Due Diligence Request List Template (M&A Buy-Side)

Due Diligence Request List: [Project name, target name]

A buy-side due diligence request list for the acquisition of a company or business: transaction and confidentiality terms, the request ID and status convention, and request schedules for the financial, tax, legal, commercial, operations, people, IT and cyber, ESG and regulatory workstreams, followed by the data room index, the question-and-answer log and the handover of findings into the share purchase agreement, the valuation and the integration plan. It follows common M&A practice; the request wording is original and does not reproduce any adviser, bank or industry-body checklist. Laws are cited by name and number only. The worked example is "Project Heron", in which Corvid Commerce Group plc (a fictional SaaS retailer) evaluates the purchase of Tallow Lane Logistics GmbH, a fictional carve-out from a fictional seller; every name and figure is invented. Replace every [bracketed] value and every row marked Example. This is a document format, not financial, investment, tax, legal or accounting advice. Obtain the standard or law for the normative text.

Document control

Approvals

Revision history

Contents

1. Transaction overview and confidentiality
2. How to use this list
3. Financial
4. Tax
5. Legal and corporate
6. Commercial and customers
7. Operations and supply chain
8. People, HR and pensions
9. IT, data and cyber
10. ESG and sustainability
11. Regulatory approvals and closing conditions
12. Data room index
13. Q&A log and status reporting
14. Findings handover and traceability
15. Glossary and references
16. Standard and licence note

1. Transaction overview and confidentiality

The perimeter decides what each workstream asks for. In a carve-out, the seller's group often provides finance, payroll, IT, treasury and insurance to the target, so the target's own records understate the cost and complexity of running it alone. Ask for the services the target receives from the group (DDR-FIN-012 and DDR-IT-010) in the first round, because the answers drive the standalone cost adjustment in the quality of earnings work and the transitional services agreement (TSA) in the integration plan.

Confidentiality has two layers. The non-disclosure agreement (legal-lite/nda) governs the whole deal team. Where buyer and target compete or trade with each other, competition law limits who may see competitively sensitive information before completion, such as customer-level pricing, margins or bid pipelines. Route those requests through a clean team: a small named group, often external advisers, who report only aggregated conclusions to the buyer. Mark such requests "CT" in the request tables and ask counsel to approve the clean team membership before the data is uploaded.

2. How to use this list

2.1 Request IDs

Each request has an ID DDR-<workstream>-<NNN>. Workstream codes are FIN (financial), TAX, LEG (legal and corporate), COM (commercial), OPS (operations), HR (people), IT (IT, data and cyber), ESG and REG (regulatory approvals). Phase 2 requests start at 100 in each workstream so a reader can see at a glance when a request was raised. Follow-up questions on an answer go to the Q&A log (section 13) with a QA ID that points back to the request; they do not become new rows here unless they ask for new documents.

2.2 Priority

2.3 Status

2.4 Materiality and periods

Ask for items above a stated threshold so the seller can answer quickly and the reviewers can focus. A practical starting point is to relate the contract threshold to the target's revenue and cost base and to cover the top customers and suppliers by value. For Project Heron the deal team used the conventions below; set your own.

2.5 Working rules

• Send the list in a structured format (spreadsheet or tracker) and keep this document as the controlled version. The IDs must match.
• One buyer owner per request. The owner chases, reviews and closes it.
• Ask the seller to answer in the data room folder that matches the request ID, so section 12 stays usable.
• Hold a weekly status call with the seller's coordinator. Prioritise open P1 items and blocked items, not volume.
• Do not ask the same thing twice in different workstreams. Where a document serves several workstreams (for example the customer contracts), one workstream requests it and the others reference the ID.

3. Financial

How to review the financial answers:

1. Reconcile first. Before analysing anything, tie the monthly management accounts to the audited annual accounts and record the reconciling items. Unreconciled differences are the most common source of later price disputes.
2. Test management's EBITDA adjustments one by one against the evidence and classify each as accepted, rejected or pending. The quality of earnings scope (finance/quality-of-earnings-scope) sets the method.
3. Build the working capital history month by month. A peg derived from year-end balances alone ignores seasonality and is easy for the seller to manage.
4. List every item that could be treated as debt. The definitions of net debt and debt-like items in the SPA are negotiated from this list, so a missing item is value left on the table.
5. In a carve-out, separate the costs that will disappear (group management charges) from the costs the target will need standalone (its own finance team, insurance, audit, IT licences). The net of the two can be large and is often negative for the buyer.

4. Tax

Review points for tax:

• Map every open year by entity and tax type against the local limitation period, and check the local law for each, because periods differ by country and can be extended by audits or disputes.
• In a carve-out, check how the target leaves any tax group or fiscal unity and whether that exit triggers tax for the target or leaves it liable for group taxes.
• Read the intercompany service charges from the seller together with the transfer pricing file (finance/transfer-pricing-local-file): if the charges were too low, the standalone cost is higher; if too high, the target's historic profit is understated.
• Quantify each exposure as a range with probability, and agree with counsel whether it is handled by price, a specific indemnity, an escrow or warranty and indemnity insurance.
• Hand post-deal attributes (losses, interest carry-forwards) to the income tax provision owner (finance/income-tax-provision) so the acquisition accounting reflects them.

5. Legal and corporate

Review points for legal:

• Build a change-of-control register from DDR-LEG-003: contract, counterparty, consent or notice required, revenue at risk, and who approaches the counterparty and when. Approaching customers before signing usually needs the seller's agreement.
• Check the anti-bribery and sanctions answers against the target's geographic footprint and sales channels (agents and distributors carry the most risk). Use Sanctions Exposure Assessment (compliance/sanctions-exposure-assessment) and the ISO 37001 programme template (compliance/iso-37001-anti-bribery) for the method.
• For software, confirm that employees and contractors assigned their rights in code to the target, and that open-source licences used in distributed products are compatible with the business model.
• Record each finding with a proposed SPA treatment: price, condition precedent, specific indemnity, warranty, or covenant between signing and completion.

6. Commercial and customers

Review points for commercial work:

• Recompute retention from DDR-COM-001 rather than accepting reported figures: gross revenue retention and net revenue retention by cohort, and concentration of the top customers. Feed the results to the revenue quality section of the QoE.
• Compare the plan's growth with the history of new business and churn. A plan that needs new bookings well above anything achieved before is a valuation finding, not only a commercial one.
• Note any customer that is also a competitor or a supplier of the buyer; the integration plan needs to handle that relationship on Day 1.
• Unit economics (finance/unit-economics-analysis) gives a structure for the customer acquisition cost and lifetime value questions.

7. Operations and supply chain

Review points for operations:

• Turn DDR-OPS-008 into a separation list. Each shared contract needs a decision: assign, split, replace or cover under the TSA.
• Compare deferred maintenance with the capex history from DDR-FIN-010. Under-investment before a sale inflates cash conversion and should be reflected in price or the plan.
• Supplier concentration and contracts that terminate on change of control go to the change-of-control register in section 5.

8. People, HR and pensions

Review points for people:

• Reconcile the census cost to the payroll cost in the management accounts. Gaps indicate missing populations (contractors, group staff recharged) or errors in the data.
• In a carve-out, the employee allocation in DDR-HR-010 is the most sensitive item. Employment law may decide which employees transfer with an asset or business transfer; in a share sale the employer does not change, but staff who worked for other group companies may need new contracts. Ask counsel which rules apply in each country.
• Where a works council exists, consultation duties can affect the timetable for signing or for later integration steps. Check the local law; in Germany, for example, the Works Constitution Act (Betriebsverfassungsgesetz) section 111 covers information and consultation on significant operational changes.
• Treat underfunded pensions and unpaid bonuses as debt-like items and pass them to the net debt analysis.

9. IT, data and cyber

Review points for IT and cyber:

• Map the separation scope from DDR-IT-002 and DDR-IT-010: which systems move with the target, which stay with the seller and must be replaced, and which are covered under the TSA. This is usually the longest-running integration workstream.
• Ask for evidence, not only answers: test reports, open findings and the age of critical vulnerabilities. Use Penetration Test Report (security/pentest-report) and Supplier Security Assessment (compliance/supplier-security-assessment) as checklists.
• Check whether personal data was processed lawfully and whether any incident was notified as required under the EU General Data Protection Regulation (Regulation (EU) 2016/679) or the local equivalent. Historic breaches can carry fines and claims that a share buyer inherits.
• Where the target falls within the EU NIS2 Directive (Directive (EU) 2022/2555) as transposed in its member state, confirm registration, risk-management measures and reporting arrangements.

10. ESG and sustainability

Review points for ESG:

• Decide early whether the target falls into the buyer's sustainability reporting boundary and from which year. The EU reporting scope was narrowed in 2026; check the current rules and the buyer's own position with Sustainability Double Materiality Assessment (finance/sustainability-double-materiality-assessment).
• Treat contamination and remediation obligations as debt-like or indemnity items, not as reputational notes.
• Related-party transactions found here also go to the financial workstream, because they may need normalising in EBITDA.

11. Regulatory approvals and closing conditions

Regimes to check, as of 2026-10 (check local law and the current thresholds with counsel before relying on any of them):

Example: for Project Heron, counsel confirmed that no merger filing is required. Corvid's worldwide turnover (below EUR 160m) and Tallow Lane's (about EUR 10.5m) are far below the EU Merger Regulation thresholds and the German GWB section 35(1) thresholds (combined worldwide turnover above EUR 500m, with one party above EUR 50m and another above EUR 17.5m in Germany); the consideration is far below the EUR 400m transaction value threshold in section 35(1a); UK merger control is voluntary and the CMA thresholds are not met; and the target has no US nexus. The UK National Security and Investment Act analysis for Tallow Lane UK Ltd concluded that its activities fall outside the 17 mandatory areas, so no notification was made.

Record each filing's information needs as requests here, and give the timetable to the integration plan, which must not schedule integration actions that take control before clearance.

12. Data room index

Freeze an archive copy of the data room at signing (many providers offer an export on encrypted media). The disclosure letter and the warranties usually refer to documents "fairly disclosed" in the data room, so the buyer needs a fixed record of what was there.

13. Q&A log and status reporting

Status report (Example, as at 2026-10-16):

Report the open P1 items by name at each status call, with the owner and the date by which the deal team needs them. A status report that shows only counts hides the two requests that decide the price.

14. Findings handover and traceability

Traceability from requests to deliverables:

When a finding changes value, express it in the same unit as the price mechanism: an EBITDA adjustment multiplied by the valuation multiple, or a euro-for-euro deduction as a debt-like item. Mixing the two, or counting an item in both, is a frequent error in negotiation packs.

15. Glossary and references

15.1 Glossary

15.2 References

Standard and licence note

Based on public law cited by name and number (EU Merger Regulation, Hart-Scott-Rodino Act, EU FDI screening regulations, UK National Security and Investment Act 2021, GDPR, NIS2 and the German Works Constitution Act) and on common M&A practice. The request list, structure, conventions and worked example are original; no adviser, bank, law firm or industry-body checklist is reproduced. Corvid Commerce Group plc, Tallow Lane Logistics GmbH, Marlow Ridge Holdings AG and all figures are fictional. Thresholds and timetables change; check the current official texts and take advice in each jurisdiction before use. This is a document format, not financial, investment, tax, legal or accounting advice. Template licence: MIT.