Blog » Due Diligence

Due Diligence Checklist for Startup Acquisition [2026 Template]

Complete due diligence checklist for startup acquisitions. Financial, legal, technical, and commercial DD, free template for founders preparing to sell.

By David Mitchell, Founder of Ventura, SaaS M&A specialist · Published 2025-04-28 · 7 min read

What Due Diligence Actually Covers

Due diligence (DD) is the formal investigation process a buyer conducts before finalizing an acquisition. For SaaS startups, DD typically spans 4 workstreams: Financial, Legal, Technical, and Commercial. Each workstream has different stakeholders on the buyer’s side and different documents they’ll request.

Understanding this process before you’re in it is the difference between a smooth 6-week close and a 6-month ordeal that kills the deal.

Financial Due Diligence Checklist

Revenue Verification

• ☐ MRR/ARR by month for the last 24 months
• ☐ MRR bridge (new, expansion, contraction, churn)
• ☐ Revenue cohort analysis (by acquisition month)
• ☐ ARR by customer (full list)
• ☐ Payment processor data (Stripe, etc.) for last 12 months
• ☐ Deferred revenue schedule
• ☐ Revenue recognition policy

Unit Economics

• ☐ CAC by channel (blended and segmented)
• ☐ LTV calculation and methodology
• ☐ Payback period analysis
• ☐ Gross margin by product line
• ☐ EBITDA and SDE calculation

Financial Statements

• ☐ P&L for last 3 years (+ YTD current year)
• ☐ Balance sheet for last 3 years
• ☐ Cash flow statement for last 3 years
• ☐ Tax returns for last 3 years
• ☐ Bank statements for last 12 months
• ☐ Cap table (current + fully diluted)

Legal Due Diligence Checklist

Corporate Structure

• ☐ Certificate of incorporation
• ☐ Bylaws / operating agreement
• ☐ Shareholder agreements
• ☐ Board meeting minutes (last 3 years)
• ☐ All equity issuances and option grants

Intellectual Property

• ☐ IP assignment agreements (founders + all employees + contractors)
• ☐ Patent filings (if applicable)
• ☐ Trademark registrations
• ☐ Domain ownership
• ☐ Open source license compliance audit
• ☐ Third-party code licenses

Contracts & Agreements

• ☐ All customer contracts (top 20 minimum)
• ☐ Standard customer agreement template
• ☐ Vendor and SaaS tool agreements
• ☐ Employment contracts (key employees)
• ☐ Non-compete and non-solicitation agreements
• ☐ Any debt instruments or convertible notes

Compliance

• ☐ Privacy policy and terms of service
• ☐ GDPR compliance documentation (if EU customers)
• ☐ SOC 2 report (if applicable)
• ☐ Data processing agreements with vendors
• ☐ Any regulatory filings or licenses
• ☐ Litigation history disclosure

Technical Due Diligence Checklist

• ☐ Architecture diagram and tech stack documentation
• ☐ Codebase access (senior engineer review)
• ☐ Test coverage and CI/CD pipeline
• ☐ Security audit results (last 12 months)
• ☐ Uptime / SLA history (last 24 months)
• ☐ Incident history and resolution documentation
• ☐ Scalability documentation
• ☐ Data backup and disaster recovery procedures
• ☐ Third-party API dependencies and risk assessment
• ☐ Infrastructure costs (AWS, GCP, Azure) breakdown

Commercial Due Diligence Checklist

• ☐ TAM / SAM / SOM analysis
• ☐ Competitive landscape analysis
• ☐ ICP (Ideal Customer Profile) documentation
• ☐ Sales pipeline and CRM export
• ☐ Marketing channel breakdown and attribution
• ☐ Customer reference list (for buyer calls)
• ☐ NPS / CSAT scores and methodology
• ☐ Product roadmap
• ☐ Key partnerships and strategic relationships

How to Prepare: 30-Day Sprint

Week 1: Gather all financial data. Reconcile numbers across all sources (payment processor, accounting software, internal dashboards). Document any discrepancies.

Week 2: Legal audit. Pull all contracts, IP assignments, corporate documents. Identify and fix any gaps (missing employee IP assignments are common).

Week 3: Technical documentation. Write up architecture, security posture, and incident history. Have a developer write the tech stack narrative.

Week 4: Commercial materials. Build cohort analysis, customer concentration report, and competitive overview. Prepare customer reference list.

Due Diligence by Buyer Type: What Each One Actually Cares About

Due diligence is not generic. The buyer type drives which sections get scrutinized most heavily. Knowing your buyer profile helps you preempt the focus areas.

Strategic acquirer (same vertical)

Priority focus: customer overlap, technology integration risk, team retention. They want to know which of your customers also use their product (overlap = lower synergy value), how your tech stack will integrate with theirs, and whether your key engineers will stay through the integration. Less focus on detailed financial mechanics because they already understand the unit economics in the space.

Strategic acquirer (adjacent vertical)

Priority focus: customer behavior in the new vertical, vertical expertise, technology re-applicability. They want evidence the vertical works (case studies, retention data), and confirmation their existing technology can be extended to your space.

PE-backed SaaS rollup

Priority focus: financial controls, accounting clean-up, operational documentation. They will run an extensive QofE (Quality of Earnings) on your financials, often hiring a third-party accounting firm. Expect 6-8 weeks of accounting DD before the operational review even starts.

Pure financial PE

Priority focus: cash flow durability, debt capacity, exit thesis 5-7 years out. They model the LBO math (debt-funded acquisition, principal paydown via cash flows). Expect rigorous scenario analysis: base case, downside case, recession case.

Search fund / individual acquirer

Priority focus: founder transition risk, operational simplicity, working capital needs. They are typically owner-operators who will run the business hands-on. They want to ensure the business does not require specialized expertise they lack. Expect lots of customer reference calls.

Acqui-hire focused buyer

Priority focus: engineering team quality, technical IP, team retention agreements. Financial DD is light because they are paying mostly for the team and technology. Expect deep technical interviews with your engineers.

The 10 Most Common Due Diligence Killers

Beyond the data room basics, here are specific items that have killed deals in the Ventura M&A dataset.

Killer 1: Contractor IP gaps

Any code or design built by contractors without signed IP assignment agreements. The #1 deal killer historically. Audit all contractor relationships, retrofit IP assignments if needed.

Killer 2: Undisclosed pending lawsuits or threatened claims

Even small disputes (a fired employee, a vendor disagreement) discovered late destroy trust. Disclose everything upfront with risk-mitigation narrative.

Killer 3: Customer concentration mis-reporting

You said top customer was 12%, DD discovered it is 22% counting affiliated entities. Automatic price haircut + trust damage.

Killer 4: Revenue recognition discrepancies

Dashboard shows $2M ARR, books show $1.6M recognized revenue. Different metrics but buyers conflate. Pre-explain the difference.

Killer 5: Open security vulnerabilities

Penetration test reveals critical issues you knew about but did not fix. Either fix them pre-DD or disclose with remediation plan.

Killer 6: Founder is 100% the business

No #2, no documented operations, customer relationships only with founder. Triggers earnout demand or deal cancellation.

Killer 7: Cap table surprises

"Forgotten" SAFEs, side letters with anti-dilution, founder shares owned by ex-spouses. Resolve all cap table ambiguity pre-listing.

Killer 8: Compliance gaps

GDPR violations, missing DPAs, HIPAA gaps for healthcare SaaS. Each gap can cost 5-15% of deal value or kill it entirely.

Killer 9: Technical debt time-bomb

Critical infrastructure on deprecated technology (old PHP versions, end-of-life databases). Documented technical debt is acceptable; hidden debt is not.

Killer 10: Suspicious customer churn pattern

Cohort analysis showing unexplained churn spikes. Buyers assume the worst (product quality, market shift, sales fraud). Have an explanation ready with data.

Due Diligence Timeline by Deal Size

Sub-$1M deal value

2-4 weeks total DD. Light financial review, basic legal check, customer reference calls. Often handled by buyer directly without external advisors.

$1M-$5M deal value

4-8 weeks DD. QofE report from a regional accounting firm ($10-30K). Legal review by buyer’s counsel. Technical review may involve 1-2 days of engineer interviews.

$5M-$20M deal value

8-14 weeks DD. Full QofE by national accounting firm ($30-60K). Legal review with extensive document requests. Commercial DD: customer interviews, market sizing. Technical DD: code review, security audit, infrastructure review.

$20M+ deal value

14-26 weeks DD. Big 4 QofE ($60K-$200K). Specialty DD firms for tax, HR, IT, security. Often involves a 50-100 page final DD report.

How to Speed Up Due Diligence by 40%

Buyers who close fastest are buyers who get information fastest. Here is how organized founders compress timelines.

Tactic 1: Pre-populated data room

Have everything organized BEFORE the buyer requests it. Saves 2-3 weeks vs scrambling reactively.

Tactic 2: Pre-run QofE

Commission your own QofE before going to market. Costs $15-30K. Saves 4-6 weeks of buyer accounting DD because the buyer can review your report rather than redo the work.

Tactic 3: Customer reference list ready

5-10 customers pre-cleared and willing to take calls. Each reference takes 30 minutes; if you can coordinate 8-10 calls in one week vs sequential, that saves 2-3 weeks.

Tactic 4: Document index with status

Master spreadsheet showing every DD-relevant document with status (final, current, needs update). Saves the buyer 5-10 hours of "where is X" emails.

Tactic 5: Single point of contact

One person owns DD communication. Buyer requests go through them. Avoid scattered email threads with 5 people from your team.

FAQ: Due Diligence

What happens if buyers find issues during DD?

Most issues are negotiated rather than deal-killers. Buyers will typically adjust the purchase price, request reps and warranties, or put a portion of the purchase price in escrow. The worst outcome is finding issues you didn’t disclose, that destroys trust and often kills the deal.

Should I hire a lawyer for DD preparation?

For deals above $2M, yes, M&A legal fees are typically 1-3% of deal value and worth every penny. For smaller deals, a startup attorney can do a legal readiness review for $3-5K that will catch most issues before buyers find them.

How long does the full due diligence process take?

For sub-$5M ARR deals: 4-8 weeks if your data room is organized. For $5M-$20M ARR: 8-16 weeks. For $20M+ deals: 14-26 weeks. The quality of your data room is the single biggest lever you have over DD timeline. Well-organized founders close 40% faster.

What is a Quality of Earnings (QofE) report?

A QofE is a third-party accounting report that validates your financial statements for an acquirer. It normalizes EBITDA, scrutinizes revenue recognition, examines working capital, and identifies one-time vs recurring items. For deals above $5M, most buyers require one. Cost: $15K-$60K depending on complexity. Often worth getting your own QofE BEFORE going to market.

Can I refuse to share specific information during DD?

Yes, but selectively. Strategic competitors should not get customer-level revenue data until LOI is signed. You can stage information release: anonymized first, then identified after NDA, then detailed after LOI. Pure information refusals (without good reason) typically kill deals.

What is the most overlooked due diligence item?

Customer contract assignability clauses. Many SaaS contracts include "change of control" provisions allowing customers to terminate on acquisition. If 30% of your contracts have these clauses, your business has built-in churn risk on acquisition. Pre-DD audit your top customer contracts and renegotiate problematic clauses.