Mergers and acquisitions represent significant milestones for any business, offering pathways to growth, market expansion and strategic advantage. Whether you are considering buying another business or preparing to sell your own, the process can feel complex. At the heart of any successful transaction is a critical investigative stage known as due diligence. It is the process of looking closely at the target company before a deal is signed.

You might be exploring an acquisition to grow your business or preparing for a future sale. In either case, understanding the due diligence process is essential for protecting your interests. This guide explains what due diligence involves, why it is so important in UK law and what you should expect during this phase. We will outline the key areas of investigation and provide a practical due diligence checklist to help you prepare.

What is due diligence in mergers and acquisitions?

Due diligence is a comprehensive investigation and analysis of a business before entering into a merger or acquisition. The primary goal is to verify the information provided by the seller and to uncover any potential risks or liabilities that may not be immediately obvious. Think of it as a thorough health check on the target business before you commit to the purchase.

In the UK, this process is particularly important because of a legal principle called caveat emptor, which means "buyer beware." This principle places the responsibility on the buyer to discover any issues with the target company. If a problem is missed during the due diligence investigation, the buyer generally has no legal recourse after the deal is complete unless specific protections were negotiated into the purchase agreement. Therefore, thorough due diligence is not just a formality; it is your main tool for managing risk.

The due diligence process allows the buyer to build a complete picture of the target company's strengths and weaknesses. This informs everything from the final price to the legal terms of the deal. A well-executed diligence review ensures that the price you pay reflects the true value and risk profile of the business you are acquiring.

What is the importance of due diligence in mergers and acquisitions?

Undertaking a detailed due diligence process is essential to the success of any M&A transaction. It serves as both a defensive measure to protect your investment and an offensive tool to strengthen your negotiating position. Skipping or rushing this stage can lead to significant financial loss and operational challenges after the transaction.

Here are the primary reasons why due diligence is so important.

Identifying and mitigating risks

A crucial function of due diligence is to identify potential risks and "deal-breakers." These are serious issues that could jeopardise the future of the target business or expose the acquiring company to unexpected liabilities. A diligent review can uncover hidden problems such as unresolved litigation, significant tax gaps or major environmental concerns.

Identifying these key risks early allows a buyer to make an informed decision. You might choose to walk away from the deal, renegotiate the price to account for the risk exposure, or insist on specific contractual protections, such as indemnities, in the final purchase agreement. The goal is to ensure there are no costly surprises after completion.

Ensuring an accurate valuation

The initial offer for a target company is typically based on preliminary financial information and strategic assumptions. The financial due diligence process rigorously tests these assumptions. By examining financial statements, accounting practices and the quality of earnings, you can confirm whether the seller's valuation is realistic.

If the due diligence process uncovers issues like overstated revenue, understated expenses, or unrealistic growth projections, the buyer has a strong basis for renegotiating the price downwards. This "price-chipping" is a common outcome of due diligence and helps ensure you do not overpay for the target business.

Informing the sale and purchase agreement

The findings from the due diligence report directly shape the legal protections written into the Sale and Purchase Agreement (SPA). This legal document contains warranties, which are factual statements the seller makes about the target company. If a warranty is later found to be untrue, the buyer can make a claim.

If your diligence review identifies a specific risk, such as pending litigation, you would not rely on a general warranty. Instead, your legal team will negotiate a specific indemnity in the SPA. An indemnity is a promise from the seller to cover a specific, known liability, offering much stronger protection than a warranty claim.

Planning for a smooth integration

Due diligence is not just about finding problems; it is also about planning for the future. The process provides deep insights into the target company’s culture, IT systems, key employees and operational workflows. This information is invaluable for planning a smooth post-completion integration.

Understanding these operational details helps the acquiring company anticipate challenges, retain key talent, and achieve the strategic objectives of the deal. A failure to plan for integration is a common reason why the anticipated "synergies" of a merger are never realised.

What is the due diligence process in mergers and acquisitions?

The due diligence process is a structured and collaborative exercise that usually takes place once heads of terms have been agreed and before the transaction completes. Depending on the size and complexity of the deal, it typically lasts between 30 and 90 days.

During this stage, the buyer and their advisors review key information about the business, including its finances, contracts, employees, assets, liabilities, property, legal obligations and any potential risks. The buyer’s team may include solicitors, accountants, tax advisors and other specialists. The aim is to help the buyer understand what they are acquiring, identify any issues early and make informed decisions before proceeding.

For the seller, due diligence is also an opportunity to present the business clearly, respond to questions and deal with any concerns in a transparent and constructive way.

The typical workflow:

Preparation and Virtual Data Room (VDR)

The seller gathers and organises important documents relating to the business. These may include company records, financial information, employee details, commercial contracts, property documents, insurance policies and details of any disputes or regulatory matters.

This information is usually uploaded to a secure online platform known as a virtual data room, or VDR. The VDR gives the buyer’s due diligence team controlled access to the documents while helping the seller protect confidential information.

Questionnaires and requests

The buyer’s legal team and financial advisors usually prepare detailed due diligence questionnaires and checklists. These request specific information about areas such as corporate structure, ownership, contracts, employment, property, tax, data protection and any existing or potential claims.

The seller and their advisors then provide responses, supporting documents and further clarification where needed.

Review and reporting

The buyer’s advisors review the documents in the VDR and the seller’s responses to identify anything that could affect the value of the business, the deal structure or the buyer’s decision to proceed.

In many UK transactions, solicitors prepare an “exceptions-only” due diligence report. Rather than summarising every document, this focuses on key risks, red flags and material issues that may need to be addressed before completion.

Management Q&A sessions

The buyer’s team may also hold meetings or calls with the target company’s management. These sessions allow the buyer to ask follow-up questions, clarify missing or unclear information and gain a better understanding of how the business operates in practice.

Informing the deal

The findings from due diligence will shape the final transaction. They may influence the purchase price, payment terms, warranties, indemnities, completion conditions and post-completion obligations.

Where issues are identified, the parties can often agree on practical solutions, such as obtaining consents, correcting documentation, adjusting the price or including specific protections in the purchase agreement.

In some UK deals, the due diligence report may also be reviewed by insurers providing Warranty and Indemnity insurance, known as W&I insurance. This can help manage risk by covering certain losses arising from warranty breaches.

Overall, due diligence gives both parties greater clarity and confidence, so the transaction moves forward in a well-managed, transparent and commercially sensible way.

What are the key types of due diligence in mergers and acquisitions?

Due diligence is not a single activity. It is a collection of specialist investigations designed to give the buyer a clear picture of the target business before completion.

While financial due diligence and legal due diligence are usually central to any merger or acquisition, a full review may also cover commercial, operational, employment, tax, IT, data protection, intellectual property and regulatory matters. Each area helps identify specific risks, liabilities and opportunities within the business.

A well-managed M&A due diligence process helps buyers make informed decisions, negotiate suitable protections and proceed with greater confidence. It can also help sellers prepare properly, respond to enquiries efficiently and reduce delays.

Financial due diligence

Financial due diligence is usually carried out by accountants or financial advisors. It goes beyond reviewing annual accounts and focuses on the true financial health of the business.

Key areas include:

• Financial statements: reviewing income statements, balance sheets, cash flow statements, management accounts and historic performance.
• Quality of earnings: assessing EBITDA, recurring revenue, margins and any exceptional or non-recurring expenses.
• Cash flow: understanding working capital, debtor and creditor positions, and any seasonal pressures.
• Tax compliance: reviewing corporation tax, VAT, PAYE, National Insurance and correspondence with HMRC.
• Debt and liabilities: identifying loans, overdrafts, credit facilities, guarantees and other financial commitments.

The findings can directly affect the valuation, purchase price, payment terms and protections included in the purchase agreement.

Legal due diligence

Legal due diligence is usually handled by solicitors and focuses on the legal health of the target company. It helps confirm that the seller has the right to sell the shares or assets and that the business is not exposed to significant legal risks.

Key areas include:

• Corporate structure: reviewing Articles of Association, shareholder agreements, statutory registers, Companies House filings and board minutes.
• Share ownership: confirming the chain of title to the shares, so the buyer knows the seller owns what they are selling.
• Material contracts: reviewing key customer, supplier, finance and employee-related contracts.
• Change of control clauses: checking whether important contracts can be terminated, renegotiated or require consent if the business is sold.
• Litigation and disputes: identifying any current, threatened or historic claims, complaints or investigations.
• Permits and licences: confirming that the company has the permissions and approvals it needs to operate lawfully.

Legal due diligence helps identify whether warranties, indemnities, consents, price adjustments or completion conditions may be needed.

Commercial and operational due diligence

Commercial and operational due diligence looks at how the business performs in the market and how effectively it operates day to day. It helps the buyer assess whether the business model is sustainable and capable of future growth.

Key areas include:

• Market position: assessing competitors, reputation, pricing strategy and market opportunities.
• Customer concentration: checking whether the business relies too heavily on a small number of customers.
• Customer relationships: reviewing retention rates, recurring revenue, contract length and the strength of key relationships.
• Suppliers: identifying key suppliers and whether suitable alternatives are available.
• Business plan: analysing forecasts, growth plans and the assumptions behind them.
• Operational systems: reviewing processes, supply chain resilience, reporting structures and areas needing investment.

This review helps the buyer understand both the current value of the business and its future potential.

Human resources and employment due diligence

Employment due diligence is particularly important in UK transactions because employee-related liabilities can be significant. This review examines the workforce, employment terms and any potential HR risks.

Key areas include:

• Employee details: reviewing roles, salaries, benefits, start dates, notice periods and length of service.
• Employment contracts: checking template contracts, director service agreements, senior employee terms and restrictive covenants.
• HR policies: reviewing staff handbooks, disciplinary and grievance procedures, sickness policies and equality policies.
• Disputes and claims: identifying grievances, disciplinary issues, settlement agreements or Employment Tribunal claims.
• Pensions: reviewing pension arrangements, auto-enrolment compliance and any potential pension liabilities.
• TUPE considerations: in an asset sale, the Transfer of Undertakings (Protection of Employment) Regulations may apply, meaning employees can transfer to the buyer on their existing terms.

This helps the buyer understand staff-related obligations and plan for a smooth transition after completion.

IT, data privacy and intellectual property due diligence

Technology, data and intellectual property are often central to the value of a modern business. This review checks whether the company owns or has the right to use its key systems, data, software and intellectual property.

Key areas include:

• IT infrastructure: reviewing hardware, software, hosting, cloud services, support contracts and disaster recovery arrangements.
• Software licences: checking that the company has proper licences and permissions for key systems.
• Cybersecurity: assessing security measures, cyber incident history and resilience against data breaches.
• Data protection compliance: reviewing privacy notices, data processing agreements, retention policies and UK GDPR compliance.
• IP ownership: verifying ownership of trademarks, patents, designs, copyright, domain names, software code and other intellectual property rights.
• Licensing agreements: reviewing agreements where the company licenses technology or intellectual property from third parties.
• Employee and contractor-created IP: checking whether intellectual property created by staff, consultants or developers has been properly assigned to the company.

This type of due diligence helps identify risks that could affect value, operations, reputation or future growth.

Regulatory and compliance due diligence

Regulatory and compliance due diligence checks whether the target company is operating in line with the laws, rules and standards that apply to its sector.

Key areas include:

• Sector-specific regulation: reviewing licences, registrations, permissions and compliance obligations.
• Anti-bribery and corruption: assessing policies, procedures and any history of fraud or improper payments.
• Health and safety: checking risk assessments, incident reports and any enforcement action.
• Environmental compliance: reviewing permits, waste management, contamination risks and regulatory correspondence.
• Consumer protection: assessing compliance with advertising, trading standards, product safety and consumer contract rules where relevant.
• NSI Act considerations: certain acquisitions in sensitive UK sectors may require notification or approval under the National Security and Investment Act 2021.
• Competition law: larger transactions may need to be assessed for potential competition concerns or review by the Competition and Markets Authority.

Regulatory due diligence helps reduce the risk of fines, enforcement action, delayed completion or restrictions on how the business can operate after acquisition.

Why do M&A deals fail during due diligence?

Due diligence is the phase where initial assumptions about a business are tested against factual evidence. Many promising deals fall apart during this phase because the investigation uncovers issues that contradict the seller's initial claims or make the proposed transaction too risky.

Here are some of the most common reasons deals collapse.

• Financial discrepancies: this is the most frequent deal-killer. If the buyer’s financial due diligence finds that revenue has been inflated or that expenses have been understated, this can undermine confidence in the seller's information and challenge the basis for the valuation.
• Undisclosed liabilities: the discovery of significant "hidden" costs, such as unpaid taxes, pending litigation or environmental clean-up obligations, can make a deal unviable for the buyer.
• Customer concentration: if the diligence process reveals that the target business relies on a single customer for a large portion of its revenue, the risk may be too high. If that customer leaves after the deal, the value of the acquired company could plummet.
• Cultural misalignment: a successful merger requires more than financial sense; the people and cultures must be compatible. If due diligence reveals a toxic leadership style or a work culture that clashes with the buyer's, the long-term integration is likely to fail.
• Regulatory Hurdles: for larger transactions, failure to secure necessary regulatory approvals from bodies like the CMA or under the NSI Act will stop a deal in its tracks.

A comprehensive M&A due diligence checklist

A thorough due diligence checklist is the backbone of any investigation. While every deal is unique, a good checklist provides a structured framework for the diligence team. This ensures that no critical area is overlooked during the diligence process.

Here is a foundational M&A due diligence checklist covering the key areas.

Corporate and legal

• Corporate structure: review Articles of Association, shareholder agreements, and official filings at Companies House.
• Material contracts: identify and review key customer and supplier agreements, paying close attention to change of control and termination clauses.
• Litigation: request details of any pending or threatened litigation, as well as past disputes.
• Permits and licences: check that the target company holds all necessary permits to operate legally.

Financial and tax

• Historical financials: review at least three years of audited financial statements.
• Tax compliance: examine corporation tax, VAT, and PAYE filings and correspondence with HMRC.
• Quality of earnings: analyse EBITDA and identify any non-recurring or personal expenses that have been added back.
• Debt: list all outstanding loans and credit facilities.

Commercial and operational

• Customers: list top customers by revenue and check for concentration risk.
• Suppliers: review key supply contracts and identify alternative suppliers.
• Business plan: analyse the company's business plan and the assumptions behind its growth projections.

HR and employment

• Employee details: create a list of all employees, including their roles, salaries, and length of service.
• Contracts and policies: review template employment contracts and the company’s HR handbook.
• Disputes: check for any ongoing or past employee disputes or tribunal claims.
• Pensions: identify the type of pension scheme and quantify any deficits.

Intellectual property and IT

• IP ownership: verify the registration and ownership of all trademarks, patents, and other intellectual property rights.
• Licensing agreements: review any agreements where the target company licenses technology from third parties.
• Data security: assess compliance with UK GDPR and check for any history of data breaches.