The M&A Due Diligence Process, Phase by Phase
Due diligence runs in four phases: preliminary screening before any letter of intent, the core diligence period where parallel workstreams produce findings, the period converting those findings into price and deal structure, and the signing-to-close period where covenants and regulatory approval run in parallel. This guide covers what actually happens at each phase, in the order it happens.
Phase 1: Before the letter of intent
Diligence work starts before any formal process, even though it is not usually called diligence at this stage. What happens here sets the price the rest of the process spends its time defending or attacking.
Preliminary screening
A first pass built entirely on information the buyer can reach without the seller's cooperation: public filings and financial statements, the target's own pitch materials, news and litigation dockets, corporate-registry records, sanctions and debarment lists, and prior transactions in the same sector for a valuation reference. The output is a decision, not a finding — is this worth committing a team and several hundred thousand dollars of adviser fees to examine properly? Obvious disqualifiers surface here: sanctions exposure, unresolved major litigation, a capital structure that cannot be cleanly acquired, a customer base that is one contract away from collapse.
Non-disclosure agreement
Signed before any confidential information changes hands. Scope matters more than buyers often treat it. An NDA that is too narrow can restrict what the buyer may later act on if it walks away and meets the same opportunity by another route; one that is too broad can taint an entire deal team from working on anything adjacent. Where the buyer is a competitor, the NDA is also the first place the clean-team question gets raised — who on the buy side is allowed to see commercially sensitive material at all.
Indicative offer or letter of intent
Price and structure are proposed on preliminary, usually seller-supplied information, typically alongside an exclusivity period that stops the seller from shopping the deal while diligence runs. This is where diligence's leverage problem begins: the buyer names a number before knowing what it is buying, and most later findings become arguments to move a price that is already anchored. A well-drafted LOI leaves explicit room for that — it frames the number as subject to confirmatory diligence rather than as a firm commitment.
Where AI helps in this phase
The screening pass is document-heavy and time-boxed, which is exactly the shape an automated first read fits. Running the target's public filings and any early seller materials through risk scoring surfaces the categories worth prioritising — and the obvious disqualifiers — before the buyer has committed adviser budget, so the LOI is anchored to something firmer than a pitch deck.
Phase 2: LOI to signing — the core diligence period
This is the longest phase and the one where most of the real work happens. It is also where a process most often loses time, almost always for the same reason: workstreams that should run in parallel end up running in sequence.
Team assembly and scoping
A deal lead to coordinate, accountants for quality of earnings and tax, counsel for legal, and specialists as the target requires — technology, environmental, actuarial, regulatory, pensions. Scope is set against what is material to this target, not a generic template: a manufacturing business and a SaaS business do not warrant the same emphasis, and spreading a fixed budget evenly across every workstream is how the one that mattered ends up under-resourced.
Information request list and data room opening
The request list should be issued complete, in one pass, organised by workstream, rather than dribbled out in rounds that each reset the seller's response clock. The seller populates a virtual data room against it. Access is role-based — the buyer's commercial team should not necessarily see what its legal team sees, and where the buyer is a competitor, the most sensitive material is walled off to a clean team so that reviewing it cannot later be characterised as coordination between competitors.
| Workstream | Core documents requested | A finding looks like |
|---|---|---|
| Financial / QoE | Audited statements, monthly management accounts, working-capital build, debt and lease schedules, revenue by customer | An adjustment to normalised EBITDA, or a working-capital peg the seller will dispute |
| Legal | Cap table, constitutional documents, material contracts, litigation files, permits, corporate minute books | A change-of-control consent, an unassignable key contract, an unquantified claim |
| Tax | Returns for open years, correspondence with authorities, transfer-pricing documentation, prior restructurings | An exposure requiring a specific indemnity or a price retention |
| Commercial | Customer and supplier contracts, pipeline data, churn history, market and competitor analysis | Concentration risk, or a pipeline that does not support the forecast |
| Technical / IT | Architecture documentation, IP assignments, open-source usage, security posture, key-person dependencies | Unassigned IP, copyleft contamination, a platform rebuild the seller has not funded |
| HR | Employee census, benefit and pension plans, key-employee contracts, union agreements, recent claims | An underfunded scheme, a retention problem, misclassified contractors |
| Regulatory / environmental | Licences, inspection history, enforcement correspondence, environmental site assessments | A remediation obligation, or an approval that gates the closing |
Parallel workstream execution
Financial, legal, tax, commercial, technical and regulatory diligence run concurrently, each producing findings independently, with the deal lead holding a running view of how they interact — a tax exposure and a legal indemnity can be the same dollar counted twice, or two halves of a problem neither workstream sees whole.
Management presentations and follow-up
Structured sessions that test documentary findings against the people who ran the business. The most useful outcome is often not a new fact but a discrepancy — the documents say one thing, management says another — which is itself a finding, and usually a more important one than whatever was on the agenda.
Site visits
Physical inspection of facilities, inventory and operations. Useful specifically because it catches the gap between the reported operation and the observed one: equipment condition, real staffing levels, safety practice, housekeeping — none of which show up in a data room.
Findings consolidation
Individual workstream outputs are ranked by materiality into one findings register, separating quantifiable adjustments from qualitative risks and flagging which findings interact. This step is routinely under-resourced relative to the workstreams that feed it, and a poorly consolidated register is what causes an investment committee to receive volume instead of a view — forty pages of observations with no line drawn between the three that would change the decision and the thirty-seven that would not.
Where AI helps in this phase
Two points. First, at the front of the phase: an automated pass over the whole data room as it opens gives each workstream a ranked starting point instead of a folder tree, so the first week is spent on the contracts and disclosures that carry risk rather than on working out where they are. Second, at consolidation: scoring every document against the same rubric produces a consistent severity signal across workstreams that were each using their own judgement, which is exactly the input the consolidation step is usually missing. Neither replaces the workstream leads — the model reads, the advisers decide.
Phase 3: Findings to signing
The findings register now has to become deal terms. This phase is short relative to Phase 2 but negotiation-heavy, and it is where the value of a well-consolidated register is realised or lost.
Valuation and structure response
Findings convert into price adjustment, escrow, earn-out, specific indemnities, or representations-and-warranties insurance, in roughly that order of frequency. Quantifiable findings tend to move price directly; unbounded or qualitative findings tend to move structure — a claim that could be nothing or could be large becomes an indemnity or an escrow rather than a discount.
The anchoring problem from Phase 1 lands here. Every price-reducing finding is now a renegotiation of a number both sides have lived with for weeks, and the seller reads each one as the buyer chipping. A register that clearly separates the few findings that genuinely move the decision from the many that do not is what keeps this phase from turning into a line-by-line fight over immaterial items.
Disclosure schedules and definitive agreement
Diligence findings populate the disclosure schedules to the purchase agreement and shape the negotiated representations, warranties and indemnity caps — a disclosed item is one the buyer cannot later claim as a breach, so what goes on the schedule is itself negotiated. This is where the diligence and legal-drafting workstreams converge, and it is worth having the same counsel across both so a finding does not get lost in the handoff.
Investment committee or board approval
The findings register, the valuation impact and the residual risk are presented for final approval before signing. A well-run process reaches this point with no material surprises: anything genuinely deal-threatening should have surfaced in Phase 2, and a deal-killer discovered at IC is usually evidence the earlier phase was rushed or mis-scoped.
Phase 4: Signing to close
Diligence does not fully stop at signing. On many deals the gap between signing and closing is where the calendar risk actually sits.
Interim covenants
The purchase agreement restricts how the target may operate between signing and closing — no material contracts outside the ordinary course, no unusual capital spending, no changes to key terms — so that the business the buyer closes on is the business it agreed to buy. Someone on the buy side has to actually monitor compliance rather than assume it.
Confirmatory review
A focused re-check that nothing material has changed since signing: updated financials, confirmation that key employees and customers are still in place, and follow-up on any finding that was left open with a covenant rather than resolved. This is narrower than Phase 2 and targeted at the specific things that could have moved.
Regulatory approval and closing
Where merger-control or sector approval is required, it typically runs through this phase and is frequently the binding constraint on the closing date — the deal cannot close until the waiting period has expired or clearance is granted, regardless of whether everything else is ready. In the United States, transactions above the reporting thresholds must be notified to the antitrust agencies and observe a statutory waiting period, which a request for additional information can extend substantially. See how long the whole process takes for how much this adds in practice.
How long each phase takes, and what gates the next
There is no standard number of weeks — a small private acquisition and a carve-out from a listed group are different exercises. What is consistent is what drives the duration of each phase and what has to be true before the next one can start.
| Phase | What drives how long it takes | Gate into the next phase |
|---|---|---|
| 1 — Before the LOI | How much public information exists; whether the buyer already knows the sector; NDA and exclusivity negotiation | A signed LOI and, usually, exclusivity |
| 2 — Core diligence | Data-room completeness and the speed of seller responses; number of workstreams; whether workstreams run in parallel; management availability | A consolidated findings register the deal team stands behind |
| 3 — Findings to signing | How far apart the parties are on price and structure; disclosure-schedule negotiation; internal approval calendars | A signed definitive agreement |
| 4 — Signing to close | Regulatory clearance almost always; third-party consents; financing conditions | Conditions satisfied — then closing |
The single largest controllable variable is in Phase 2: a data room populated slowly, in rounds, against a request list that keeps changing will stretch the phase regardless of how well the team is resourced.
Where AI changes the process
An automated risk-screening pass does not change the shape of the process — the four phases, the workstreams, the negotiation are unchanged. What it changes is how quickly a large volume of documents can be turned into a ranked starting point, and how consistent the severity signal is across workstreams that would otherwise each be using their own judgement.
- Phase 1 screening — run the target's public filings and early seller materials through risk scoring before committing adviser budget, so the LOI is anchored to more than a pitch deck.
- Data-room triage — score the whole room as it opens; each workstream starts on the documents that carry risk instead of on a folder tree.
- Consistent severity across workstreams — every document scored against the same rubric, which is the input the findings-consolidation step is usually missing.
- Findings checked against their source — a screening tool worth using verifies each finding against the document text rather than trusting the model's own summary, and surfaces what it could not confirm rather than staying quiet.
- Access control that holds where the buyer is a competitor — sensitive material can be confined to a clean team in a clean room whose separation is a database permission, not just hidden in the interface. The M&A clean room guide covers the antitrust background.
The model reads; the advisers decide. Anything a screening pass produces is a starting point for a workstream lead, not a substitute for one — see AI in due diligence for where the line sits.
Frequently asked questions
What are the main phases of the M&A due diligence process?
Four phases: preliminary screening and NDA before any letter of intent; the core diligence period from LOI to signing, where parallel workstreams (financial, legal, tax, commercial, technical, regulatory) produce findings; the period converting findings into price, structure and disclosure schedules ahead of signing; and the signing-to-close period, where interim covenants and any required regulatory approval run in parallel.
What happens during the LOI-to-signing period?
This is the core diligence period. A deal team is assembled, an information request list is issued and the data room opens, workstreams run in parallel, management presentations and site visits test documentary findings, and individual workstream outputs are consolidated into a single ranked findings register that feeds the valuation and structure decisions.
Do diligence workstreams run at the same time or one after another?
In parallel wherever possible. Financial, legal, tax, commercial and technical diligence typically run concurrently, coordinated by a deal lead, rather than sequentially. This is the single biggest structural lever for keeping the process within its target timeline.
Does due diligence end at signing?
Not fully. Interim covenants restrict how the target can operate between signing and closing, a confirmatory review is common to verify nothing material changed, and any required regulatory approval typically runs through this period and often becomes the binding constraint on the actual closing date.
What is the due diligence phase in an M&A deal?
The due diligence phase is the period between the letter of intent and signing when the buyer's advisers examine the target in detail. Financial, legal, tax, commercial, technical and regulatory workstreams run in parallel against a populated data room, test what they find against management, and consolidate the results into a single ranked findings register that feeds the price and the deal structure.
How do you streamline the M&A due diligence process?
The largest structural lever is running workstreams genuinely in parallel rather than in sequence, coordinated by one deal lead. Beyond that: issue the information request list complete in one pass, scope each workstream to what is material to this target rather than a generic template, resource the findings-consolidation step properly, and triage a large data room early so effort goes where the risk is. Screening the full document set quickly is where an AI pass helps most.
What documents are requested during M&A due diligence?
The information request list is organised by workstream. Financial diligence asks for audited statements, management accounts, the working-capital build and debt schedules; legal asks for the cap table, material contracts, litigation files and corporate records; tax asks for returns and any correspondence with authorities; HR asks for the employee census, benefit plans and key contracts; and commercial, technical, regulatory and environmental workstreams request their own specialist material.
Sources
Primary sources for the statutory figures cited on this page. Thresholds and timelines change — verify current requirements with the relevant agency before relying on them.
- Hart-Scott-Rodino Antitrust Improvements Act, 15 U.S.C. § 18a — premerger notification to the Federal Trade Commission and the Antitrust Division of the Department of Justice, the statutory waiting period, and the effect of a request for additional information (a “second request”) on that period.