (c) Equipment replacement: does equipment break every year? If so, it's a recurring cost and should stay in. Be conservative and assume it recurs. Adjusted EBITDA = $1.2M - $200K + $80K = $1.08M. The seller was trying to present $1.5M ($1.2M + $200K + $80K + $50K excluded), but reality is $1.08M - a 28% gap.

medium

A target has $5M ARR across 200 customers. Breakdown: top customer = $1.2M/year (24%), next 4 customers = $300K each ($1.2M total, 24%), remaining 195 customers = $2.6M (52%). Historical Churn Rate: 8% annually for small customers, 15% for the top 5 (they renegotiate aggressively or leave). Calculate the Expected Value of annual Revenue loss from Churn. Then: if you're paying $25M for this business and using a 10% Discount Rate over a 5-year Investment Horizon, how much does this Churn pattern reduce your Valuation compared to a uniform 8% assumption?

Hint: Weight the Churn Rate by Revenue in each segment to get a blended rate. Then calculate the present value difference between the blended rate and the uniform 8% assumption.

Show solution

Blended Churn calculation: Small customers: $2.6M x 8% = $208K expected annual loss. Top 5: $2.4M x 15% = $360K expected annual loss. Total expected annual Revenue loss = $568K. Blended Churn Rate = $568K / $5M = 11.4%.

Valuation impact: Under the uniform 8% assumption, expected annual Revenue loss = $5M x 8% = $400K. Under the real blended rate, it's $568K. The annual difference is $168K in additional Revenue erosion.

Present value of $168K/year over 5 years at 10% Discount Rate: $168K x [(1 - 1.10^-5) / 0.10] = $168K x 3.791 = ~$637K. Your Valuation should drop by roughly $637K just from correcting the Churn assumption. On a $25M deal, that's a 2.5% adjustment - meaningful, and that's before considering that losing a $1.2M customer (24% of Revenue) isn't just a Churn statistic, it's an existential event.

hard

You're 30 days into due diligence on a $12M acquisition of an e-commerce business with $2M EBITDA. Findings so far: (1) Revenue grew 20% last year, but 60% of that growth came from a single product line whose supplier hasn't signed a renewal; (2) the website runs on a custom platform with zero documentation and the lead developer plans to leave post-close; (3) the business labels products 'organic' but has no certification on file - a Compliance Risk; (4) working capital is negative $300K and worsening. The seller will not reduce the $12M price. Proceed, renegotiate terms, or walk? Show your math.

Hint: Assign an Expected Value cost to each risk by estimating probability and dollar impact. Sum them to find Risk-Adjusted Value, then compare to the asking price.

Show solution

Risk-by-risk Expected Value analysis:

(1) Supplier risk: 60% of Revenue growth = $1.2M Revenue at risk. Estimate 40% probability of non-renewal. Expected Value of loss = $480K/year in Revenue.

(2) M&A Technical Due Diligence failure: custom platform rebuild estimate $300-500K, 6-12 months of Execution Risk. Developer departure is near-certain without incentives. Use $400K as expected cost.

(3) Compliance Risk: regulatory action on false 'organic' claims could mean fines, forced product withdrawal, and reputational damage. Conservative Expected Value: $300K (low probability but high impact - Tail Risk).

(4) Working Capital Management: negative $300K means immediate cash injection needed post-close, likely growing.

Risk-adjusted EBITDA: $2M - $480K annualized supplier risk = $1.52M. At 6 times EBITDA, base Risk-Adjusted Value = $9.1M. Subtract capital injection ($300K), platform rebuild ($400K), and Compliance Risk reserve ($300K): total adjusted cost of ownership = ~$10.1M for a $12M asking price.

Decision: Walk. The gap between asking price and Risk-Adjusted Value is $1.9M, and the Compliance Risk introduces open-ended Tail Risk. If the seller won't negotiate price, propose Closing Adjustments: $3M held back against supplier renewal and compliance remediation. If they reject both price reduction and holdback structure, walk - the Expected Value of this deal is negative at $12M.

Connections

M&A due diligence is where your knowledge of Financial Statements and Valuation collides with messy reality. You already know Financial Statements are a three-statement system where each statement alone can mislead - due diligence is the discipline of proving those statements match source documents before you commit Capital. Your Valuation model made assumptions about Revenue, Cost Structure, and Cash Flow - due diligence validates or demolishes every one of them. The fairness principles from mergers apply directly when structuring Closing Adjustments: when diligence reveals risks, who bears them? How much should the Buyer discount versus how much should the seller guarantee? These are Bargaining questions with real dollar stakes. Downstream, due diligence findings feed into Portfolio Construction - is this the right bet alongside your existing PE portfolio companies, or does it introduce correlated risk? They shape Capital Allocation decisions - is this $18M better deployed here or on a different opportunity with higher Risk-Adjusted Return? And they ground LBO Modeling in reality - can the deal's Capital Structure support the actual EBITDA, not the seller's optimistic version? For technology targets, M&A Technical Due Diligence becomes a critical specialized workstream: code quality, infrastructure Depreciation, and engineering Knowledge Asset risk can make or break a deal where the Competitive Advantage is supposed to be the technology itself.

Disclaimer: This content is for educational and informational purposes only and does not constitute financial, investment, tax, or legal advice. It is not a recommendation to buy, sell, or hold any security or financial product. You should consult a qualified financial advisor, tax professional, or attorney before making financial decisions. Past performance is not indicative of future results. The author is not a registered investment advisor, broker-dealer, or financial planner.