Due diligence: meaning, types and practical checklists

Whether you are buying a business, taking investment, signing a critical supplier or entering a partnership, due diligence is how you find out what you are really getting into. This guide explains what the term means, the main types with checklists for each, and — the step most guides skip — how to turn the findings into risks you actually manage after the deal.

By Alex Martyushin, founder & risk consultant · Updated 30 October 2026 · 15 min read

What due diligence means

“Due” means appropriate or owed; “diligence” means careful effort. Together, due diligence is the level of care a reasonable person would be expected to take before acting. The phrase has a general legal meaning — in many laws, showing you took “all reasonable steps” or “exercised all due diligence” is a defence — and a business meaning that has grown from it: the structured investigation before a transaction.

The business use became common in US securities practice after the Securities Act of 1933, which gave underwriters and others a defence if they had carried out a reasonable investigation of what a prospectus said. Since then the term has spread to mergers and acquisitions, investment, lending, procurement, anti-money laundering (“customer due diligence”) and, more recently, human rights and environmental supply-chain checks.

Whatever the context, due diligence answers three questions:

1. Is it what they say it is? Verify the claims: revenue, customers, ownership, certifications, security controls.
2. What could go wrong? Find the risks the other side has not mentioned, deliberately or not.
3. What should we do about it? Decide whether the findings change the decision, the price or the terms.

Due diligence is a specific form of risk assessment, aimed at someone else’s organisation rather than your own. If you are new to the vocabulary of risk, our guide to what risk management is covers the basics.

When due diligence is needed

The due diligence process

1. Define the purpose and scope. What decision does this inform? What would make you walk away? Scope the work around those questions rather than a generic checklist.
2. Agree confidentiality. A non-disclosure agreement usually comes before any sensitive information is shared.
3. Send a request list. A structured list of documents and questions, prioritised so the deal-breakers come first.
4. Review documents. In transactions these are usually shared in a virtual data room. Track what has been received, reviewed and is still outstanding.
5. Interview management and verify independently. Talk to the people who run the business; check public registers, filed accounts, litigation searches, sanctions lists and references.
6. Record findings. For each finding note the evidence, the potential impact, how confident you are and what you recommend.
7. Decide and negotiate. Translate findings into price adjustments, contract protections, conditions or a decision not to proceed.
8. Carry the risks forward. The findings you live with become entries in the risk register and actions in the integration or onboarding plan.

Due diligence questionnaires and data rooms

A due diligence questionnaire (DDQ) is a structured set of questions sent to the other side. Investors use them with fund managers, buyers use them alongside the request list in acquisitions, and companies use them with suppliers — for security reviews, standard question sets such as the Shared Assessments SIG or the Cloud Security Alliance CAIQ are common. A good DDQ asks for evidence, not just yes or no, and is short enough that the answers get read.

A virtual data room is a secure online space where the target shares documents with bidders and advisers. Look for permission levels, watermarking, an audit trail of who viewed what, and a question-and-answer module. Organise the index to mirror the request list, so gaps are obvious to both sides.

Types of due diligence, with checklists

The checklists below are starting points for a small or mid-size transaction or partnership. Larger deals use the same headings with more depth and specialist advisers.

Commercial due diligence

Does the business have a credible future? Commercial due diligence tests the market and the plan behind the numbers.

• Market size, growth and the target’s share; who the real competitors are.
• Customer concentration: share of revenue from the top one, five and ten customers.
• Customer retention, churn and contract renewal dates; any notice to terminate.
• Pricing power: recent price increases and how customers reacted.
• Pipeline quality and the assumptions behind the forecast.
• Customer interviews or reference calls where possible.
• Dependence on a channel, platform or partner that could change its terms.

Financial due diligence

Are the numbers real and repeatable? Financial due diligence goes beyond the audited accounts.

• Quality of earnings: underlying profit after removing one-offs and owner-specific costs.
• Revenue recognition and whether it matches cash received.
• Working capital: debtor days, stock levels, seasonal swings.
• Net debt and debt-like items: leases, deferred revenue, unpaid bonuses, tax arrears.
• Cash flow history and the forecast for the next 12–24 months.
• Management accounts compared with statutory accounts.
• Off-balance-sheet commitments and guarantees.

Legal due diligence

Does the business own what it says it owns, and what obligations come with it?

• Corporate structure, share ownership and any options or rights over shares.
• Material contracts: change-of-control clauses, exclusivity, unusual liabilities, termination rights.
• Litigation, disputes, claims and regulatory investigations, current and threatened.
• Intellectual property: registrations, ownership of software and content created by contractors.
• Licences and permits needed to trade, and whether they transfer.
• Property leases, security over assets, compliance with key regulations. A gap here is a compliance risk you inherit.

Cyber and IT due diligence

Increasingly decisive, because you inherit the target’s security debt, its past breaches and its personal data obligations.

• Inventory of systems, applications and data; what personal and payment data is held and where.
• Security controls: MFA, patching, backups and restore tests, endpoint protection, privileged access.
• Past incidents and breaches, including any that were not reported.
• Independent evidence: ISO 27001 certificate, SOC 2 report, recent penetration test and whether findings were fixed. See vulnerability assessment vs penetration testing.
• Data protection: records of processing, privacy notices, processor contracts, international transfers.
• Technical debt: unsupported software, single points of failure, key-person knowledge.
• Licensing: are software licences valid and transferable? Is open-source use compliant?

ESG due diligence

Environmental, social and governance due diligence looks at risks that may not appear in the accounts yet but can affect value, financing and reputation.

• Environmental: permits, contamination, emissions, waste handling, exposure to climate-related physical risk.
• Social: health and safety record, labour practices, modern slavery risk in the supply chain, employee relations.
• Governance: board oversight, related-party transactions, anti-bribery controls, whistleblowing.
• Sustainability claims: can marketing and reporting claims be substantiated?

Some ESG due diligence is becoming a legal duty. The UK Modern Slavery Act 2015 requires organisations with a turnover of £36 million or more to publish an annual statement. In the EU, the Corporate Sustainability Due Diligence Directive was adopted in 2024; later simplification amendments narrowed its scope to very large companies (more than 5,000 employees and €1.5 billion turnover) and pushed application back to 2029. Check the current text before relying on any date. Smaller firms still feel these rules when large customers pass requirements down the supply chain.

Vendor and third-party due diligence

Before you sign a supplier that will hold your data or run a critical process, you need a lighter but similar investigation: who they are, whether they are financially stable, whether their security and resilience are adequate, and whether the contract protects you. Tier suppliers first so the depth matches the risk. We cover this in detail, including a tiering model and question set, in our third-party risk assessment guide.

Other types

• Tax — historic tax compliance, open enquiries, exposure from employment status of contractors, VAT treatment.
• HR — key people and their contracts, retention risk, pending claims, pension liabilities.
• Operational — capacity, supply chain, quality, continuity plans.
• Customer due diligence (KYC) — a regulatory process for banks, payment firms, accountants, estate agents and others in scope of anti-money laundering rules: identifying the customer and beneficial owners, understanding the purpose of the relationship and monitoring it.

Customer due diligence and enhanced due diligence

In anti-money laundering (AML) law, due diligence has a narrower, mandatory meaning: the checks a regulated business — a bank, payment firm, accountant, lawyer, estate agent and others in scope — must do on its customers. The level depends on risk:

In the UK these levels are set by the Money Laundering Regulations 2017; in the US, FinCEN’s Customer Due Diligence Rule requires covered financial institutions to identify beneficial owners of legal entity customers. Lists of high-risk countries change after each FATF plenary, so check the current list rather than a copy. If you are not in a regulated sector, you will still meet these checks as a customer — and the same logic (more risk, more checks) is a good model for your own supplier and partner reviews.

Due diligence in real estate

When buying property, due diligence is the buyer’s investigation before committing: title and ownership, boundaries and survey, building condition, planning and zoning, environmental issues, and — for commercial property — leases, tenants, service charges and capital expenditure that is due.

• In the US, purchase contracts often include a due diligence period (sometimes called an inspection or contingency period) in which the buyer can investigate and, depending on the contract, withdraw. In North Carolina’s standard residential contract, the buyer pays a negotiated due diligence fee directly to the seller for that right; it is generally non-refundable, while the separate earnest money deposit is usually returned if the buyer terminates within the period.
• In England and Wales, the principle is “buyer beware”: the buyer’s solicitor or conveyancer runs searches and raises enquiries, and a surveyor inspects, before contracts are exchanged — after which withdrawing usually costs the deposit.

Terms vary by state, country and contract, so the exact deadlines and refund rules are in the contract you sign, not in a general guide.

Buy-side vs sell-side (vendor) due diligence

In a transaction, buy-side due diligence is commissioned by the buyer or investor to test the target. Vendor due diligence — confusingly the same word as for suppliers — is commissioned by the seller before going to market. A seller who prepares a vendor report finds problems early, can fix or explain them on its own terms and gives bidders a common starting point, which can shorten the process. Buyers usually still do confirmatory work of their own, because the report was paid for by the other side.

For a founder thinking of selling in the next few years, the lesson is simple: the cleaner your records, contracts, accounts and risk register, the shorter and cheaper the buyer’s due diligence, and the fewer reasons to chip the price.

Due diligence on a small budget

Not every deal justifies a team of advisers. Buying a small competitor, taking a minority stake in a partner or signing a two-year contract with a niche supplier still deserves due diligence, just a leaner version:

• Do the free checks yourself. Company registers, filed accounts, director histories, court and insolvency searches, sanctions lists, reviews and press coverage take a few hours and catch a surprising amount.
• Spend adviser money where the risk is. If the value is in customer contracts, pay a lawyer to read the top ten. If it is in software, pay for a short technical and security review. Skip the rest or do it in-house.
• Ask for evidence, not assurances. Bank statements rather than a revenue summary; the signed contract rather than a description of it; the restore test log rather than “we have backups”.
• Use the contract to fill gaps. Where you could not verify something, ask for a specific warranty, an indemnity or a deferred payment linked to it.
• Write down what you did not check. Unverified areas are accepted risks; list them so they can be revisited.

Red flags that deserve a closer look

• Slow, partial or inconsistent answers to basic requests.
• Management accounts that do not reconcile to filed accounts or bank statements.
• Revenue concentrated in one customer whose contract is near renewal or has a change-of-control clause.
• Key software or IP created by contractors with no assignment of rights.
• Security incidents described as “minor” with no written record.
• Frequent changes of auditor, bank or senior finance staff.
• Unexplained related-party transactions.

Turning findings into risks in the register

A due diligence report is a snapshot that tends to be filed once the deal closes. The risks it found do not disappear at completion — they become yours. The fix is to treat the findings as the first entries in the target’s (or supplier’s) risk register.

For each material finding, decide the response:

Everything in the last three rows belongs in the risk register on day one, scored on your usual risk matrix. An example from the acquisition of a 35-person software agency:

Scores are illustrative residual scores on a 5×5 scale. Link each register entry back to the finding and the contract protection that covers it — if a warranty claim window closes in 18 months, that date belongs in the register too. Review the post-deal risks monthly for the first six months, then fold them into the normal review cycle.

Common mistakes

• Generic checklists. A 400-line request list buries the five questions that matter.
• Taking documents at face value. Verify against independent sources: banks, registers, customers.
• Leaving cyber and IT to the end. Security problems can change the price and the integration plan.
• Deal momentum. Once people are emotionally committed, red flags get explained away. Set walk-away criteria at the start.
• Filing the report. Findings that do not reach the risk register and the integration plan are forgotten by the time they materialise.
• One-off supplier checks. Suppliers change; so should your view of them.