Due diligence in 2025 is faster, more data-driven, and less forgiving of sellers who show up unprepared. Here's what has changed and what it means for your exit.
Most founders who've never sold a company before imagine due diligence as a few weeks of answering questions and sharing spreadsheets. The reality is more like a stress test of everything you've built. Buyers, especially private equity firms and strategic acquirers with dedicated M&A teams, will pull on every thread they can find. If something unravels, it costs you money, time, or the deal itself.
What's changed in 2025 is that buyers are better equipped than ever. AI-assisted document review, automated financial analysis, and real-time data room platforms have compressed timelines while simultaneously raising the bar on what a "clean" process looks like. Sellers who understand this dynamic can use it to their advantage. Those who don't get eaten alive on reps and warranties, price adjustments, and earn-out structures designed to shift risk back onto them.
This article breaks down what modern due diligence actually looks like, where deals get derailed, and what a founder needs to do right now to be ready for a process in the next 12 to 36 months.
What Buyers Are Actually Looking For in Due Diligence
Before getting into the mechanics, it helps to understand the buyer's mindset. Every acquirer, whether a strategic buyer or a PE-backed platform, is trying to answer three questions: Is this business what you said it was? Are the earnings real and recurring? And what could blow up after we close?
Financial due diligence is still the centerpiece. A quality of earnings (QoE) report, typically commissioned by the buyer and conducted by a third-party accounting firm, will reconstruct your EBITDA from the ground up. They will add back or strip out one-time items, test revenue recognition, and look for any gap between reported earnings and what a new owner would realistically collect. For software companies doing $5M to $50M in revenue, expect QoE findings to move normalized EBITDA by 10% to 25% in either direction.
Legal due diligence runs in parallel. Buyers want clean IP ownership, no material contract disputes, no cap table surprises, and confirmation that key customer agreements are transferable. One founder we've seen go through this process discovered mid-diligence that a contractor who built her core product had never signed an IP assignment agreement. That one issue cost three weeks and roughly $150,000 in legal fees to resolve.
The Documents Buyers Request First
The initial due diligence request list typically lands within a week of signing an LOI and runs 50 to 100 line items long. The fastest-moving deals are ones where sellers can respond within 48 to 72 hours on the core items. That means having these organized before you enter a process:
- Three to five years of audited or reviewed financial statements
- Monthly MRR or ARR schedules with cohort-level churn data
- Customer contracts, especially the top 20 by revenue
- Cap table, including options, warrants, and any side letters
- All material vendor and partnership agreements
- Corporate formation documents, board minutes, and any prior financing documents
- Employee agreements, offer letters, and non-compete or non-solicitation agreements
- IP ownership documentation and any open-source software licenses in the product
- A complete list of pending or threatened litigation
- Tax returns for the last three years plus any open IRS correspondence
Sellers who have this in a well-organized virtual data room on day one signal to buyers that management is competent and the business is well-run. That perception directly influences price and deal terms.
How AI Is Changing the Speed and Depth of Due Diligence
Five years ago, a buy-side legal team might spend two weeks manually reviewing several hundred contracts. Today, AI-powered document review tools can process the same volume in hours, flagging change-of-control provisions, termination rights, and missing representations across every agreement simultaneously. Firms like Kira Systems, Luminance, and several proprietary platforms used by the major accounting firms have made this the standard, not the exception.
For sellers, this cuts both ways. The good news is that processes move faster. A deal that once took six months from LOI to close can now reach the finish line in 60 to 90 days when both sides are prepared. The less comfortable news is that buyers find things they used to miss. A buried indemnification clause or an unfavorable auto-renewal provision that might have slipped through manual review in 2019 gets flagged automatically today.
AI in Financial Modeling and Risk Detection
On the financial side, buyers are using AI-assisted tools to run anomaly detection across transaction-level data. They can spot revenue recognition patterns that look unusual, identify customers who are paying late or reducing spend before it shows up in aggregate churn figures, and model out scenarios where key customer concentrations present risk.
One private equity firm we work with regularly now requests a full export of the target company's billing system data as part of diligence. They run it through their own internal model to reconstruct ARR from scratch, independent of whatever the seller has reported. If the numbers don't reconcile within a tight tolerance, it raises immediate red flags and can trigger a price reduction or an earn-out tied to revenue verification post-close.
The practical takeaway for founders: your financial reporting needs to be airtight, internally consistent, and reconcilable to your source systems. If your QuickBooks doesn't tie to your Stripe data which doesn't tie to your CRM, fix that before you start a process, not during one.
Cybersecurity Due Diligence Is Now Non-Negotiable
A decade ago, cybersecurity was a checkbox item for most M&A buyers outside of defense and financial services. That has completely changed. After high-profile post-close breach disclosures at acquired companies, most sophisticated buyers now run a dedicated cybersecurity assessment as a standalone workstream.
This typically involves an external penetration test or a review of recent pen test results, an assessment of the company's security policies and incident response procedures, a review of SOC 2 compliance status (Type I or Type II), and an audit of access controls around sensitive customer data. For SaaS companies handling healthcare, financial, or personal data, buyers will also assess HIPAA, PCI-DSS, or GDPR compliance, depending on the customer base.
What a Cybersecurity Gap Costs You at the Table
A clean SOC 2 Type II report is worth real money in an M&A process. Buyers view it as proof that security controls have been independently tested and confirmed, which reduces their risk. Absence of SOC 2 in a SaaS business serving enterprise customers often triggers a specific escrow holdback at closing, typically 5% to 10% of deal value, held for 12 to 18 months pending a post-close audit.
We've seen deals where a buyer discovered the target company had experienced a data incident 18 months prior that was never formally disclosed to customers or regulators. In one case, that discovery triggered a $2M purchase price reduction and an additional $1M in escrow. The seller thought they'd buried a problem. The buyer's security team found it in server logs.
ESG Factors and How Much They Actually Matter in Software M&A
ESG is a real consideration in M&A due diligence, but its weight varies enormously depending on who's buying. If you're selling to a publicly traded strategic acquirer or a large institutional PE fund with LP commitments around sustainable investing, ESG matters and will be assessed. If you're selling to a smaller PE firm or a founder-led strategic, it's far less likely to be a gating issue.
For software companies in the $2M to $100M revenue range, the most relevant ESG considerations in diligence typically come down to three things: governance practices (board composition, related-party transactions, and documentation of major decisions), workforce practices (employee classification, compensation equity, and retention), and data privacy and ethics (how the company handles customer data and whether its AI or algorithmic tools create potential discrimination risks).
What Buyers Are Asking About ESG in Practice
A strategic buyer doing $500M or more in annual revenue will likely send a formal ESG questionnaire as part of diligence. These ask about carbon reporting, supplier diversity programs, board diversity, and pay equity analyses. For a 40-person SaaS company, this can feel wildly out of proportion to the business, but the buyer's internal M&A policy requires it.
The practical advice here is simple: don't fabricate policies you don't have, but do document the responsible practices you're already following. If you have a remote-first workforce that reduces commuting emissions, write it down. If you do annual compensation reviews, have the records. Buyers aren't expecting a climate tech company. They're looking for evidence that management thinks and operates professionally.
The Role of the Virtual Data Room in Running an Efficient Process
The quality of your virtual data room (VDR) sends a signal before buyers ask a single question. A well-organized VDR with clearly labeled folders, complete documents, and permission controls appropriate to the buyer's NDA status tells an experienced deal team that the seller is serious and the company is well-managed. A poorly organized VDR with duplicate files, missing documents, and broken links tells the opposite story.
Most sophisticated sellers today use platforms like Datasite, Intralinks, or DealRoom. The specific platform matters less than the organization and completeness of what's inside it. FIH.com typically builds the initial data room structure for clients early in the preparation phase, often three to six months before the first buyer conversation, so that the process can move efficiently from the moment an LOI is signed.
Controlling Information Flow During Diligence
One underappreciated aspect of a well-run VDR is controlling what buyers see and when. Not every document needs to go into the VDR on day one. Customer names, for example, are often redacted in initial document drops and only revealed after the buyer has signed a more specific NDA or demonstrated a credible path to closing. Competitive intelligence buried in operational data can be selectively timed to later diligence stages.
The goal is full transparency with the eventual buyer, but on a timeline that protects the seller if a deal doesn't close. In a competitive process with multiple bidders, this sequencing becomes critically important. You don't want a strategic competitor accessing your complete customer list before you've received a binding offer.
Working Capital Pegs, Escrows, and the Financial Mechanics That Move Money
Diligence is about more than validating the story. It directly feeds the financial mechanics of the deal structure. Two areas where this matters most are working capital adjustments and representations and warranties.
Working capital pegs are one of the most commonly misunderstood deal terms. The basic concept: the buyer and seller agree on a "target" level of working capital (current assets minus current liabilities) that should be in the business at closing. If actual working capital at close is below that target, the purchase price is adjusted down, dollar for dollar. If it's above, the seller gets more. For a $20M deal, a working capital dispute of $500K to $1M is completely normal. For sellers who haven't modeled this carefully, it can be a nasty surprise after the wire clears.
Reps and Warranties Insurance
Representations and warranties (R&W) insurance has become a standard tool in deals above roughly $20M in enterprise value. Instead of holding 10% of deal proceeds in escrow for 18 to 24 months to cover any breaches of seller representations, the buyer purchases an insurance policy that covers those claims. The seller walks away with more cash at closing.
R&W insurance typically costs 2% to 4% of the policy limit, which is usually sized at 10% of deal value. On a $50M deal, that's a $5M policy costing $100K to $200K in premium, typically split or fully absorbed by one party depending on negotiation. The underwriters conduct their own review of diligence materials, which creates yet another reason to have your documentation clean and complete before you enter a process.
Human Capital and Culture: The Diligence Category That Kills Post-Close Value
Financial and legal due diligence identifies risks before close. Poor culture assessment destroys value after close, and it's harder to quantify, which is why it often gets less attention than it deserves.
Buyers want to understand whether key employees have retention agreements and whether those agreements are enforceable. They want to know who the three to five people are who could walk and materially damage the business, and what the plan is to keep them. For founder-led companies in particular, buyers will scrutinize management depth. A business where all customer relationships, all product decisions, and all vendor negotiations run through the founder is a business that presents significant key-person risk.
What Founders Should Do Before Diligence Starts
The single most valuable thing a founder can do in the 12 months before running a process is to deliberately reduce key-person dependency. Document processes. Promote managers into decision-making roles. Let senior sales or customer success leaders own relationships with top accounts. This isn't just about making buyers comfortable. It results in a better-run business regardless of whether you sell.
Buyers will also look at voluntary turnover rates over the past two to three years and compare them to industry benchmarks. SaaS companies with voluntary turnover above 20% annually will face questions. Companies with strong retention, documented career development programs, and consistent employee satisfaction data have a tangible advantage in diligence and at the negotiating table.
Frequently Asked Questions
How long does due diligence typically take in a software M&A deal?
For most software companies in the $10M to $100M revenue range, due diligence runs 45 to 90 days from LOI signing to closing, assuming the seller is well-prepared and responsive. Deals with missing documentation, complex structures, or contested findings can stretch to 120 to 150 days. Every additional month of diligence increases the risk that a deal falls apart or that the buyer renegotiates terms.
What is a quality of earnings report and do I need one as a seller?
A quality of earnings report is an independent analysis of your adjusted EBITDA, typically commissioned by the buyer but sometimes run by the seller proactively. Seller-side QoE reports, which cost $30,000 to $80,000 depending on complexity, are increasingly common in deals above $5M in EBITDA. They speed up diligence, identify issues before buyers find them, and often result in a higher final price because they reduce buyer uncertainty.
What kills deals during due diligence?
The most common deal killers are revenue that doesn't reconcile to source systems, undisclosed customer concentration (when the top three customers represent more than 40% to 50% of revenue), surprise litigation or regulatory issues, missing IP assignments, and working capital disputes that neither side anticipated. Most of these are preventable with proper preparation 6 to 12 months before starting a process.
How does cybersecurity affect my company's valuation in an M&A deal?
A company with a clean SOC 2 Type II report, documented incident response procedures, and no known breaches will face fewer escrow holdbacks and price adjustments than one with gaps. In enterprise SaaS deals, buyers will typically require a third-party security assessment. Material vulnerabilities found in diligence can reduce purchase price by 5% to 15% or result in specific escrow provisions covering potential post-close liabilities.
Should I disclose problems I know about before diligence starts?
Yes, always. Buyers who discover issues during diligence that were not proactively disclosed interpret it as a character issue, not just a business issue. They wonder what else is being hidden. Proactive disclosure of known issues, framed with context and a mitigation plan, is almost always received better than discovery. The exception is truly immaterial items; use judgment, but when in doubt, disclose.
What is the difference between escrow and an earn-out, and which is better for me as a seller?
Escrow holds a portion of the purchase price (typically 5% to 15%) in a neutral account post-close to cover potential indemnification claims. Earn-outs tie a portion of the purchase price to future performance metrics, usually revenue or EBITDA targets measured 12 to 24 months post-close. Escrow is generally more favorable to sellers because the money is contractually yours if no claims are made. Earn-outs are riskier because post-close business performance can be influenced by buyer decisions you no longer control.
Conclusion: What a Prepared Seller Looks Like in 2025
The companies that get the best outcomes in 2025 M&A processes are not necessarily the fastest-growing or the most profitable. They're the most prepared. Clean financials, organized documentation, proactive disclosure of issues, and a management team that can run the business independently of the founder, these are the factors that separate sellers who close at full price from sellers who take haircuts, earn-outs, and extended escrows.
Due diligence is not something that happens to you. It's something you prepare for. The work starts 12 to 24 months before you sign an LOI, not the day after.
If you're a technology or software founder thinking about a sale or capital raise in the next one to three years, FIH.com offers confidential exit-readiness conversations at no cost and no obligation. Our team works exclusively in the technology sector, maintains a network of more than 15,000 active strategic and financial buyers, and operates on a success-based fee structure so our incentives are aligned with yours. Reach out when you're ready to think through what a process could look like for your business.