How to Do Due Diligence on a Company: A Guide by Business Type

To do due diligence on a company, you sign a confidentiality agreement, bring in experienced advisers, agree a due diligence checklist, share the documents in a secure virtual data room, then review them and raise questions before you sign. The steps are the same for every deal, but the focus changes with the type of business: market position for large companies, team and technology for startups, financial detail for private companies, and fraud and compliance risk for small businesses.

Whether you are investing in a business, merging with or acquiring a company, or buying real estate, due diligence confirms that you are getting what you think you are getting and that every aspect of the deal is genuine. It also gives you a clearer picture of the company's prospects for growth.

This guide covers the core due diligence steps, then explains how the process differs for large companies, startups, private companies and small businesses.

What is business due diligence?

Business due diligence is the investigation a buyer or investor carries out before a transaction to verify a company's financial, legal, commercial and operational position. It covers obligations, liabilities, company structure, contracts and financial records, and is often adapted to industry-specific requirements.

Due diligence matters to both seller and buyer. It can feel time-consuming and complex, but done properly it gives you clarity and confidence in the deal, a smoother integration and a lower risk of hidden liabilities or warranty claims. For a broader introduction, read our answers to common questions about the due diligence process.

How do you perform due diligence on a company?

When you perform due diligence on a business, you investigate its records and references thoroughly so that everything is as it appears and there are no surprises later. Typically the buyer leads the process by asking the seller for information about the target company and its operations. In an auction sale, the seller usually runs the process and controls what each bidder sees.

Most due diligence processes follow the same steps:

1. Sign a confidentiality agreement. Before any information is shared, both parties sign a non-disclosure agreement so the deal is not made public before it is finalised.
2. Build your advisory team. Whatever the size of the target, don't do due diligence on your own. Involve an accountant and a lawyer with transaction experience: they know how to spot the red flags you might miss.
3. Agree a due diligence checklist. Work with your advisers to list every document and question the review must cover. Start from an existing template, such as a legal or financial due diligence checklist, to save time.
4. Set up a virtual data room. The seller shares the information in a virtual data room, organised in folders that follow the structure of the checklist so reviewers can find what they need quickly.
5. Review and ask questions. The buyer's team and advisers review the documents and raise questions through the data room's Q&A, with the seller assigning answers to the right people.
6. Report and decide. Findings are summarised in a due diligence report that decides whether the deal goes ahead, is renegotiated or is abandoned.

The scope varies with the transaction. A large deal can require the buyer, their internal team and many advisers to review thousands of documents. A smaller transaction may only need a few key areas checked, especially when the buyer already knows the business or the business is simple.

How does due diligence differ by business type?

How to perform due diligence on a large company

Large transactions are becoming more complex. Whether it's a merger or acquisition, the sale of a division or a strategic alliance, determining the real value of the deal can be difficult. A simple, fact-based due diligence approach is essential, especially for large-cap and mid-market organisations.

• Look at the fundamentals. Focus on the company's value proposition, market position, historical performance and industry trends to judge whether it will meet its revenue forecasts.
• Use a detailed checklist. For private equity investments in particular, a thorough checklist reduces the risk of discovering inconsistencies in documents or operations after the deal has closed.
• Understand the strategy. Learn as much as you can about the company's investments, transactions and plans. A private equity investor, for example, should look at typical transaction sizes, holding periods, industry focus and investment stages to understand a fund's strategy.

M&A success rates are improving, but about half of all large deals fail to deliver the expected returns.

From Deal making: Using strategic due diligence to beat the odds, Bain & Company

How to perform due diligence on a startup

Venture capital firms use due diligence to evaluate startups and reduce uncertainty. For founders, transparency is essential: companies that are open about pending lawsuits, patent disputes, staff issues and past mistakes move through due diligence faster.

Investors won't rely only on what you provide. Alongside their own checks, they may interview current or former employees and speak to customers about your product. Founders should set aside enough time and resources, because a failed due diligence can significantly devalue a startup. Key areas to cover:

• Product and technology: evaluate the full product portfolio, the R&D pipeline and how the acquisition will create lasting value.
• Synergies and risks: these can be hard to assess when the company isn't yet profitable, especially outside its core business.
• Talent: founders, engineers and technologists are the lifeblood of a startup. Identify critical people early and plan how to retain them.

How to perform due diligence on a private company

Private companies publish far less information than listed ones, so you can't rely on market data. Due diligence on a private company usually follows three steps:

1. Financial review. Analyse quarterly and annual financial statements in depth. A private company may announce headline figures when it passes a revenue milestone, but you should ask the target for the full detail.
2. Market research. Map the market and sector dynamics to check that your own research matches the company's claims. A mismatch here can point to serious problems.
3. Culture and people. Review employment contracts, HR policies, benefits and staff turnover to understand the health of the company's culture and to plan retention.

Private company due diligence starts from accepting that risk and investment go hand in hand. A structured review helps you understand both the risks and the opportunities.

How to perform due diligence on a small business

According to Deloitte, failing to identify and manage third parties properly can cause revenue losses of between $2 million and $50 million. Taking the right precautions with small businesses protects your own operations.

A simple checklist for small business due diligence:

1. Define your due diligence objectives
2. Determine the type of business
3. Understand its legal structure
4. Investigate its financial health
5. Examine the management team
6. Review its website and social media accounts
7. Look for possible signs of fraud
8. Get expert opinions

Risks to keep in mind:

• Small businesses often run on tight budgets and can be vulnerable to changes in supply and demand
• Non-compliance can carry fines and penalties that pass on to the buyer, so check that compliance procedures are followed
• Lower barriers to entry can make small businesses more exposed to fraud, such as misrepresented products or practices outside accepted financial, legal and ethical standards

Due diligence on a small business should be relatively quick. If it drags on, that can be a warning sign of issues you haven't yet considered. It may be simpler than a large deal, but don't cut corners: a thorough, fact-based process is the basis for a lasting relationship.

Frequently asked questions

What are the main types of due diligence?

The most common types are financial, legal, commercial, operational, tax, HR, IT and ESG due diligence. Most transactions combine several, with the mix depending on the size, sector and risk profile of the target company.

Who carries out due diligence?

The buyer or investor usually leads due diligence, supported by internal specialists and external advisers such as lawyers, accountants and financial advisers. In an auction sale, the seller manages the process and controls what each bidder can access.

How long does due diligence take?

Due diligence can take anything from a few weeks to six months. Small business deals are usually quickest, while large, cross-border or highly regulated transactions take longest. Preparing documents in advance is the most reliable way to shorten the timeline.

Do you need a data room for due diligence?

For any deal involving confidential documents and several parties, a virtual data room is the standard. It controls who sees what, logs activity and keeps questions and answers in one place. Sellers can start early with a preparation portal before inviting buyers in. Learn more in our guide What is a data room?

Conclusion

Due diligence is essential for every deal, from mergers and acquisitions to major investments and new supplier or customer partnerships. It is the critical step before signing anything, so that you can make a fully informed decision.

Your review should cover the business structure, products, and physical and intellectual property. Set clear objectives, keep the investigation focused, and use technology such as a secure data room to keep the process organised. For a deeper look at due diligence best practice, download our guide: