The Founder's Guide to Due Diligence in Acquisitions

Your Mindset: DD is an Offensive Weapon, Not a Defensive Chore

You’ve landed a Letter of Intent (LOI). The price is agreed upon, the key terms are set. Now the real work begins: Due Diligence (DD).

Most founders treat diligence as an invasive, painful audit to be survived. This is a mistake. An organized, professional, and prompt DD process is your best tool to build buyer confidence, maintain deal momentum, and defend your valuation. A sloppy process does the opposite: it erodes trust, creates delays, and gives the buyer leverage to lower the price.

Think of it this way: the buyer is making a multi-million dollar bet. Diligence is their process for convincing themselves the asset is what they think it is. Your job is to make it easy and compelling for them to reach that conclusion.

Mistake #1: Starting When You Get the LOI

The single biggest mistake founders make is scrambling to assemble documents after the LOI is signed. This guarantees a slow, painful process and signals you aren’t prepared.

You should maintain a “data room in a box” from the moment you start your company. This is a living repository of all the key documents a buyer (or major investor) would want to see. Don't wait for a deal. Start today.

A basic data room should be organized with clear folders. At a minimum, it includes:

Corporate Governance: Certificate of incorporation, bylaws, board meeting minutes and consents, cap table, and any investor rights agreements. · Financials: Monthly financial statements (P&L, Balance Sheet, Cash Flow), your operating model/forecast, and ideally, your last 1-2 years of tax returns. · Team: Offer letters, employment agreements, confidentiality and IP assignment agreements for all employees and contractors. A simple employee census with titles, start dates, and salaries. · IP: A list of all key software, patents, and trademarks. Critically, include a list of all open-source software used in your product, along with their license types. · Material Contracts: All significant customer contracts, partnership agreements, and vendor agreements, especially those with revenue over a certain threshold (e.g., >$20k ARR) or with non-standard terms.

The Three Streams of Due Diligence

Buyer requests will pour in through a virtual data room (VDR)—this could be a dedicated service like Intralinks or a well-organized Dropbox/Google Drive folder. The requests generally fall into three parallel tracks.

1. Legal Diligence

The buyer’s lawyers are hunting for risks and liabilities that could come back to bite them. Their primary concerns are:

Clean Cap Table & Corporate Records: Is the company properly formed? Are all stock issuances properly documented and approved? Are there any weird vesting schedules or promises of equity that aren't on the cap table? · IP Ownership: This is a deal-killer. They need to verify that you own, without a doubt, all the intellectual property your business is built on. The number one red flag is missing IP assignment agreements from former employees or contractors. · Contracts & Change of Control: They will read your biggest customer and partnership contracts, looking for "change of control" clauses. These clauses might allow the customer to terminate the contract upon your acquisition. You need to know where these are and flag them proactively. · Employment Issues: Are employees properly classified (exempt vs. non-exempt)? Are there any outstanding wage claims or legal disputes? · Litigation: Are there any active, pending, or even threatened lawsuits against the company?

2. Financial Diligence

This goes far beyond your high-level financial statements. The buyer’s finance team or external accountants want to understand the "quality" of your revenue and the fundamental health of your business model.

Revenue Recognition: How do you recognize revenue? Is it in accordance with GAAP? They will scrutinize this to ensure your reported ARR/MRR is real. · Customer Concentration: Does a single customer account for more than 10-15% of your revenue? This is a major risk factor for a buyer. · Cohort Analysis: They will want your raw data to analyze customer retention, expansion, and churn. Vague assertions about "strong retention" won't fly. You need to show gross and net revenue retention by customer cohort. · Margin Analysis: What are your gross margins? How have they trended over time? What levers can pull to improve them? · The Forecast: They will pressure-test the assumptions in your operating model. Be ready to defend why you believe you can hit your future targets with a bottoms-up rationale.

3. Technical & Product Diligence

The buyer’s engineering and product teams need to understand what they are actually buying. They’re assessing not just the product today, but its ability to scale and integrate into their own systems.

Architectural Review: A 2-3 hour call where your tech lead walks their team through the entire tech stack, architecture, and development process. · Code Scan: They will almost always ask to run a static analysis tool (like Black Duck or Snyk) on your codebase. This primarily checks for open-source license compliance and known security vulnerabilities. Festering security issues or reliance on GPL-licensed code can be major red flags. · Security & Compliance: Expect questions about data privacy, security audits (SOC 2, ISO 27001), and your process for handling security incidents. · Team Assessment: The buyer is often acquiring the team as much as the tech. They will want to speak with your key engineers to gauge their skill level, morale, and how they might fit into the acquiring organization.

Managing the Process Like a Pro

Don’t let the DD process manage you. Drive a weekly cadence to maintain momentum.

Appoint a Quarterback: One person, usually the CEO or CFO, should be the single point of contact for all DD requests. This prevents mixed signals and ensures a single source of truth. · Establish a Request Tracker: Use a simple Google Sheet to track every request from the buyer: the request, who it's assigned to, the date it was asked, and the date it was answered with a link to the document. This creates accountability and a clear record. · Set a Weekly Sync: Schedule a standing 30-minute call each week with your counterpart on the buyer’s side. The agenda is simple: review open requests, clarify new ones, and identify blockers. This formal cadence prevents the deal from drifting.

When to Push Back (Gently)

Not all DD requests are reasonable. Sometimes a buyer, or their junior associate, will ask for things that are overly broad, irrelevant, or designed to wear you down for a price negotiation.

It’s okay to push back, but do it professionally. If a request seems unreasonable, use this framework:

Seek to Understand: "Thanks for this request. To make sure we get you the right information, can you help us understand what you're ultimately trying to verify with this data?" · Propose an Alternative: "Pulling emails from our entire executive team for the last three years would be a huge undertaking. However, we can easily provide the board minutes approving the transaction you're asking about. Would that work?"

Persistent, unreasonable requests are a yellow flag. It could signal a disorganized buyer or, worse, that they are fishing for a reason to re-trade the price. Pay attention to these signals—diligence is a two-way street.

How to Apply This This Week

Don't wait for an LOI to land in your inbox. Take these concrete steps to prepare now.

Create a "VDRTemplate" Folder: Create a new folder in your Google Drive or Dropbox. Build out the sub-folder structure (Corporate, Financial, IP, etc.) described above. · Audit Your IP Assignments: Make a list of every person (full-time, part-time, contractor) who has ever written code for your product. Hunt down their signed confidentiality and IP assignment agreement. If you can't find one, work with your lawyer to get it signed now. · Review Your Top 5 Customer Contracts: Read your five largest customer agreements. Look for the "Assignment" or "Change of Control" section. Know exactly what your obligations are if you get acquired. · Run an Open-Source Scan: Use a tool like Snyk, FOSSA, or have an engineer use a free library to scan your codebase for all open-source dependencies and their licenses. Flag any that aren't permissive (like MIT or Apache) and might cause issues for a commercial buyer (like GPL or AGPL).