Due diligence is a deep audit of your business, not just a confirmation of your pitch deck. This guide provides a comprehensive checklist for your data room, covering corporate, legal, financial, team, and product areas. It also details the most common mistakes founders make—from messy cap tables to using the wrong open source licenses—and provides actionable steps to prepare your company for a smooth and successful diligence process, whether for fundraising or an M&A exit.
Key takeaways
- Build your data room from Day 1; don't wait for a term sheet.
- A messy cap table is the #1 deal-killer. Use software like Carta or Pulley to keep it clean.
- Ensure you have a signed PIIA from every person who ever contributed to your IP, including early contractors.
- Run an open-source software scan to avoid license conflicts that could compromise your proprietary code.
- Proactively identify and flag potential issues. Surprises kill deals, but prepared solutions build trust.
- The focus of fundraising diligence is upside; M&A diligence is all about de-risking the acquirer's liability.
Diligence Isn't a Stage, It's a Discipline
Due diligence isn't something you "prepare" for; it's a reflection of your company's day-to-day operational discipline. Investors and acquirers aren't just verifying slide deck claims. They are performing an invasive audit to answer one core question: is this business as real as the founders claim it is?
A messy, reactive diligence process kills deals, wastes months, and torches your reputation. A clean, organized process signals you run a tight ship. It builds confidence and accelerates momentum, often leading to a faster close on better terms. This is your tactical guide to acing diligence, not just surviving it.
The Two Arenas: Fundraising vs. M&A Diligence
While the documents overlap, the mindset and intensity are worlds apart. Understand the game you're playing.
Fundraising Diligence (Seed/Series A)
This process is primarily forward-looking . VCs are stress-testing your assumptions to confirm the upside. Does the dog food taste as good as you said? Can this team actually capture this market?
Focus: Team, product, traction, and market size. They spend more time on customer calls and your financial model's assumptions than on your board minutes from two years ago. · Timeline: Faster. Expect 2-4 weeks for a Seed round, 4-8 weeks for Series A. · Goal: Validate the dream.
M&A Diligence
This is a rigorous, backward-looking audit. An acquirer is inheriting every asset and—more importantly—every liability. Your past mistakes become their future legal and financial problems.
Focus: Intense legal, financial, tax, and HR scrutiny. Teams of lawyers and Big Four accountants will crawl through everything. They are hunting for skeletons. · Timeline: A marathon. 60-120 days is standard, and it can easily go longer. · Goal: Mitigate downside risk.
Your Virtual Data Room: The Ultimate Checklist
Your Virtual Data Room (VDR) is the single source of truth for your company. Don't wait for a term sheet. Create these folders in a service like DocSend, Dropbox, or a dedicated VDR provider today. Keep them updated quarterly. When an investor asks for access, you want to be able to grant it within minutes.
Pro Tip: Don't dump all the files at once. Grant access in stages. Start with a "Phase 1" folder containing the deck, exec summary, and maybe high-level financials. Reserve the "Phase 2" folder with the full cap table, detailed financials, and customer contracts for after a term sheet is signed or interest is deeply confirmed.
1. Corporate & Legal
What they're looking for: Is this a real, cleanly-governed company that can be bought or invested in?
Corporate Formation Docs: Certificate of Incorporation, Bylaws, and any amendments. · Foreign Qualifications: Proof of registration to do business in every state where you have employees or significant operations. A common miss. · Board & Shareholder Records: A complete history of all board meeting minutes, written consents, and shareholder resolutions. Get a lawyer to help you "clean up" your minute book for $2,000-$5,000. It's money well spent. · Capitalization Table: Must be 100% accurate. This is the #1 deal-killer. A messy cap table can cost $10k-$25k+ in legal fees to fix. Use Carta or Pulley from day one to avoid this nightmare. · All Stock Purchase Agreements: Evidence for every share ever issued, including founder stock, advisor grants, and financings. · Voting Agreements & Side Letters: Any document that gives specific investors or individuals special rights.
2. Finance & Tax
What they're looking for: Is the financial story consistent and are the future projections believable?
Historical Financials: Profit & Loss, Balance Sheet, and Cash Flow Statements (accrual basis) for at least 3 years or since inception. Post-Series A, these should be reviewed or audited by a CPA firm. · Financial Model & Projections: The 3-5 year forecast model. Don't just show the output. Your assumptions sheet is the most important part. Show your work for CAC, LTV, churn, hiring, and every other driver. · Tax Filings: All federal, state, and local tax returns ever filed. Yes, all of them. · Material Contracts: Don't make them guess. Include all customer or vendor contracts with a value greater than $25,000 annually, and any strategic partnership agreements. · Bank Statements: The last 12 months are typical. They will cross-reference these with your P&L to verify revenue and major expenses.
3. Team & HR
What they're looking for: Do you actually own the IP your team created, and are there any HR time bombs?
Employee & Contractor List: Name, title, start date, end date (if applicable), compensation, and visa status. · Offer Letters & Employment Agreements: For every current and former employee. · Proprietary Information and Invention Assignment Agreements (PIIAs): This is non-negotiable. You need a signed PIIA from every person who has ever contributed to your product or IP, including that freelance designer you used for three weeks in your first month. A missing PIIA from a key early engineer can jeopardize a multi-million dollar acquisition. · Benefits Summary: Health, dental, 401k, etc. · HR Policies & Employee Handbook: Shows you have standard processes in place.
4. Product & Technology
What they're looking for: Is the technology proprietary, defensible, and not built on a house of cards?
Intellectual Property Portfolio: All patent filings, trademarks, and domain name registrations. · Open Source Software (OSS) Scan: A list of all third-party libraries in your codebase and their associated licenses. Using a library with a restrictive "viral" license (like GPL or AGPL) can force you to open-source your proprietary code. Run a scan with a tool like Snyk or Black Duck before diligence begins. · Product Roadmap: A detailed plan for the next 12-18 months, showing key features and business goals. · Tech Stack & Architecture: High-level diagrams showing how your systems are built and connected. Be prepared for a technical diligence session where their engineers will interview your team lead.
The 7 Founder Mistakes That Kill Deals
Having the documents isn't enough. You must avoid these unforced errors in judgment and process.
The Unfixable Cap Table: Verbal equity promises, "I'll figure it out later" advisor grants, and un-repurchased shares from departed founders create a legal mess that can be impossible to resolve under the pressure of a deal. · Missing PIIAs: An acquirer who finds you don't have a clean title to your IP may walk away, or worse, force you to re-purchase that IP from a disgruntled ex-contractor. · Ignoring Open Source "Poison Pills": Using a GPL-licensed component without realizing its implications is an amateur mistake that can destroy your company's core value. · Misrepresenting Metrics: Presenting "vanity metrics" like cumulative signups instead of cohort retention, or non-GAAP revenue without clear reconciliation. Your credibility will be shot. · A "Magic" Financial Model: Projections that aren't based on explicit, defensible drivers. If an investor changes your CAC or churn assumption and the model breaks, they lose faith instantly. · "Handshake" Agreements for Critical Work: Relying on email chains or verbal agreements with customers or IP-creating contractors. If it's not a signed contract, it doesn't exist in diligence. · Surprises. Finding a problem isn't the deal-killer. Finding out you knew about it and hid it is. If you have a potential issue—a past data breach, a minor tax error, a contract dispute—flag it proactively with your proposed solution. It turns a red flag into a demonstration of your maturity.
How to Apply This: Your 5-Step Diligence Fire Drill
Build the VDR skeleton. Create the exact folder structure listed above. Drop in the documents you already have. Now you know where your gaps are. · Run a cap table audit. Sit down with your lawyer and Carta/Pulley. Match every single share on the ledger to a signed Stock Purchase Agreement. · Run an HR audit. Create a spreadsheet of every person who has ever worked for the company (full-time, part-time, contractor, intern). Do you have a signed PIIA for every single one? · Run a preliminary OSS scan. Use a tool like Snyk to get a baseline report. You don't want to discover a GPL issue for the first time when a buyer's legal team is on the clock. · Review your board minutes. Are there any major decisions (like issuing stock options) that happened over email but were never formally approved in a board consent? Get them cleaned up now.
Frequently asked questions
- What is the single biggest mistake founders make in due diligence?
- The most common and costly mistake is a messy capitalization table. Inaccurate records of ownership, verbal promises of equity, and unsigned stock purchase agreements can delay or kill a deal entirely.
- How much does it cost to fix common due diligence issues?
- Fixing corporate records like board minutes can cost $2,000-$5,000 in legal fees. Correcting a messy cap table is far more expensive, often ranging from $10,000 to over $25,000, and can take months.
- What's the difference between fundraising and M&A diligence?
- Fundraising diligence (2-8 weeks) is forward-looking, focused on validating your startup's potential upside. M&A diligence (2-4 months) is a much deeper, backward-looking audit designed to uncover hidden liabilities and de-risk the acquisition for the buyer.
- Should I give investors access to my entire data room at once?
- No. Provide access in stages. Start with top-level information like your pitch deck and corporate summary. Only grant access to highly sensitive documents like the detailed cap table, financial model, and customer contracts after you have a term sheet or the investor has demonstrated serious intent.
- What is a PIIA and why is it so important?
- A Proprietary Information and Invention Assignment Agreement (PIIA) is a contract where an employee or contractor agrees that any intellectual property they create for your company belongs to the company. Without a signed PIIA from every contributor, an acquirer can't be sure you own 100% of your technology, which is a massive red flag.
