M&A Due Diligence Before You Sign the Purchase Agreement

By Hank FasthoffJuly 6, 2026

You conduct due diligence to determine whether the business you were offered is the business you will own after closing. The investigation should verify ownership, earnings, assets, contracts, liabilities, compliance, and the seller's authority to complete the transaction. It should also identify the consents, payoffs, corrective work, and contractual protection you need before you commit to close.

A large data room can produce a false sense of completeness. Ownership, customer retention, and lien status require verification through source documents, public records, financial data, and interviews with the people who operate the business. Your diligence process should test the seller's disclosures against that evidence.

Control the Diligence Process

Your diligence period should reflect the business, transaction structure, condition of the records, financing schedule, and required approvals. A fixed market timetable can't account for a regulated company, a business with operations in several states, a complicated ownership history, or a target whose records require reconstruction. You should build the schedule around identified workstreams and the decisions that depend on them.

You should assign responsibility for each request, track what the seller produced, and separate complete responses from partial responses. An issue list should state the fact, source, financial exposure, person responsible for follow-up, and proposed deal response. That discipline prevents an important finding from disappearing inside an email chain or a folder containing hundreds of documents.

In some transactions, buyers complete most diligence before the parties sign the purchase agreement. In others, the parties use a signing and closing structure with confirmatory diligence, third party consents, regulatory approvals, financing, or corrective work between those events. You should identify which issues must be resolved before signing, which may become conditions to closing, and which risks you're prepared to accept through price or contract terms.

Entity Status, Authority, and Equity Ownership

You should review the target's certificate of formation or incorporation, company agreement or bylaws, amendments, ownership ledgers, certificates, minutes, written consents, and agreements among owners. Certificates of existence and foreign qualification records confirm public filing status. Ownership records and authority documents establish who owns the equity and whether the seller has authority to transfer it.

The capitalization review should account for every issued interest, option, warrant, convertible instrument, profits interest, phantom equity award, and contractual right to acquire equity. You should compare the capitalization table against ledgers, tax records, board approvals, grant documents, and payment evidence. A spreadsheet prepared for the transaction proves little if the underlying records tell a different story.

Transfer restrictions can affect both timing and closing certainty. Rights of first refusal, co-sale rights, drag-along provisions, voting agreements, investor consent rights, lender covenants, and restrictions in the governing documents may require notices, waivers, approvals, or additional signatures. You should also search for liens against the equity and confirm the authority of every person signing for an owner.

An asset transaction requires a separate authority analysis. You should confirm that the seller can approve the sale under its governing documents and applicable entity law, identify any owner vote, and determine whether the transaction triggers dissenters' rights or a requirement to distribute proceeds through a specified process.

Financial Condition and Quality of Earnings

You should reconcile the seller's earnings presentation to its financial statements, general ledger, tax returns, bank records, payroll, customer invoices, and cash receipts. Depending on the size and risk of the transaction, a transaction accountant may prepare a quality of earnings report to test recurring revenue, normalized expenses, working capital, cash conversion, and the assumptions behind valuation.

You should examine revenue recognition, customer and product concentration, gross margin by line of business, backlog, deferred revenue, rebates, returns, discounts, and unusual transactions near period end. Concentration has no universal percentage that makes a customer safe or dangerous. The contract term, renewal history, margin, switching risk, personal relationships, and customer's ability to terminate determine the exposure.

Expense adjustments require the same scrutiny. Owner compensation, personal expenses, related party charges, one-time professional fees, vacant positions, deferred maintenance, and proposed cost savings may affect normalized earnings in different ways. You should distinguish a historical expense that will disappear after closing from a recurring cost the buyer will have to pay.

You should tie the working capital analysis to the purchase price assumptions and review monthly account balances, aging, inventory reserves, bad debt, customer deposits, accrued expenses, deferred revenue, seasonality, and the accounting practices used to prepare the working capital target. Those records inform the working capital target, indebtedness definition, transaction expense definition, and any item the parties intend to treat outside working capital.

Taxes

Tax diligence should cover federal, state, local, and foreign returns, elections, payment records, audits, notices, settlement agreements, and statutes of limitation. You should confirm the target's entity classification, S corporation status if applicable, tax sharing arrangements, net operating losses, payroll compliance, sales and use tax, franchise tax, property tax, unclaimed property, and nexus in every jurisdiction where it has employees, property, customers, or other business activity.

An equity purchase leaves historical tax liabilities inside the target. An asset buyer can inherit exposure through successor liability doctrines, tax liens, and statutes that impose liability on the purchaser. In Texas, Tax Code Section 111.020 requires a purchaser of a business or stock of goods to withhold enough of the purchase price to cover amounts due until the seller provides the required receipt or certificate. The purchaser's failure to follow that procedure can produce liability up to the value of the purchase price.

You should coordinate tax diligence with structure before signing the purchase agreement. Asset allocation, depreciation recapture, sales and transfer taxes, tax elections, rollover equity, debt treatment, and the identity of the seller receiving proceeds can change the economics. If the parties contemplate a Section 338 election, Section 336(e) election, or partnership basis adjustment, you should confirm eligibility and model the consequences before treating the election as part of the bargain.

Worker classification belongs in both tax and employment diligence. You should test employee and contractor classifications against the services performed, the company's control, payment practices, and applicable law. Payroll tax exposure, wage claims, benefit eligibility, and information reporting can arise from the same classification decision.

Debt, Liens, and Payoff Mechanics

You should review every loan agreement, promissory note, line of credit, equipment financing arrangement, capital lease, guaranty, letter of credit, and factoring agreement. The debt schedule should reconcile to the general ledger, financial statements, lender statements, and UCC records. Related party debt and undocumented advances require the same attention as bank debt.

Lien searches should cover the correct debtor names and filing jurisdictions, along with real property records, fixture filings, certificate of title records, intellectual property records, tax liens, and judgment liens where applicable. Under Texas Business and Commerce Code Section 9.315, a security interest generally continues in collateral after a sale unless the secured party authorized a disposition free of the security interest or another rule applies. The buyer should require an effective release or other evidence that the assets will transfer free of the lender's collateral claim.

You should identify each payoff, release, termination statement, and original instrument needed at closing. If a lender holds deposit accounts, equity certificates, vehicle titles, domain credentials, or other collateral, the closing process should address delivery and control as well as the payoff amount.

Material Contracts

You should assemble a complete contract population rather than accept a small group selected by revenue. The review should cover customer, vendor, supply, distribution, referral, lease, financing, intellectual property, software, government, joint venture, and related party agreements. Purchase orders, statements of work, amendments, side letters, and course-of-dealing documents may contain economic terms that the principal agreement omits.

An equity purchase transfers ownership of the target rather than assigning each target contract. A change of control provision may nevertheless give the counterparty a consent, termination, pricing, or notice right. In an asset purchase, the buyer usually needs an assignment of each acquired contract, and the contract language and governing law determine whether consent is required and whether rights, duties, or both may transfer.

You should examine term, renewal, termination, exclusivity, minimum purchases, volume commitments, rebates, service levels, warranties, indemnities, audit rights, most favored customer provisions, data rights, price adjustments, and limits on assignment or control. A profitable customer relationship may lose value if the customer can terminate at closing, reprice the work, refuse assignment, or follow a departing owner.

Oral agreements and informal business practices require factual diligence. An oral agreement may be enforceable, but the parties may disagree about price, duration, scope, or termination rights, and the relationship may depend on a person who will leave after closing. You should document the business terms and determine how the relationship will continue under the buyer's ownership.

Intellectual Property and Technology

You should identify the intellectual property the business owns, licenses, develops, or depends on. That review includes patents, patent applications, trademarks, copyrights, trade secrets, domain names, social media accounts, software, databases, designs, content, inventions, and rights of publicity. Registration schedules should reconcile to the records of the Copyright Office, Patent and Trademark Office, registrars, and foreign authorities.

Ownership depends on chain of title. A company claiming ownership of copyright created by contractors often needs a signed transfer under 17 U.S.C. Section 204, and patent rights require a written assignment under 35 U.S.C. Section 261. You should review employment agreements, contractor agreements, invention assignments, work for hire language, acquisition records, licenses, and settlement agreements instead of assuming payment for development transferred ownership.

You should review source code control, repositories, administrator credentials, development practices, disaster recovery, service availability, technical debt, and dependence on key personnel or vendors. You should also identify open source components and their licenses, because some licenses impose source disclosure, attribution, notice, or distribution conditions when the company distributes covered software.

Third party licenses may limit users, territory, affiliates, transfer, hosting, sublicensing, or use after a change of control. You should also review inbound data rights, model training rights, application programming interfaces, cloud terms, and any software the company uses outside the scope of its license.

Data Privacy and Cybersecurity

You should compare the target's data practices against its privacy policies, customer promises, employee notices, consents, contracts, and applicable law. The review should identify the personal data and confidential information the company collects, its purposes, storage locations, retention practices, recipients, cross-border transfers, and methods for responding to access, deletion, correction, and opt-out requests.

You should review incident history, ransomware and extortion events, insurance notices, penetration tests, vulnerability reports, access controls, encryption, backups, endpoint management, and incident response plans. You should confirm whether the target investigated known incidents, met notification duties, completed remediation, and preserved evidence of its response.

Vendor relationships deserve separate review because processors, cloud providers, payment vendors, analytics services, and software tools may receive valuable or regulated data. You should examine data processing agreements, security addenda, audit reports, subprocessor terms, breach notice periods, deletion obligations, and limits on the vendor's use of data. A buyer also needs a lawful and secure process for receiving diligence data before closing.

Employees and Benefit Plans

Employment diligence should reconcile the employee roster to payroll, tax filings, benefit records, equity awards, and written agreements. You should review compensation, bonuses, commissions, accrued leave, classification, work locations, immigration status, restrictive covenants, invention assignments, change of control payments, severance, pending claims, workplace investigations, and health and safety records.

Key employee risk requires more than checking for a noncompetition covenant. Enforceability varies by state and by the employee's work. Retention, leadership succession, customer transition, and transfer of institutional knowledge require separate planning. You should identify the people the business depends on and determine the employment offers, incentives, consents, or transition services needed before closing.

You should review benefit plan documents, filings, testing, funding, service-provider agreements, claims, and correction history. Defined benefit plans, multiemployer plans, deferred compensation, equity plans, COBRA obligations, and retiree benefits can produce liabilities that require specialized review. Planned layoffs or operational changes may also require analysis under federal or state notice laws.

Litigation, Investigations, and Compliance

You should review pending and threatened claims, demand letters, arbitration, administrative proceedings, government inquiries, subpoenas, settlements, judgments, injunctions, and consent orders. Claims history may reveal a recurring product, employment, billing, safety, or compliance problem even when no single case threatens the transaction.

You should control access to privileged material. A seller shouldn't place legal advice, investigation files, or privileged communications in an unrestricted data room. The parties should use privilege logs, limited access, joint defense or common interest arrangements where applicable, and other procedures chosen by litigation counsel to reduce waiver risk.

You should tailor compliance diligence to how the target earns revenue and where it operates. That review should cover licensing, anti-bribery, sanctions, export controls, government contracting, healthcare, environmental, consumer protection, advertising, accessibility, product safety, and industry rules that apply to the business. It should also identify prior violations, voluntary disclosures, remediation, monitors, and commitments that bind future operations.

Real Property and Environmental Exposure

For owned real estate, you should review title, surveys, zoning, certificates of occupancy, easements, restrictions, property taxes, service agreements, and pending condemnation or land use proceedings. Leased property requires review of the lease, amendments, guaranties, estoppels, subordination agreements, defaults, options, restoration duties, assignment provisions, and change of control provisions.

You should tailor environmental diligence to the property's history and the target's operations. CERCLA can impose liability on a current owner or operator under 42 U.S.C. Section 9607, subject to statutory defenses and liability protections. A buyer seeking bona fide prospective purchaser protection must satisfy the statutory criteria, including all appropriate inquiries before acquisition and continuing obligations after acquisition.

EPA recognizes ASTM E1527-21 and E2247-23 as compliant methods for conducting all appropriate inquiries in the circumstances those standards cover. A Phase I environmental site assessment should be completed within the required period and early enough to permit additional investigation, allocation, remediation, or a decision to withdraw. You should also review permits, tanks, waste disposal, spills, notices, remediation records, and environmental indemnities associated with the business and its former locations.

Insurance

You should review current and historical policies, applications, binders, endorsements, claims, notices, reserves, deductibles, self-insured retentions, exclusions, and coverage disputes. The policy periods should cover the years in which significant claims or incidents may have occurred, not only the current renewal year.

Transaction structure can affect coverage. You should determine whether the acquisition triggers a change of control provision, ends coverage for subsequent acts, requires runoff or tail coverage, or requires consent for assignment. Claims-made and occurrence policies respond differently, so the purchase agreement should allocate responsibility for notices, continued cooperation, deductibles, and recovery under historical policies.

Representations and warranties insurance supplements the indemnification package and depends on the diligence record. Exclusions, retention, policy definitions, subrogation, and facts known before binding determine what the insurer will pay. You should align the diligence record, disclosure schedules, purchase agreement, and insurance application before binding coverage.

Licenses, Permits, and Transaction Approvals

You should inventory every license, permit, registration, certification, and government approval required to operate the business. The review should identify the holder, covered location or activity, expiration date, renewal status, violations, and effect of an asset transfer, merger, or change of control. Some approvals transfer, some require notice or consent, and others require the buyer to qualify and apply in its own name.

You should maintain a separate schedule for transaction approvals. Depending on the parties and industry, the acquisition may require antitrust filings, foreign investment review, state healthcare notices, lender approval, landlord consent, franchise approval, professional licensing, or approval from a contracting agency. You should build those requirements into the signing conditions, closing conditions, covenants, and outside date.

Convert Findings Into Deal Terms

Each material finding should change the transaction or receive a documented acceptance decision. The available responses include a price change, working capital treatment, debt classification, excluded asset or liability, pre-closing cure, third party consent, closing condition, operating covenant, representation, disclosure, special indemnity, escrow, insurance solution, or decision to end negotiations.

A known liability rarely belongs in a general representation alone. You should determine who will bear it, how long the obligation will last, whether the seller can pay, and what source of recovery will exist after closing. A special indemnity may require separate survival, a negotiated limit, an escrow, a guaranty, or another credit solution.

You should use diligence findings to prepare and review the disclosure schedules. A seller's disclosure may qualify a representation, identify an exception, or provide the buyer a termination right depending on the agreement. You should compare each schedule against the diligence record instead of treating seller disclosure as a substitute for investigation.

If you're the buyer, you should finish the work that determines ownership, price, transferability, regulatory approval, and post-closing exposure before you lose the right to withdraw. You should enter closing with a documented answer for every material finding, because the purchase agreement can allocate a known risk only when the parties identify it and negotiate who will bear it.