Due Diligence Checklist: A Practical Guide for Legal and Deal Teams

A due diligence checklist is a structured list of the documents to request, the facts to verify and the risks to assess before completing a merger, acquisition, financing or major commercial agreement. A good due diligence checklist records what to verify in each category, not just what to collect.

This due diligence checklist sets out what to verify in eight risk categories, how to run the contract review at the center of the process, and what to do with each finding once it surfaces. It is written for in-house legal teams and deal counsel.

What a good due diligence checklist actually does

A due diligence checklist converts a seller's representations into verified fact while there is still time to act on what the verification turns up. It is a risk instrument, and the legal meaning of the term carries that same sense of investigation undertaken before commitment.

Well-designed checklists:

1. Reduce the chance of missing a material issue.
2. Create a repeatable review standard across deals and reviewers.
3. Let reviewers spend their time on the highest-risk areas first.
4. Surface issues while the deal terms can still be changed.

A checklist does not replace judgment, and it is not a substitute for scoping. It provides the structure that lets judgment be applied where it changes the outcome.

[cta-1]

When and why you need a due diligence checklist

A due diligence checklist is needed whenever a transaction depends on another party's representations, disclosures or assumptions. The trigger is the dependency, not the deal size, so a written checklist is warranted on any transaction where the buyer is relying on what the other side has said about the business. That discipline is also part of why transactional practice has absorbed so much of the recent work on artificial intelligence in mergers and acquisitions.

Transactions that warrant a full due diligence checklist include:

1. Mergers and acquisitions (M&A) involving a target company.
2. Asset purchases covering real property, equipment or intellectual property.
3. Equity or debt fundraising.
4. Joint ventures and strategic partnerships.
5. Large vendor, supply chain or licensing agreements.

How scope scales with the deal

Scope should scale with deal size, complexity and risk tolerance. A seed-stage financing may reasonably focus on corporate records, intellectual property and key employee agreements. An acquisition of a mature company calls for depth across financial statements, tax filings, material contracts, real estate and regulatory compliance. The process that runs it is closer to full M&A due diligence, which covers the workstreams and timeline this checklist feeds into. Smaller transactions still require discipline, applied to a narrower set of questions.

Core categories in a due diligence checklist

A due diligence checklist commonly groups requests into eight categories, organized around risk rather than internal departments, because risk is how issues actually surface during a transaction. A finding does not announce itself as belonging to the finance team. It announces itself as an unrecorded liability.

The eight categories below cover the substance of most commercial transactions:

1. Legal and corporate records
2. Financial and tax
3. Commercial and go-to-market
4. Contracts and revenue drivers
5. Intellectual property
6. Human resources and employment
7. Technology, data and security
8. Real estate and tangible assets

Each category below states what to request and what to verify, which are different questions. The request produces the document. The verification produces the finding.

Legal due diligence checklist

A legal due diligence checklist establishes whether the target company is properly formed, compliant with applicable law, and legally able to transfer the rights and assets being sold. Legal diligence findings differ from the rest in kind: they tend to be structural, which means they affect whether the deal can close at all rather than what it should cost.

1. Articles of incorporation and bylaws: Confirm the formation history and the charter as currently amended.
2. Certificate of good standing: Verify active status in the state of formation and in every state of foreign qualification.
3. Board and shareholder approvals: Check that minutes authorize the transaction and the prior issuances the cap table reports.
4. Capitalization table and equity records: Reconcile stock, options, warrants and convertible instruments against the underlying grant documents.
5. Litigation and disputes: Identify pending and threatened claims, arbitrations, settlements and government investigations.
6. Licenses, permits and regulatory filings: Verify every license the business needs to keep operating after a change of ownership.
7. Related-party transactions: Identify agreements with founders, affiliates or entities under common control, and the terms on which they were struck.

What to reconcile, not just collect

The detail that matters in legal diligence is reconciliation rather than collection. A transaction approved in board minutes but not reflected in the cap table is a common gap, and it is usually the real finding. Disputes resolved through arbitration rather than litigation are among the easiest to miss, because they leave no public docket to search and surface only through counsel correspondence or the company's own records. Ask for the list of matters resolved outside court, not just the litigation schedule, and ask who at the company would know.

Where filing thresholds become a schedule

Where the transaction crosses the reporting thresholds, the waiting period under the premerger notification program becomes a scheduling constraint on closing rather than a document to file, so it belongs on the deal timeline from the first week.

Financial due diligence checklist

A financial due diligence checklist tests whether reported financial statements reflect the company's economic reality. Financial diligence concentrates on cash, liabilities and the assumptions underneath a forecast, because those are the inputs to valuation that a balance sheet alone does not expose.

1. Historical financial statements: Review balance sheets, income statements and cash flow statements, audited where audits exist.
2. Tax returns and filings: Verify federal, state and local filings, and any correspondence with the Internal Revenue Service.
3. Unresolved tax liabilities: Assess open assessments, voluntary disclosure positions and nexus exposure (whether the company's activity in a state creates a tax filing obligation there) in states where the company sells.
4. Debt, liens and credit agreements: Confirm loan documents, security interests, guarantees and off-balance-sheet obligations.
5. Forecasts and projections: Test the assumptions and the sensitivity analysis rather than the output.
6. Accounting policies: Review revenue recognition, expense capitalization, reserves and auditor communications.
7. Working capital: Establish the normalized working capital level the purchase price will be adjusted against, and how it was calculated.

Why statements and tax returns rarely match

In practice, financial statements and tax returns rarely reconcile on first pass. The difference is a question to ask rather than an error to correct, and the add-backs (adjustments that reverse one-time or non-operating items out of reported earnings) it exposes are often the adjustment that matters most to the price.

Commercial and go-to-market due diligence checklist

A commercial due diligence checklist evaluates whether the business can sustain its revenue in practice rather than in the model. It looks at who buys, why they renew, and how concentrated the answer turns out to be.

1. Customer contracts and revenue concentration: Identify the top customers by revenue and the share each represents.
2. Renewal and churn data: Review retention by cohort, renewal rates and the reasons recorded for losses.
3. Sales pipeline and backlog: Test pipeline accuracy against historical conversion rather than accepting the stated figure.
4. Pricing and discounting practices: Confirm standard pricing, the frequency of exceptions, and who approves them.
5. Channel and reseller agreements: Review partner terms, referral arrangements and exclusivity provisions.
6. Marketing and co-selling commitments: Check obligations that survive the transaction.
7. Supplier and vendor concentration: Identify single-source dependencies and what switching away from each would cost.

How customer concentration hides

Customer concentration can be obscured by account naming. A top-customer list showing three unrelated accounts can resolve into a single buying group holding three legal entities, which changes the concentration risk materially and is visible only by checking corporate parentage, not account names.

Contract due diligence checklist

A due diligence contract review checklist focuses on the agreements that actually govern revenue, obligations and risk allocation. Contract diligence findings are frequently actionable before closing, because a consent or a waiver can be sought while the deal is still open.

1. Material customer and vendor contracts: Review the highest-value agreements and the dependencies they create.
2. Assignment and change-of-control provisions: Identify agreements that require consent, permit termination, or reprice on a change of ownership.
3. Termination rights and renewal terms: Confirm notice periods, automatic renewals and early termination costs.
4. Liability caps and indemnities: Assess uncapped exposure, customer-favorable indemnities and unusual risk allocation.
5. Non-standard and heavily negotiated terms: Flag side letters, amendments and deviations from the company's standard form.
6. Most-favored-nation and exclusivity clauses: Check commitments that constrain pricing or partnering after close.

Why silence on consent is not permission

Consent provisions need careful reading, because their absence is not the same as permission. Where an agreement is silent on change of control, whether the transaction triggers a consent requirement may turn on the deal structure and the governing law rather than on the contract text. Anti-assignment rules also do not operate uniformly across every type of right. An equity transaction and an asset purchase can produce different answers on identical wording, so the structure has to be settled before this review is useful. Record the structure assumption at the top of the review log, because a change in structure late in the deal invalidates every consent conclusion reached under the previous one.

Read the assignment terms early

Reading assignment provisions closely, and in the first week rather than the last, is what keeps a required consent from becoming a closing condition discovered with no time left to obtain it. Pair that reading with the caps, because a generous liability cap alongside a broad indemnity is not the protection it appears to be, and the two provisions have to be read together rather than ticked off separately.

How this fits the wider review

The mechanics of running a review of this kind, including the sequencing and the reviewer standards it depends on, are set out in the contract review process.

Intellectual property due diligence checklist

An intellectual property due diligence checklist verifies that the company owns, or holds the right to use, the intellectual property its products depend on. Ownership gaps are frequently fixable when caught early, and expensive to discover after closing.

1. Patent, trademark and copyright registrations: Verify ownership of record, status and maintenance history.
2. Employee invention assignments: Confirm that every employee who contributed to the product assigned the resulting rights.
3. Contractor and founder IP agreements: Check assignments from contractors, agencies and pre-incorporation founders.
4. Open-source usage and compliance: Review the open-source inventory against license obligations for attribution and distribution.
5. Inbound and outbound licenses: Assess exclusivity, field-of-use limits, sublicensing rights and termination triggers.
6. Domain names and brand assets: Confirm registrant control of domains and social accounts.
7. Trade secrets and confidentiality controls: Confirm that the measures protecting unregistered intellectual property are documented and actually followed.

Where ownership gaps usually start

The original contractor who wrote the codebase often predates the company's standard assignment paperwork, and no later agreement cures that absence retroactively. Verifying the chain of title on intellectual property means starting at the first commit rather than at the current employee roster.

Human resources and employment due diligence checklist

A human resources due diligence checklist assesses workforce obligations that affect integration cost, retention and post-closing stability. Human resources diligence affects deal value directly, because key employees frequently carry a share of it, and their agreements determine whether that value survives the transaction.

1. Employment agreements and offer letters: Review compensation, severance, notice and change-of-control terms.
2. Restrictive covenants: Confirm the enforceability posture of non-compete and non-solicit terms in each relevant jurisdiction.
3. Equity compensation and incentive plans: Verify grants, vesting schedules, acceleration triggers and plan compliance.
4. Independent contractor arrangements: Assess classification exposure and whether assignment terms are present.
5. Benefit plans and obligations: Review plan documents, funding status and any unfunded liabilities.
6. Wage, hour and policy compliance: Check classification, overtime practice and handbook currency.
7. Collective bargaining and works councils: Confirm any union agreements and the consultation obligations a transfer would trigger.

The classification exposure that survives closing

Classification exposure survives the transaction and compounds quietly. A contractor population that functions as employees creates liability that does not appear in any single document, and it is identified by comparing actual working arrangements against the written terms. The reading discipline that applies to employment contract review applies here, at portfolio scale.

Technology, data and security due diligence checklist

A technology and data due diligence checklist examines whether systems are reliable, secure and transferable, and whether the handling of personal data creates regulatory exposure. Technology diligence increasingly drives deal terms and insurance requirements, as data breach history and AI vendor dependencies have become standard negotiating points.

1. Core technology stack: Review proprietary systems, third-party platforms and the dependencies between them.
2. Data inventory and processing records: Confirm what personal data is collected, where it is stored and on what legal basis.
3. Data processing agreements: Verify that agreements are in place with every processor handling personal data.
4. Security policies and incident history: Review controls, penetration test findings and prior incidents with their remediation.
5. Third-party software and service dependencies: Check contract terms, service level agreements and disaster recovery provisions.
6. Access control and offboarding practice: Confirm that access is revoked when people leave.
7. AI and model usage: Confirm which systems rely on third-party models, on what contractual terms, and whether customer data reaches training.

Processor terms are a documentary requirement

Where the target processes personal data on another party's behalf, the written terms required under Article 28 of the General Data Protection Regulation are a documentary requirement rather than a best practice, and their absence is a finding in its own right.

State privacy obligations run in parallel

Companies selling to consumers in California carry a separate set of obligations under the California Consumer Privacy Act that a European-focused review does not automatically cover, so the question is which regimes apply, not whether privacy was looked at.

Remediation evidence is a separate request

The finding that matters in a penetration test report is whether the issues it identified were remediated. The remediation evidence is a separate request, and it is often not made. Asking for the report without asking for the closure record leaves the question of whether the findings were fixed unanswered.

[cta-2]

Real estate and asset due diligence checklist

A real estate due diligence checklist confirms that physical assets are owned or leased as represented and can transfer without unexpected restriction. Real estate diligence is worth running even on asset-light businesses, which still carry lease and equipment exposure.

1. Owned property records: Verify deeds, title condition, encumbrances and zoning compliance.
2. Leases and amendments: Review term, renewal rights, assignment and change-of-control consent provisions.
3. Equipment and asset schedules: Confirm material equipment, vehicles and hardware against depreciation schedules.
4. Environmental reports and obligations: Assess contamination risk, prior assessments and remediation obligations.
5. Insurance coverage and exclusions: Review property and casualty coverage, limits and exclusions.
6. Condition and deferred maintenance: Check the cost of deferred work that transfers with the asset.
7. Property tax and assessments: Verify current assessments, any pending appeals, and special assessments that transfer with the property.

Landlord consent belongs in the first wave

A landlord consent requirement can block a closing rather than merely adjust a price. It sits on the critical path in the same way a customer consent does, and landlords are frequently slower to respond, so the request belongs in the first wave. The termination and renewal terms deserve the same early attention, because an option deadline falling inside the deal timeline becomes the buyer's problem.

Turning the checklist into a document request list and data room index

A due diligence checklist and a due diligence document request list are different artifacts doing different jobs. The checklist records what must be verified; the document request list is the numbered set the other side actually receives. Converting one into the other is where most of the process friction lives.

Build the request list from the verification

Each verification item becomes a numbered request naming a specific document, a date range and a format. A request for "material contracts" produces whatever the seller considers material. A request for "all customer agreements generating more than the stated revenue threshold in the last three fiscal years, including amendments and side letters" produces a reviewable set.

Mirror the index to the request numbering

When the data room index uses the same numbering as the request list, a reviewer can distinguish three states that otherwise blur together:

1. Documents provided and reviewed.
2. Documents provided that do not answer the request.
3. Requests with no responsive document at all.

The third state is the one that produces findings, and it becomes invisible the moment the index is organized by the seller's folder structure instead of by the request.

Run the second request list deliberately

A full data room does not mean a complete review. The second request list, built from the gaps and partial answers in the first round, is where the substantive findings usually appear, and it should be scheduled from the outset instead of treated as a sign that something went wrong.

Treat data room access as its own review

Data rooms carry commercially sensitive material, so the confidentiality terms governing who may enter, what may be copied and what happens on termination deserve the same scrutiny as the documents inside.

Which due diligence findings are deal-blocking, priced, or papered

Due diligence red flags are not all the same kind of problem, and a checklist that records findings without dispositioning them stops one step short of the decision the deal team needs. Every finding resolves into one of three outcomes, and naming which one applies is the analytical work.

Findings that change the deal or stop it

These are issues where the thing being bought is not the thing described, or where the risk cannot be bounded, which is usually a question of whether the limitation of liability holds:

1. Ownership gaps in the intellectual property the product depends on.
2. Uncapped liability under agreements that generate material revenue.
3. Consent requirements the counterparty has signaled it may withhold.
4. Regulatory non-compliance that cannot be cured before or shortly after closing.

Findings that move price

These are quantifiable exposures better handled through the purchase price than through papering:

1. Unrecorded liabilities and open tax assessments.
2. Deferred maintenance and capital expenditure the seller has postponed.
3. Customer concentration that raises the discount rate rather than the liability.
4. Remediation cost for security or environmental findings.

Findings that get papered

These are risks that can be allocated through the agreement, and the drafting of an indemnification provision is where a good deal of that allocation happens:

1. A specific indemnity for an identified, bounded exposure.
2. An escrow or holdback sized to the contingency.
3. A bespoke representation with a corresponding survival period.
4. A closing condition requiring a named third-party consent.

Why the ordering matters

Representations and warranties, financial exposure and consent blockers carry the most weight in a commercial transaction, because they determine the price and the ability to close.

Choosing the remedy is a negotiation

Selecting between a price adjustment, an indemnity and a closing condition is a negotiating decision rather than a mechanical one, and how a team approaches it draws on the positions it has already recorded in a negotiation playbook. A finding also needs a named owner and a deadline, or it sits on the log until closing without ever being resolved.

Who owns each section of the due diligence checklist

Buyer's counsel usually prepares the due diligence checklist, with input from investors, accountants and subject-matter specialists. But whoever prepares the checklist does not own every section of it. Most sections have a substantive owner outside the legal team and a legal reviewer who signs off on the risk. Treating the whole list as legal's property produces a review that is thorough on documents and thin on substance, because the person who can say what a document means operationally usually sits elsewhere. The table below sets out who owns each section of the due diligence checklist in practice.

Why the owner is rarely legal alone

The commercial sections need the deal desk and revenue operations rather than the sales team, because the people who negotiated the non-standard terms are the people who can explain them. And a finding is not closed when the document has been read; it is closed when the substantive owner has confirmed what the document means operationally.

In-house teams that run this process repeatedly tend to build the ownership map once and reuse it across deals, which is also how the tools for lawyers supporting it get standardized rather than rebuilt for every transaction.

How to adapt a due diligence checklist to your deal

No two transactions carry the same risk profile, so a due diligence checklist should be adapted to the deal before it is run. Adapting it to a deal means setting depth by naming thresholds rather than by naming intentions.

1. Deal size and structure: Set a contract review threshold by value, and state whether the deal is an asset purchase or an equity transaction, which changes what transfers.
2. Jurisdiction and regulatory environment: Name the regimes that apply, and the filings each one requires.
3. Industry-specific risk: Identify the sector obligations that a general checklist omits.
4. Buyer risk tolerance: Define what level of unquantified exposure is acceptable without a remedy.
5. Integration plan: Scope the sections that affect what happens after closing, not just at it.

The useful discipline is to define where scope stops. An instruction to review "material contracts" is not implementable. A threshold naming a contract value, a counterparty type and a date range is. Skipping this step does not reduce the review; it spreads the same effort across everything shallowly, which costs more.

Common due diligence mistakes to avoid

The most common due diligence mistakes are predictable, and each one has a recognizable tell.

1. Over-collecting without reviewing: The tell is a data room measured in documents rather than in resolved requests.
2. Missing contract-level risk: The tell is a consent requirement surfacing in the closing checklist rather than in the review.
3. Working from an outdated template: The tell is a checklist with no data protection or security section, or one that still treats them as technical appendices.
4. Treating diligence as a single pass: The tell is no second request list, which means the gaps in the first round were never worked.
5. Reviewing without a disposition: The tell is a findings log with no column for what happens to each finding.

The common thread is volume substituting for judgment: a review that resolves every open request beats one that only grows the data room, which is the same principle underneath any structured contract risk assessment.

Contract due diligence at volume

A due diligence contract review checklist holds up differently at ten agreements than at five hundred. Manual review degrades along three specific axes as volume rises: consistency between reviewers, completeness of the non-standard terms actually identified, and the time between a finding and the decision it should inform.

What volume exposes

Volume also exposes how much variation sits inside a contract set described as standard. A Spellbook Labs analysis of 3,019 material contract exhibits filed on EDGAR, the Securities and Exchange Commission's public filing system, found that 60% contained drafting errors. That is a useful calibration for any assumption that a target's executed agreements match the form they were papered from.

Where structured review helps

This is the point at which structured, AI-assisted review earns its place in a diligence workflow:

1. Applying one review standard across an entire document set rather than per reviewer.
2. Identifying assignment, change-of-control and termination provisions consistently across a full agreement set.
3. Surfacing terms that deviate from the company's own standard positions.
4. Comparing a non-standard clause against market practice to establish whether it is genuinely unusual.

Spellbook supports this work through the Review feature for per-agreement risk surfacing and redlining, the Associate agent for applying a review standard across a full document set, and the Compare to Market feature for testing whether a clause sits outside market practice.

The mechanism matters more than the feature list

The review is grounded in the team's own playbook positions and in a benchmark set of more than 20 million real contracts, which is what allows a deviation to be flagged as a deviation rather than merely as unfamiliar language. Teams evaluating the category tend to start with AI-assisted due diligence before narrowing a shortlist.

What these tools do not do

These tools can help a team apply a consistent standard and prioritize what to read closely; they do not make the risk judgment, and a diligence finding still requires a lawyer to decide what it means for the transaction. A fuller comparison of the tools for contract due diligence is a reasonable next step for a team scoping this work, since the category covers products built for different parts of the problem and the differences matter more than the shared capabilities.

Structured review is worth introducing before the data room opens rather than partway through it, because the review standard it applies has to be agreed first. Retrofitting a standard onto a review already in progress reintroduces exactly the inconsistency it was meant to remove. The underlying mechanics, including how extraction and clause identification behave across large document sets, are covered in AI legal document review.

Final thoughts

A good due diligence checklist produces decisions, not documents.

Scope the checklist before running it, convert each verification into a specific request, give every finding a disposition and a named owner, and keep the contract review consistent as the document count rises. The result is a cleaner closing and fewer discoveries after signing.

[cta-3]

FAQ

What is the difference between legal and financial due diligence?

Legal due diligence examines ownership, corporate authority, contracts, compliance and liabilities. Financial due diligence tests the accuracy of reported financials, cash flow, liabilities and the assumptions behind a forecast. The two overlap where a contract drives revenue recognition or creates an unrecorded obligation.

How long does due diligence usually take?

Timelines range from roughly two weeks on a small financing to several months on a complex acquisition. The two variables that move the schedule most are data room readiness and the number of third-party consents the transaction requires.

Should the buyer or the seller build the data room index?

Both build one, and they rarely match. The seller organizes the data room around its own folder structure, so the buyer needs a separate index keyed to its own request numbering. Without it, a request nobody answered disappears into a folder that looks full.

Can a seller back out of a contract during the due diligence period?

It depends on what the signed agreement provides. A due diligence or inspection period typically gives the buyer defined termination rights, while the seller's ability to withdraw is usually narrower and governed by the specific conditions, exclusivity provisions and break-fee terms negotiated into the agreement.

What counts as a red flag in due diligence?

A red flag is any finding that changes the decision rather than merely the paperwork. The highest-priority examples are ownership gaps in core intellectual property, uncapped liability under revenue-generating agreements, consent requirements a counterparty may withhold, and regulatory non-compliance that cannot be cured.