# Due Diligence Request List: [Project name, target name]

> A buy-side due diligence request list for the acquisition of a company
> or business: transaction and confidentiality terms, the request ID and
> status convention, and request schedules for the financial, tax,
> legal, commercial, operations, people, IT and cyber, ESG and
> regulatory workstreams, followed by the data room index, the
> question-and-answer log and the handover of findings into the share
> purchase agreement, the valuation and the integration plan. It
> follows common M&A practice; the request wording is original and does
> not reproduce any adviser, bank or industry-body checklist. Laws are
> cited by name and number only. The worked example is "Project Heron",
> in which Corvid Commerce Group plc (a fictional SaaS retailer) evaluates
> the purchase of Tallow Lane Logistics GmbH, a fictional carve-out
> from a fictional seller; every name and figure is invented. Replace
> every `[bracketed]` value and every row marked *Example*. This is a
> document format, not financial, investment, tax, legal or accounting
> advice. Obtain the standard or law for the normative text.

<!--
Guidance: How to use this template
- Use this list on the buy side, from the first data room access to
  signing, and keep using it for pre-completion and integration
  requests. Sell-side teams can use the same structure to prepare a
  vendor data room in advance.
- Tailor before sending. Delete requests that cannot matter for this
  target (an asset-light software company has no environmental permits
  of substance) and add sector requests. A list with 600 generic rows
  signals that nobody has thought about the deal.
- Agree materiality first (section 2.4): requests should ask for items
  above a threshold, not "all contracts".
- Every request keeps its ID for life. Do not renumber when rows are
  added or closed, because Q&A entries, findings and SPA disclosures
  refer to the ID.
- Related documents: Quality of Earnings Scope
  (`finance/quality-of-earnings-scope`), Valuation Report
  (`finance/valuation-report`), M&A Integration 100-Day Plan
  (`finance/m-and-a-integration-100-day-plan`), Private Equity
  Investment Memo (`finance/private-equity-investment-memo`),
  Investment Committee Memo (`finance/investment-committee-memo`),
  Non-Disclosure Agreement (`legal-lite/nda`), RAID Log
  (`project/raid-log`).
-->

## Document control

<!-- Guidance: Record which version of the list the target received and when. Sellers answer against a specific version; if you add requests after the first issue, show them as a new version so response timetables stay fair and traceable. -->

| Field | Value |
|---|---|
| Document ID | [DDR-2026-001] |
| Project code name | [Project name] |
| Target | [Legal name, registered number, jurisdiction] |
| Seller | [Legal name] |
| Buyer | [Legal name] |
| Deal structure | [Share purchase / asset purchase / merger / carve-out] |
| Phase | [Phase 1 (pre-offer) / Phase 2 (confirmatory) / Pre-completion] |
| Data room | [Provider, project folder, access list owner] |
| Version | [0.1] |
| Status | [Draft / Issued to seller / Closed] |
| Owner (deal lead) | [@deal-lead] |
| Approvers/reviewers | [@corporate-development-head], [@cfo], [@general-counsel] |
| Last updated | YYYY-MM-DD |
| Classification | [Strictly confidential, deal team only] |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| Deal lead | [@deal-lead] | [Prepared] | YYYY-MM-DD |
| General counsel or external counsel | [@general-counsel] | [Reviewed legal and regulatory sections] | YYYY-MM-DD |
| CFO or finance diligence lead | [@cfo] | [Approved for issue] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change |
|---|---|---|---|
| 0.1 | YYYY-MM-DD | [@deal-lead] | First draft, all workstreams |
| 1.0 | YYYY-MM-DD | [@deal-lead] | Issued to seller for Phase 1 |
| 1.1 | YYYY-MM-DD | [@deal-lead] | Phase 2 requests added (IDs from 100 upwards in each workstream) |

## Contents

1. [Transaction overview and confidentiality](#1-transaction-overview-and-confidentiality)
2. [How to use this list](#2-how-to-use-this-list)
3. [Financial](#3-financial)
4. [Tax](#4-tax)
5. [Legal and corporate](#5-legal-and-corporate)
6. [Commercial and customers](#6-commercial-and-customers)
7. [Operations and supply chain](#7-operations-and-supply-chain)
8. [People, HR and pensions](#8-people-hr-and-pensions)
9. [IT, data and cyber](#9-it-data-and-cyber)
10. [ESG and sustainability](#10-esg-and-sustainability)
11. [Regulatory approvals and closing conditions](#11-regulatory-approvals-and-closing-conditions)
12. [Data room index](#12-data-room-index)
13. [Q&A log and status reporting](#13-qa-log-and-status-reporting)
14. [Findings handover and traceability](#14-findings-handover-and-traceability)
15. [Glossary and references](#15-glossary-and-references)
16. [Standard and licence note](#standard-and-licence-note)

## 1. Transaction overview and confidentiality

<!-- Guidance: Give every adviser the same one-page picture of the deal before they read the requests. State the perimeter precisely: which legal entities, which business lines, and which assets stay with the seller. Pitfall: diligence that covers the seller's whole group when only one division transfers, or misses an entity that does transfer. -->

| Item | Value |
|---|---|
| Buyer *(Example)* | Corvid Commerce Group plc (CC-HOLD; IFRS reporter, functional currency EUR, financial year = calendar year) |
| Target *(Example)* | Tallow Lane Logistics GmbH (Germany) and its subsidiary Tallow Lane UK Ltd: warehouse management software and fulfilment services |
| Seller *(Example)* | Marlow Ridge Holdings AG, which keeps its other divisions |
| Structure *(Example)* | Purchase of 100% of the shares of Tallow Lane Logistics GmbH; carve-out of shared services currently provided by the seller group |
| Indicative value *(Example)* | Enterprise value EUR 26.2m in the non-binding offer (11.0x management adjusted EBITDA of EUR 2.38m), subject to diligence |
| Funding *(Example)* | Drawing of EUR 12.0m under Corvid's existing EUR 20,000k revolving credit facility plus cash on hand; pro forma leverage and liquidity tested in the QoE (section 11.1) and the investment committee paper |
| Timetable *(Example)* | Data room open 2026-08-24; Phase 1 answers 2026-09-14; Phase 2 answers 2026-10-23; target signing 2026-11-20 |
| Confidentiality *(Example)* | NDA dated 2026-08-10; clean team protocol for customer pricing (section 6) |
| Advisers *(Example)* | Financial and tax diligence: [Adviser]; legal: [Law firm]; IT and cyber: [Adviser]; commercial: in-house strategy team |

The perimeter decides what each workstream asks for. In a carve-out, the seller's group often provides finance, payroll, IT, treasury and insurance to the target, so the target's own records understate the cost and complexity of running it alone. Ask for the services the target receives from the group (DDR-FIN-012 and DDR-IT-010) in the first round, because the answers drive the standalone cost adjustment in the quality of earnings work and the transitional services agreement (TSA) in the integration plan.

Confidentiality has two layers. The non-disclosure agreement (`legal-lite/nda`) governs the whole deal team. Where buyer and target compete or trade with each other, competition law limits who may see competitively sensitive information before completion, such as customer-level pricing, margins or bid pipelines. Route those requests through a clean team: a small named group, often external advisers, who report only aggregated conclusions to the buyer. Mark such requests "CT" in the request tables and ask counsel to approve the clean team membership before the data is uploaded.

## 2. How to use this list

<!-- Guidance: Explain the conventions once so the seller, advisers and the buyer's own team read every row in the same way. Questions to answer: who owns each request on the buyer side, how urgent is it, and when is it closed? Pitfall: closing a request because a document was uploaded, without anyone reading it. -->

### 2.1 Request IDs

Each request has an ID `DDR-<workstream>-<NNN>`. Workstream codes are FIN (financial), TAX, LEG (legal and corporate), COM (commercial), OPS (operations), HR (people), IT (IT, data and cyber), ESG and REG (regulatory approvals). Phase 2 requests start at 100 in each workstream so a reader can see at a glance when a request was raised. Follow-up questions on an answer go to the Q&A log (section 13) with a QA ID that points back to the request; they do not become new rows here unless they ask for new documents.

### 2.2 Priority

| Priority | Meaning | Typical timing |
|---|---|---|
| P1 | Needed to value the business or decide whether to continue | Phase 1, before a binding offer |
| P2 | Needed to confirm value, draft the SPA and the disclosure letter | Phase 2, before signing |
| P3 | Needed to complete or integrate, such as bank mandates and system access | Between signing and completion |

### 2.3 Status

| Status | Meaning |
|---|---|
| Open | Not yet answered |
| Partial | Some documents provided; buyer owner has stated what is missing |
| Provided | Seller says complete; buyer owner has not yet reviewed |
| Closed | Buyer owner has reviewed and recorded any finding (section 14) |
| Not available | Seller confirms the item does not exist; record whether that is itself a finding |
| Withdrawn | Buyer no longer needs it; record why |

### 2.4 Materiality and periods

Ask for items above a stated threshold so the seller can answer quickly and the reviewers can focus. A practical starting point is to relate the contract threshold to the target's revenue and cost base and to cover the top customers and suppliers by value. For Project Heron the deal team used the conventions below; set your own.

| Convention | Value |
|---|---|
| Historical periods *(Example)* | FY2023, FY2024, FY2025 audited; monthly management accounts January 2024 to the latest month; LTM to 2026-09-30 |
| Currency and units *(Example)* | EUR thousands unless stated; GBP figures of Tallow Lane UK Ltd translated at the monthly average rate |
| Contract threshold *(Example)* | Annual value above EUR 100k, or any contract with change-of-control, exclusivity or uncapped liability terms regardless of value |
| Customers and suppliers *(Example)* | Top 20 customers and top 15 suppliers by FY2025 value |

### 2.5 Working rules

- Send the list in a structured format (spreadsheet or tracker) and keep this document as the controlled version. The IDs must match.
- One buyer owner per request. The owner chases, reviews and closes it.
- Ask the seller to answer in the data room folder that matches the request ID, so section 12 stays usable.
- Hold a weekly status call with the seller's coordinator. Prioritise open P1 items and blocked items, not volume.
- Do not ask the same thing twice in different workstreams. Where a document serves several workstreams (for example the customer contracts), one workstream requests it and the others reference the ID.

## 3. Financial

<!-- Guidance: The financial requests feed the quality of earnings work, the net debt and working capital definitions and the model. Ask for data at the level the analysis needs (monthly, by entity, by revenue stream) rather than for presentation packs. Pitfall: receiving only audited annual accounts, which cannot support a working capital peg or a run-rate view. -->

| ID | Request | Period or scope | Priority | Buyer owner | Status |
|---|---|---|---|---|---|
| DDR-FIN-001 | Audited financial statements with auditor's reports and management letters | FY2023 to FY2025, each entity and any consolidation | P1 | [@fin-lead] | [Open] |
| DDR-FIN-002 | Monthly management accounts: income statement, balance sheet and cash flow, with the reconciliation to the audited accounts | January 2024 to latest month | P1 | [@fin-lead] | [Open] |
| DDR-FIN-003 | Trial balances by entity at each year end and month end, with mapping to the management accounts | Same periods | P1 | [@fin-lead] | [Open] |
| DDR-FIN-004 | Revenue by stream, customer, product, country and month, reconciled to reported revenue | FY2023 to LTM | P1 | [@fin-lead] | [Open] |
| DDR-FIN-005 | Management's list of adjustments to EBITDA with support for each item | FY2023 to LTM | P1 | [@fin-lead] | [Open] |
| DDR-FIN-006 | Budget for the current year and business plan for the next three years, with the assumptions and the model | Current and plan years | P1 | [@fin-lead] | [Open] |
| DDR-FIN-007 | Budget against actual for the last three years with explanations of the main variances | FY2023 to FY2025 | P2 | [@fin-lead] | [Open] |
| DDR-FIN-008 | Monthly balance sheet working capital accounts: receivables ageing, contract assets, inventory, payables ageing, accruals, deferred revenue | January 2024 to latest month | P1 | [@fin-lead] | [Open] |
| DDR-FIN-009 | Debt and debt-like schedule: facilities, cash pooling, leases, guarantees, factoring, pension deficits, deferred consideration, provisions, unpaid bonuses | Latest month end | P1 | [@fin-lead] | [Open] |
| DDR-FIN-010 | Capital expenditure by project, split maintenance and growth, including capitalised development costs and the capitalisation policy | FY2023 to LTM | P1 | [@fin-lead] | [Open] |
| DDR-FIN-011 | Accounting policies, changes in policy or estimate, and any restatements | FY2023 to date | P2 | [@fin-lead] | [Open] |
| DDR-FIN-012 | Services and costs received from the seller group: management charges, shared services, insurance, IT, with the allocation keys | FY2023 to LTM | P1 | [@fin-lead] | [Open] |
| DDR-FIN-013 | Intercompany balances and transactions with the seller group, and how they will be settled at completion | Latest month end | P2 | [@fin-lead] | [Open] |
| DDR-FIN-014 | Cash flow and bank statements reconciled to the ledger; restricted or trapped cash | Last 12 months | P2 | [@fin-lead] | [Open] |
| DDR-FIN-015 | Off-balance-sheet commitments, contingent liabilities, guarantees given and letters of comfort | Current | P2 | [@fin-lead] | [Open] |
| DDR-FIN-016 | Internal control environment: close calendar, key controls, known deficiencies, internal audit reports | Last 3 years | P2 | [@fin-lead] | [Open] |

How to review the financial answers:

1. Reconcile first. Before analysing anything, tie the monthly management accounts to the audited annual accounts and record the reconciling items. Unreconciled differences are the most common source of later price disputes.
2. Test management's EBITDA adjustments one by one against the evidence and classify each as accepted, rejected or pending. The quality of earnings scope (`finance/quality-of-earnings-scope`) sets the method.
3. Build the working capital history month by month. A peg derived from year-end balances alone ignores seasonality and is easy for the seller to manage.
4. List every item that could be treated as debt. The definitions of net debt and debt-like items in the SPA are negotiated from this list, so a missing item is value left on the table.
5. In a carve-out, separate the costs that will disappear (group management charges) from the costs the target will need standalone (its own finance team, insurance, audit, IT licences). The net of the two can be large and is often negative for the buyer.

## 4. Tax

<!-- Guidance: Tax diligence looks for historic exposures that the buyer inherits in a share deal and for attributes that affect value after the deal (losses, interest capacity, transfer pricing). In an asset deal most historic corporate tax stays with the seller, but transaction taxes and payroll exposures can still follow the business. Pitfall: treating the tax indemnity in the SPA as a substitute for diligence. -->

| ID | Request | Period or scope | Priority | Buyer owner | Status |
|---|---|---|---|---|---|
| DDR-TAX-001 | Corporate income tax returns, assessments and computations for each entity | Open years under local limitation periods | P1 | [@tax-lead] | [Open] |
| DDR-TAX-002 | Status of tax audits, disputes, rulings and correspondence with tax authorities | Open years | P1 | [@tax-lead] | [Open] |
| DDR-TAX-003 | Group structure chart with tax residence, permanent establishments and tax groups or fiscal unities | Current | P1 | [@tax-lead] | [Open] |
| DDR-TAX-004 | Tax losses and other attributes, and any rules that restrict them after a change of ownership | Current | P1 | [@tax-lead] | [Open] |
| DDR-TAX-005 | Transfer pricing documentation, intercompany agreements and the pricing of services from the seller group | Open years | P2 | [@tax-lead] | [Open] |
| DDR-TAX-006 | VAT and sales tax registrations, returns and any reviews or penalties | Open years | P2 | [@tax-lead] | [Open] |
| DDR-TAX-007 | Payroll tax and social security compliance, including treatment of contractors and expatriates | Open years | P2 | [@tax-lead] | [Open] |
| DDR-TAX-008 | Withholding taxes on dividends, interest, royalties and service fees paid cross-border | Open years | P2 | [@tax-lead] | [Open] |
| DDR-TAX-009 | Government grants, tax incentives and research credits, with clawback conditions | Open years | P2 | [@tax-lead] | [Open] |
| DDR-TAX-010 | Reorganisations, hive-downs and transfers made to prepare the sale, and their tax treatment | Last 7 years or local equivalent | P1 | [@tax-lead] | [Open] |
| DDR-TAX-011 | Tax provision and deferred tax workpapers supporting the financial statements | FY2023 to FY2025 | P2 | [@tax-lead] | [Open] |
| DDR-TAX-012 | Whether the target is part of a group within the scope of the global minimum tax rules, and the related data the seller provides | Current | P2 | [@tax-lead] | [Open] |

Review points for tax:

- Map every open year by entity and tax type against the local limitation period, and check the local law for each, because periods differ by country and can be extended by audits or disputes.
- In a carve-out, check how the target leaves any tax group or fiscal unity and whether that exit triggers tax for the target or leaves it liable for group taxes.
- Read the intercompany service charges from the seller together with the transfer pricing file (`finance/transfer-pricing-local-file`): if the charges were too low, the standalone cost is higher; if too high, the target's historic profit is understated.
- Quantify each exposure as a range with probability, and agree with counsel whether it is handled by price, a specific indemnity, an escrow or warranty and indemnity insurance.
- Hand post-deal attributes (losses, interest carry-forwards) to the income tax provision owner (`finance/income-tax-provision`) so the acquisition accounting reflects them.

## 5. Legal and corporate

<!-- Guidance: Legal requests confirm that the seller owns what it is selling, that the target's key contracts survive the change of control, and that there is no litigation or regulatory problem the price does not reflect. Pitfall: reviewing only the contracts the seller chooses to upload; ask for a complete list first, then select. -->

| ID | Request | Period or scope | Priority | Buyer owner | Status |
|---|---|---|---|---|---|
| DDR-LEG-001 | Constitutional documents, commercial register extracts, shareholder register and share capital history | Each entity, current | P1 | [@legal-lead] | [Open] |
| DDR-LEG-002 | Encumbrances over shares or assets: pledges, security, options, pre-emption rights | Current | P1 | [@legal-lead] | [Open] |
| DDR-LEG-003 | List of material contracts above the threshold, flagging change-of-control, exclusivity, non-compete, most-favoured-customer and termination for convenience terms | Current | P1 | [@legal-lead] | [Open] |
| DDR-LEG-004 | Copies of the contracts selected from DDR-LEG-003 | Current | P2 | [@legal-lead] | [Open] |
| DDR-LEG-005 | Financing agreements, security documents and any consent needed for the sale | Current | P1 | [@legal-lead] | [Open] |
| DDR-LEG-006 | Litigation, arbitration, claims threatened or pending, and settlements | Last 5 years | P1 | [@legal-lead] | [Open] |
| DDR-LEG-007 | Intellectual property register: patents, trade marks, domain names, software ownership, licences in and out, open-source use | Current | P1 | [@legal-lead] | [Open] |
| DDR-LEG-008 | Real estate: owned and leased sites, lease terms, break dates, landlord consents | Current | P2 | [@legal-lead] | [Open] |
| DDR-LEG-009 | Licences, permits and authorisations needed to operate, and any breach notices | Current | P2 | [@legal-lead] | [Open] |
| DDR-LEG-010 | Compliance programmes: anti-bribery, sanctions and export controls, competition, whistleblowing reports and investigations | Last 5 years | P2 | [@legal-lead] | [Open] |
| DDR-LEG-011 | Insurance policies, claims history and cover provided under the seller group programme | Last 5 years | P2 | [@legal-lead] | [Open] |
| DDR-LEG-012 | Agreements between the target and the seller group that will continue, terminate or need replacement after completion | Current | P1 | [@legal-lead] | [Open] |

Review points for legal:

- Build a change-of-control register from DDR-LEG-003: contract, counterparty, consent or notice required, revenue at risk, and who approaches the counterparty and when. Approaching customers before signing usually needs the seller's agreement.
- Check the anti-bribery and sanctions answers against the target's geographic footprint and sales channels (agents and distributors carry the most risk). Use Sanctions Exposure Assessment (`compliance/sanctions-exposure-assessment`) and the ISO 37001 programme template (`compliance/iso-37001-anti-bribery`) for the method.
- For software, confirm that employees and contractors assigned their rights in code to the target, and that open-source licences used in distributed products are compatible with the business model.
- Record each finding with a proposed SPA treatment: price, condition precedent, specific indemnity, warranty, or covenant between signing and completion.

## 6. Commercial and customers

<!-- Guidance: Commercial diligence tests whether the revenue in the plan will happen: market growth, competitive position, customer retention and pricing power. Where buyer and target compete, run customer-level analysis inside the clean team. Pitfall: accepting the seller's cohort analysis without the underlying customer-month data. -->

| ID | Request | Period or scope | Priority | Buyer owner | Status |
|---|---|---|---|---|---|
| DDR-COM-001 | Customer-by-month revenue file with contract start, end, product and price (CT) | January 2023 to latest month | P1 | [@commercial-lead] | [Open] |
| DDR-COM-002 | Annual recurring revenue bridge: new, expansion, contraction, churn | FY2023 to LTM | P1 | [@commercial-lead] | [Open] |
| DDR-COM-003 | Top 20 customer contracts with renewal dates and pricing terms (CT) | Current | P1 | [@commercial-lead] | [Open] |
| DDR-COM-004 | Sales pipeline with stage, probability and expected close date | Current | P2 | [@commercial-lead] | [Open] |
| DDR-COM-005 | Price list history and discounting policy, with average realised discount by segment | FY2023 to date | P2 | [@commercial-lead] | [Open] |
| DDR-COM-006 | Lost customer list with reasons for loss | Last 24 months | P2 | [@commercial-lead] | [Open] |
| DDR-COM-007 | Market studies, competitor analyses and win-loss reviews held by management | Last 3 years | P2 | [@commercial-lead] | [Open] |
| DDR-COM-008 | Customer satisfaction measures and service level performance against contract | Last 24 months | P2 | [@commercial-lead] | [Open] |
| DDR-COM-009 | Channel partner, reseller and agent agreements with commission terms | Current | P2 | [@commercial-lead] | [Open] |
| DDR-COM-010 | Marketing spend and customer acquisition cost by channel | FY2023 to LTM | P2 | [@commercial-lead] | [Open] |

Review points for commercial work:

- Recompute retention from DDR-COM-001 rather than accepting reported figures: gross revenue retention and net revenue retention by cohort, and concentration of the top customers. Feed the results to the revenue quality section of the QoE.
- Compare the plan's growth with the history of new business and churn. A plan that needs new bookings well above anything achieved before is a valuation finding, not only a commercial one.
- Note any customer that is also a competitor or a supplier of the buyer; the integration plan needs to handle that relationship on Day 1.
- Unit economics (`finance/unit-economics-analysis`) gives a structure for the customer acquisition cost and lifetime value questions.

## 7. Operations and supply chain

<!-- Guidance: Operations requests reveal how the business delivers its product and what it depends on: sites, suppliers, capacity and quality. For a service or software business, the critical dependencies are often hosting providers, carriers and key subcontractors. Pitfall: missing single points of failure that the seller manages informally. -->

| ID | Request | Period or scope | Priority | Buyer owner | Status |
|---|---|---|---|---|---|
| DDR-OPS-001 | Site list with function, headcount, capacity and utilisation | Current | P1 | [@ops-lead] | [Open] |
| DDR-OPS-002 | Top 15 suppliers by spend with contract terms, alternatives and single-source flags | FY2025 and LTM | P1 | [@ops-lead] | [Open] |
| DDR-OPS-003 | Key operating metrics: orders processed, order accuracy, on-time dispatch, cost per order | Monthly, last 24 months | P2 | [@ops-lead] | [Open] |
| DDR-OPS-004 | Quality incidents, product recalls, service credits paid | Last 3 years | P2 | [@ops-lead] | [Open] |
| DDR-OPS-005 | Business continuity and disaster recovery plans with the latest test results | Current | P2 | [@ops-lead] | [Open] |
| DDR-OPS-006 | Planned or deferred maintenance and capacity investments | Next 3 years | P2 | [@ops-lead] | [Open] |
| DDR-OPS-007 | Health and safety statistics, inspections and enforcement notices | Last 3 years | P2 | [@ops-lead] | [Open] |
| DDR-OPS-008 | Operating dependencies on the seller group: shared sites, shared contracts, shared suppliers | Current | P1 | [@ops-lead] | [Open] |

Review points for operations:

- Turn DDR-OPS-008 into a separation list. Each shared contract needs a decision: assign, split, replace or cover under the TSA.
- Compare deferred maintenance with the capex history from DDR-FIN-010. Under-investment before a sale inflates cash conversion and should be reflected in price or the plan.
- Supplier concentration and contracts that terminate on change of control go to the change-of-control register in section 5.

## 8. People, HR and pensions

<!-- Guidance: People requests cover cost, retention of key staff, employment law exposures and pensions. Employee data is personal data: request anonymised or pseudonymised data in early phases and agree the lawful basis and minimisation with counsel. Pitfall: uploading full personnel files to a data room in Phase 1. -->

| ID | Request | Period or scope | Priority | Buyer owner | Status |
|---|---|---|---|---|---|
| DDR-HR-001 | Anonymised employee census: role, grade, location, start date, base pay, variable pay, contract type | Latest month end | P1 | [@hr-lead] | [Open] |
| DDR-HR-002 | Organisation chart to two levels below the managing director, with key person identification | Current | P1 | [@hr-lead] | [Open] |
| DDR-HR-003 | Senior management service contracts, notice periods, non-competes and change-of-control payments | Current | P2 | [@hr-lead] | [Open] |
| DDR-HR-004 | Bonus, commission and incentive plans, including any transaction bonuses and how they are funded | Current and FY2025 | P1 | [@hr-lead] | [Open] |
| DDR-HR-005 | Pension arrangements: defined benefit obligations with the latest actuarial valuation, defined contribution plans, unfunded promises | Current | P1 | [@hr-lead] | [Open] |
| DDR-HR-006 | Works councils, trade union recognition, collective agreements and consultation history | Current | P2 | [@hr-lead] | [Open] |
| DDR-HR-007 | Employment claims, tribunal or labour court cases and settlements | Last 3 years | P2 | [@hr-lead] | [Open] |
| DDR-HR-008 | Contractors and agency staff: numbers, cost, length of engagement, status assessments | Current | P2 | [@hr-lead] | [Open] |
| DDR-HR-009 | Staff turnover, absence and engagement survey results | Last 24 months | P2 | [@hr-lead] | [Open] |
| DDR-HR-010 | Employees who work partly for the seller group or partly for the target, and how they will be allocated | Current | P1 | [@hr-lead] | [Open] |

Review points for people:

- Reconcile the census cost to the payroll cost in the management accounts. Gaps indicate missing populations (contractors, group staff recharged) or errors in the data.
- In a carve-out, the employee allocation in DDR-HR-010 is the most sensitive item. Employment law may decide which employees transfer with an asset or business transfer; in a share sale the employer does not change, but staff who worked for other group companies may need new contracts. Ask counsel which rules apply in each country.
- Where a works council exists, consultation duties can affect the timetable for signing or for later integration steps. Check the local law; in Germany, for example, the Works Constitution Act (Betriebsverfassungsgesetz) section 111 covers information and consultation on significant operational changes.
- Treat underfunded pensions and unpaid bonuses as debt-like items and pass them to the net debt analysis.

## 9. IT, data and cyber

<!-- Guidance: IT and cyber diligence establishes what the buyer inherits (architecture, technical debt, security posture, incidents) and what must be separated or replaced. For a software target, the product itself is the main asset, so code quality, ownership and security matter as much as the corporate IT estate. Pitfall: an interview-only review with no evidence such as penetration test reports or vulnerability data. -->

| ID | Request | Period or scope | Priority | Buyer owner | Status |
|---|---|---|---|---|---|
| DDR-IT-001 | Architecture overview of the product and corporate IT: applications, hosting, integrations, data flows | Current | P1 | [@it-lead] | [Open] |
| DDR-IT-002 | Software asset list and licences, flagging licences held by the seller group and those that do not transfer | Current | P1 | [@it-lead] | [Open] |
| DDR-IT-003 | Security policies, risk assessments and certifications or attestation reports | Current | P1 | [@it-lead] | [Open] |
| DDR-IT-004 | Penetration test and vulnerability scan reports with remediation status | Last 24 months | P1 | [@it-lead] | [Open] |
| DDR-IT-005 | Security incidents and personal data breaches, notifications made and lessons learned | Last 3 years | P1 | [@it-lead] | [Open] |
| DDR-IT-006 | Record of processing activities, data protection impact assessments, processor agreements and international transfer mechanisms | Current | P2 | [@it-lead] | [Open] |
| DDR-IT-007 | Software development process, code repositories, open-source component inventory and known technical debt | Current | P2 | [@it-lead] | [Open] |
| DDR-IT-008 | IT cost by category and IT headcount, including services charged by the seller group | FY2025 and LTM | P1 | [@it-lead] | [Open] |
| DDR-IT-009 | Major IT projects in progress, budgets and status | Current | P2 | [@it-lead] | [Open] |
| DDR-IT-010 | Services provided by the seller group IT (network, identity, email, ERP, service desk) and the effort to separate them | Current | P1 | [@it-lead] | [Open] |
| DDR-IT-011 | Availability and service level performance of the product, with major outages | Last 24 months | P2 | [@it-lead] | [Open] |
| DDR-IT-012 | Applicability of sector cyber and resilience rules to the target, and the compliance status | Current | P2 | [@it-lead] | [Open] |

Review points for IT and cyber:

- Map the separation scope from DDR-IT-002 and DDR-IT-010: which systems move with the target, which stay with the seller and must be replaced, and which are covered under the TSA. This is usually the longest-running integration workstream.
- Ask for evidence, not only answers: test reports, open findings and the age of critical vulnerabilities. Use Penetration Test Report (`security/pentest-report`) and Supplier Security Assessment (`compliance/supplier-security-assessment`) as checklists.
- Check whether personal data was processed lawfully and whether any incident was notified as required under the EU General Data Protection Regulation (Regulation (EU) 2016/679) or the local equivalent. Historic breaches can carry fines and claims that a share buyer inherits.
- Where the target falls within the EU NIS2 Directive (Directive (EU) 2022/2555) as transposed in its member state, confirm registration, risk-management measures and reporting arrangements.

## 10. ESG and sustainability

<!-- Guidance: ESG requests identify risks that affect value or reporting after the deal: environmental liabilities, emissions data needed for the buyer's sustainability reporting, human rights in the supply chain and governance failures. Scale the requests to the target's footprint and the buyer's own reporting duties. Pitfall: a generic questionnaire answered with policy documents and no data. -->

| ID | Request | Period or scope | Priority | Buyer owner | Status |
|---|---|---|---|---|---|
| DDR-ESG-001 | Greenhouse gas emissions inventory (scopes 1 and 2, and scope 3 where measured) with method and boundary | FY2024 and FY2025 | P2 | [@esg-lead] | [Open] |
| DDR-ESG-002 | Environmental permits, site surveys, contamination reports and remediation obligations | Current | P2 | [@esg-lead] | [Open] |
| DDR-ESG-003 | Supplier code of conduct, supply chain due diligence process and audit results | Current | P2 | [@esg-lead] | [Open] |
| DDR-ESG-004 | Sustainability reports, ratings, customer questionnaires answered, and sustainability-linked contract terms | Last 2 years | P2 | [@esg-lead] | [Open] |
| DDR-ESG-005 | Workforce diversity, pay equity and health and safety data | FY2024 and FY2025 | P2 | [@esg-lead] | [Open] |
| DDR-ESG-006 | Board and management governance: conflicts of interest, related-party transactions, whistleblowing cases | Last 3 years | P2 | [@esg-lead] | [Open] |
| DDR-ESG-007 | Data the target will need to provide for the buyer's sustainability reporting after completion, and the systems that hold it | Current | P3 | [@esg-lead] | [Open] |

Review points for ESG:

- Decide early whether the target falls into the buyer's sustainability reporting boundary and from which year. The EU reporting scope was narrowed in 2026; check the current rules and the buyer's own position with Sustainability Double Materiality Assessment (`finance/sustainability-double-materiality-assessment`).
- Treat contamination and remediation obligations as debt-like or indemnity items, not as reputational notes.
- Related-party transactions found here also go to the financial workstream, because they may need normalising in EBITDA.

## 11. Regulatory approvals and closing conditions

<!-- Guidance: List every approval that could be a condition to completion and the information each filing needs. Merger control and foreign investment screening timetables often set the earliest completion date. Pitfall: implementing parts of the integration before clearance (gun-jumping), which merger regimes prohibit. -->

| ID | Request | Period or scope | Priority | Buyer owner | Status |
|---|---|---|---|---|---|
| DDR-REG-001 | Turnover by country for each target entity, in the format counsel needs for merger control thresholds | Last financial year | P1 | [@legal-lead] | [Open] |
| DDR-REG-002 | Activities that may fall within foreign direct investment screening (critical infrastructure, data, defence, technology) | Current | P1 | [@legal-lead] | [Open] |
| DDR-REG-003 | Sector licences that require regulator consent to a change of control | Current | P1 | [@legal-lead] | [Open] |
| DDR-REG-004 | Foreign subsidies or financial contributions received from non-EU states, where relevant | Last 3 years | P2 | [@legal-lead] | [Open] |
| DDR-REG-005 | Third-party consents required under contracts or financing (cross-reference DDR-LEG-003 and DDR-LEG-005) | Current | P2 | [@legal-lead] | [Open] |

Regimes to check, as of 2026-10 (check local law and the current thresholds with counsel before relying on any of them):

| Regime | Reference | Point to note |
|---|---|---|
| EU merger control | Council Regulation (EC) No 139/2004 (EU Merger Regulation) | Notifiable concentrations may not be implemented before notification and clearance; Phase 1 review is 25 working days |
| National merger control in EU member states and the UK | National competition laws | Thresholds and suspensory effect differ by country |
| US premerger notification | Hart-Scott-Rodino Act, 15 U.S.C. 18a | Size-of-transaction threshold USD 133.9 million from 2026-02-17 (adjusted annually); initial waiting period 30 days (15 for cash tender offers). The 2025 notification form was vacated by a federal district court (E.D. Tex.) on 2026-02-12 and the agencies accept the earlier form; the FTC appeal is pending; check the FTC page for the current form |
| EU foreign investment screening | Regulation (EU) 2019/452, to be replaced by the revised FDI Screening Regulation (Official Journal 2026-06-26, in force 2026-07-16, applies from 2028-01-17; check the number and text on EUR-Lex) | Until 2028-01-17, national screening laws under the 2019 framework apply; check which regime governs the deal date |
| UK national security screening | National Security and Investment Act 2021 | Mandatory notification for acquisitions of qualifying entities in 17 sensitive areas; a notifiable acquisition completed without approval is void |

*Example*: for Project Heron, counsel confirmed that no merger filing is required. Corvid's worldwide turnover (below EUR 160m) and Tallow Lane's (about EUR 10.5m) are far below the EU Merger Regulation thresholds and the German GWB section 35(1) thresholds (combined worldwide turnover above EUR 500m, with one party above EUR 50m and another above EUR 17.5m in Germany); the consideration is far below the EUR 400m transaction value threshold in section 35(1a); UK merger control is voluntary and the CMA thresholds are not met; and the target has no US nexus. The UK National Security and Investment Act analysis for Tallow Lane UK Ltd concluded that its activities fall outside the 17 mandatory areas, so no notification was made.

Record each filing's information needs as requests here, and give the timetable to the integration plan, which must not schedule integration actions that take control before clearance.

## 12. Data room index

<!-- Guidance: Keep the data room structure aligned with the request IDs so reviewers can find answers and the disclosure letter can reference documents exactly. Pitfall: an index that the seller reorganises during the process, breaking references in findings. -->

| Folder | Content | Request IDs | Documents | Last upload |
|---|---|---|---|---|
| 01 Corporate *(Example)* | Constitutional documents, registers, structure | DDR-LEG-001, DDR-LEG-002, DDR-TAX-003 | 42 | 2026-08-28 |
| 02 Financial *(Example)* | Accounts, management accounts, trial balances, working capital | DDR-FIN-001 to DDR-FIN-016 | 186 | 2026-10-09 |
| 03 Tax *(Example)* | Returns, audits, transfer pricing | DDR-TAX-001 to DDR-TAX-012 | 74 | 2026-10-02 |
| 04 Commercial *(Example)* | Customer data (clean team folder 04-CT), pipeline, pricing | DDR-COM-001 to DDR-COM-010 | 95 | 2026-10-12 |
| 05 Operations *(Example)* | Sites, suppliers, KPIs, continuity | DDR-OPS-001 to DDR-OPS-008 | 58 | 2026-09-30 |
| 06 People *(Example)* | Census, plans, pensions, works council | DDR-HR-001 to DDR-HR-010 | 63 | 2026-10-05 |
| 07 IT and cyber *(Example)* | Architecture, security, data protection | DDR-IT-001 to DDR-IT-012 | 110 | 2026-10-14 |
| 08 ESG *(Example)* | Emissions, permits, governance | DDR-ESG-001 to DDR-ESG-007 | 21 | 2026-10-01 |
| 09 Regulatory *(Example)* | Turnover data, screening analysis | DDR-REG-001 to DDR-REG-005 | 9 | 2026-09-18 |

Freeze an archive copy of the data room at signing (many providers offer an export on encrypted media). The disclosure letter and the warranties usually refer to documents "fairly disclosed" in the data room, so the buyer needs a fixed record of what was there.

## 13. Q&A log and status reporting

<!-- Guidance: The Q&A log records every question about an answer, who asked, the reply and whether it closes the point. It is also evidence of what the seller told the buyer. Pitfall: questions sent by email outside the log, which then cannot be traced or disclosed. -->

| QA ID | Request ID | Question | Asked by | Date | Answer summary | Status |
|---|---|---|---|---|---|---|
| QA-031 *(Example)* | DDR-FIN-005 | Please provide the invoices supporting the EUR 110k legal cost adjusted out of LTM Sep-26 EBITDA | [@fin-lead] | 2026-09-21 | Invoices uploaded to 02.05.03; settlement agreement dated 2026-04-30 | Closed |
| QA-044 *(Example)* | DDR-FIN-012 | How was the EUR 280k group management charge allocated, and which services does it cover? | [@fin-lead] | 2026-09-24 | Allocation by revenue share; services listed in 02.12.01; IT services charged separately | Partial |
| QA-058 *(Example)* | DDR-IT-004 | Two critical findings in the 2026 penetration test show no remediation date. What is the status? | [@it-lead] | 2026-10-01 | One fixed 2026-10-08 with retest evidence; one scheduled for 2026-11 | Open |
| QA-067 *(Example)* | DDR-HR-005 | Please confirm whether the German pension promise is funded and provide the latest actuarial report | [@hr-lead] | 2026-10-03 | Unfunded; report as at 2025-12-31 uploaded to 06.05.02 | Closed |

Status report *(Example, as at 2026-10-16)*:

| Workstream | Requests | Closed | Partial or provided | Open | Open P1 |
|---|---|---|---|---|---|
| FIN | 16 | 11 | 4 | 1 | 0 |
| TAX | 12 | 7 | 3 | 2 | 1 |
| LEG | 12 | 6 | 4 | 2 | 0 |
| COM | 10 | 6 | 3 | 1 | 0 |
| OPS | 8 | 5 | 2 | 1 | 0 |
| HR | 10 | 7 | 2 | 1 | 0 |
| IT | 12 | 6 | 4 | 2 | 1 |
| ESG | 7 | 3 | 2 | 2 | 0 |
| REG | 5 | 4 | 1 | 0 | 0 |
| Total | 92 | 55 | 25 | 12 | 2 |

Report the open P1 items by name at each status call, with the owner and the date by which the deal team needs them. A status report that shows only counts hides the two requests that decide the price.

## 14. Findings handover and traceability

<!-- Guidance: Diligence has value only when findings change something: the price, the SPA, the conditions, or the integration plan. This section traces each finding from the request that produced it to the action taken. Pitfall: long diligence reports whose findings never reach the negotiation. -->

| Finding ID | Request ID | Finding | Value impact | Treatment | Owner | Destination |
|---|---|---|---|---|---|---|
| DDF-001 *(Example)* | DDR-FIN-012 | Standalone costs exceed the group management charge by EUR 80k a year (360 against 280) | EBITDA -80k at run-rate | Price (QoE adjustment) | [@fin-lead] | QoE, valuation |
| DDF-002 *(Example)* | DDR-HR-005 | Unfunded German pension obligation EUR 300k | Equity value -300k | Debt-like item in SPA definitions | [@fin-lead] | QoE net debt, SPA |
| DDF-003 *(Example)* | DDR-LEG-003 | Two top-10 customer contracts terminable on change of control | Revenue at risk EUR 725k | Pre-signing approach with seller consent; condition in SPA for the larger contract | [@legal-lead] | SPA, integration Day 1 |
| DDF-004 *(Example)* | DDR-IT-010 | ERP and payroll run on seller systems; no standalone instance | One-off separation cost EUR 150k, 9 months | TSA with exit plan | [@it-lead] | TSA, integration plan |
| DDF-005 *(Example)* | DDR-TAX-005 | Seller service charges below arm's length in FY2024 | Tax exposure range EUR 20k to 40k | Specific tax indemnity | [@tax-lead] | SPA |

Traceability from requests to deliverables:

| Deliverable | Fed by requests | Owner |
|---|---|---|
| Quality of earnings report (`finance/quality-of-earnings-scope`) | DDR-FIN-001 to DDR-FIN-016, DDR-COM-001, DDR-COM-002, DDR-HR-001, DDR-HR-004, DDR-HR-005 | [@fin-lead] |
| Valuation (`finance/valuation-report`) | QoE output, DDR-FIN-006, DDR-COM-002, DDR-COM-004, DDR-OPS-006 | [@corporate-development-head] |
| SPA and disclosure letter | All DDF findings, DDR-LEG series, DDR-TAX series | [@general-counsel] |
| Integration plan (`finance/m-and-a-integration-100-day-plan`) | DDR-FIN-012, DDR-OPS-008, DDR-HR-010, DDR-IT-010, DDR-LEG-012, DDR-REG series | [@integration-lead] |
| Investment committee paper (`finance/investment-committee-memo`) | Summary of DDF findings and value impacts | [@deal-lead] |

When a finding changes value, express it in the same unit as the price mechanism: an EBITDA adjustment multiplied by the valuation multiple, or a euro-for-euro deduction as a debt-like item. Mixing the two, or counting an item in both, is a frequent error in negotiation packs.

## 15. Glossary and references

<!-- Guidance: Define terms the seller's team and non-finance reviewers may not share, and list the laws and related templates cited. Keep references to name, number and date. -->

### 15.1 Glossary

| Term | Meaning |
|---|---|
| Carve-out | Sale of a division or business that depends on its parent group for some services or assets |
| Clean team | Named individuals allowed to see competitively sensitive data before completion, reporting only aggregated results |
| Change of control clause | Contract term that gives the counterparty rights (consent, termination, renegotiation) when ownership changes |
| Data room | Secure repository where the seller shares documents with bidders |
| Debt-like item | Obligation not shown as borrowing but deducted from enterprise value to reach equity value |
| Disclosure letter | Seller's document that qualifies the warranties in the SPA |
| Gun-jumping | Implementing a transaction, or taking control, before a required clearance |
| LTM | Last twelve months |
| QoE | Quality of earnings: analysis of the level and sustainability of earnings |
| SPA | Share purchase agreement |
| TSA | Transitional services agreement: seller services to the target for a limited period after completion |

### 15.2 References

| Reference | Version or date | Use |
|---|---|---|
| Council Regulation (EC) No 139/2004 (EU Merger Regulation) | Consolidated text on EUR-Lex | Standstill and notification (section 11) |
| Hart-Scott-Rodino Antitrust Improvements Act, 15 U.S.C. 18a | Thresholds effective 2026-02-17 | US premerger notification |
| Regulation (EU) 2019/452 and the revised EU FDI Screening Regulation | Revised regulation published 2026-06-26, in force 2026-07-16, applies from 2028-01-17 | Foreign investment screening |
| Gesetz gegen Wettbewerbsbeschränkungen (GWB, Germany) section 35 | Current text | German merger control thresholds |
| National Security and Investment Act 2021 (UK) | GOV.UK guidance updated 2026-07-15 | UK mandatory notification |
| Regulation (EU) 2016/679 (GDPR) | As amended | Personal data in diligence and breach history |
| Directive (EU) 2022/2555 (NIS2) | As transposed nationally | Cyber obligations of the target |
| Betriebsverfassungsgesetz (Germany) section 111 | Current text | Works council consultation on operational changes |
| Quality of Earnings Scope (`finance/quality-of-earnings-scope`) | [QOE-2026-001] | Financial diligence method |
| PBC Request List (`finance/pbc-request-list`) | Related | Similar request mechanics in an audit |
| DPIA (`compliance/dpia`) | Related | Data protection assessment of diligence data handling |

## Standard and licence note

Based on public law cited by name and number (EU Merger Regulation, Hart-Scott-Rodino Act, EU FDI screening regulations, UK National Security and Investment Act 2021, GDPR, NIS2 and the German Works Constitution Act) and on common M&A practice. The request list, structure, conventions and worked example are original; no adviser, bank, law firm or industry-body checklist is reproduced. Corvid Commerce Group plc, Tallow Lane Logistics GmbH, Marlow Ridge Holdings AG and all figures are fictional. Thresholds and timetables change; check the current official texts and take advice in each jurisdiction before use. This is a document format, not financial, investment, tax, legal or accounting advice. Template licence: MIT.