Checklist · Corporate

Conducting Merger and Acquisition Due Diligence: A Practical Checklist

15 U.S.C. § 18

Type: Checklist
Jurisdiction: National
Date: 2024-08-23
Topic: Corporate

Buy-side due diligence is not a document-collection exercise; it is a pricing exercise. This checklist walks a buyer's deal team through fourteen phases — from setting up the NDA, clean team, and data room, through corporate records, capitalization, material contracts, intellectual property chain of title, open-source exposure, employment and benefits, litigation, tax, privacy, insurance, real estate, environmental, and financial review — and then translates what you find into deal terms. Each phase lists what to request, what to look for, and the red flags that move price, change structure, or end the deal. A running worked example follows a software acquisition where the target's most valuable module was written by a contractor who never signed an assignment. The governing authorities are cited throughout, including 17 U.S.C. § 204(a), 35 U.S.C. § 261, the Hart-Scott-Rodino Act, the WARN Act, and the Delaware General Corporation Law. Diligence findings are worthless unless they land in the purchase agreement, so the final phase maps each category of finding to price, structure, reps, indemnity, escrow, or walk-away.

Conducting Merger and Acquisition Due Diligence: A Practical Checklist

Corporate > Mergers and Acquisitions | Published 23 August 2024 - Updated 5 December 2025 | UpLaw - uplaw.us

Due diligence is not about collecting documents. It is about finding the three facts that change the price, the two that change the structure, and the one that means you do not close at all.

Keywords: M&A due diligence, buy-side diligence, data room, cap table, change of control, anti-assignment, IP chain of title, invention assignment, open source, worker classification, WARN Act, HSR, successor liability, escrow and indemnity, purchase agreement

How to use this checklist

This is a buy-side checklist. It assumes a signed letter of intent with an exclusivity period, a target that has never been through a sale before, and a deal team that has to produce an answer — buy, buy cheaper, buy differently, or walk — in six to ten weeks.

Work the phases in parallel, not in sequence. Corporate and IP diligence gate everything else, so staff those first. And remember the discipline that separates competent diligence from expensive theater: every finding must resolve into an action — a price adjustment, a structural change, a specific indemnity, a closing condition, or a shrug. A finding that resolves into nothing was a waste of the exclusivity clock.

For the surrounding transaction — the LOI, the auction dynamics, the purchase agreement, the closing mechanics — see Mergers and Acquisitions: A Comprehensive Guide from Letter of Intent to Closing and The Mergers and Acquisitions Toolkit.

Our running example. Cordwell Analytics, Inc., a Delaware buyer, is acquiring Tidewater Metrics, Inc., a 42-person software company, for $58 million in a stock purchase. Tidewater's crown jewel is a forecasting engine called Ledgerline. We will follow Cordwell's deal team through the phases, and through the fact they find in week three.

The diligence clock at a glance

Week	What must be moving
0	NDA signed, LOI executed, clean-team protocol issued, data room opened, request list out
1–2	HSR assessment and filing decision; corporate and cap-table review; IP chain-of-title reconciliation begins
2–4	Material contracts and consents matrix; open-source scan commissioned; quality-of-earnings engagement
3–6	Employment, benefits, tax nexus, privacy, insurance, real estate, environmental
5–8	Findings quantified; disclosure schedules exchanged; purchase agreement negotiated against the findings tracker
8–10	Consents delivered, conditions satisfied, closing

Nothing on this chart is a rule. It is a reminder that HSR waiting periods, WARN notice periods, and landlord consent windows are calendar-driven — they cannot be compressed with money or effort, so they must start first.

Phase 0 — Set up: NDA, clean team, data room, and the diligence request list

[ ] Signed mutual NDA in place with a defined permitted-purpose clause, a non-solicit of the target's employees, and a residuals clause you actually read.
[ ] Confirm the NDA's confidentiality survival period outlasts the diligence period and any post-LOI cooling-off.
[ ] If buyer and target are actual or potential competitors, stand up a clean team: outside counsel or an external consultant reviews competitively sensitive data (customer-level pricing, forward-looking bids, cost structures) and reports only aggregated conclusions to the business team.
[ ] Assess Hart-Scott-Rodino applicability early (15 U.S.C. § 18a; 16 C.F.R. Parts 801–803). Thresholds adjust annually — check the current size-of-transaction and size-of-person tests. Filing drives the timeline; a Second Request drives it off a cliff.
[ ] Instruct the team on gun-jumping: pre-closing, the buyer may not control the target's pricing, bidding, or customer decisions. Coordination beyond what integration planning requires is exposure under HSR and Sherman Act § 1 (15 U.S.C. § 1).
[ ] Issue a written diligence request list, organized by workstream, with a named owner and a due date per item. The ABA Model Stock Purchase Agreement with Commentary contains the canonical starting list; adapt it, do not copy it wholesale.
[ ] Open a virtual data room with per-folder permissions, full audit logging, and a running Q&A log (question, date, answer, document reference). The Q&A log becomes evidence of what you were told.
[ ] Build a diligence findings tracker from day one with columns for: issue, workstream, quantified exposure (high/low/expected), and resolution — price, structure, rep, indemnity, escrow, closing condition, or accepted.

Why it matters, and the traps. The single most common buy-side failure is a diligence process that produces a 200-page memo and no decisions. The tracker prevents that. The second most common failure is the clean-team problem: a buyer's VP of Sales reads the target's customer-by-customer pricing file during diligence, the deal dies, and the buyer now has its competitor's pricing inside its sales organization. That is an antitrust and trade-secret problem simultaneously — and it is unfixable after the fact. Set the walls before the data room opens. If you need to sharpen the NDA itself, work from Building an Enforceable NDA Clause by Clause: A Practical Checklist.

Phase 1 — Corporate: formation, good standing, minutes, and the cap table

[ ] Certified charter and all amendments; bylaws; certificates of good standing from the state of incorporation and every state of foreign qualification.
[ ] All board and stockholder minutes and written consents since inception — not a summary, the actual book.
[ ] Confirm every issuance of stock, every option pool increase, and every material transaction (financings, key hires, debt, the merger itself) was actually approved by the body that had to approve it.
[ ] Subsidiary chart with ownership percentages; confirm each subsidiary is in good standing and its shares are held free of liens.
[ ] Stockholder agreements, voting agreements, ROFR/co-sale agreements, investors' rights agreements, drag-along provisions.
[ ] Identify the vote required for the deal: Delaware requires a majority of outstanding shares for a merger (8 Del. C. § 251) and for a sale of all or substantially all assets (8 Del. C. § 271), plus any charter-level or contractual supermajority, class vote, or preferred protective provision.
[ ] Map appraisal rights exposure (8 Del. C. § 262) and confirm the drag-along will actually deliver the signatures you need.

Why it matters, and the traps. Corporate law is state law, and Delaware is the reference point — most venture-backed targets are Delaware corporations, but a Texas or California entity follows its own code, and you must read it rather than assume the Delaware rule. The recurring finding is not fraud; it is sloppiness: a Series Seed that was approved by email and never papered, a 2019 option pool increase that shows up in the cap table but not in any board consent, minute books that stop in 2021. Every gap becomes a cleanup item, a bring-down condition, or a specific indemnity. The prophylactic version of this work is set out in Board Governance, Minutes, and Corporate Formalities: A Practical Checklist, and the duties the target's board owes while selling are in Corporate Governance and Fiduciary Duties: A Comprehensive Guide for Directors and Officers. For targets with a multi-entity structure, Running Multiple Businesses Under One Structure explains what you are actually buying when the org chart has four boxes.

Phase 2 — Equity: option grants, 409A valuations, vesting, and the unissued-shares problem

[ ] Fully diluted cap table tied out security by security to source documents: stock certificates or ledger entries, option grant agreements, warrants, SAFEs, convertible notes, and any promised-but-ungranted equity.
[ ] Equity incentive plan documents and every amendment; confirm the shares reserved under the plan cover every option actually granted.
[ ] For each option: board approval date, exercise price, the 409A valuation it was priced against, and the valuation's date.
[ ] Founder stock: restricted stock purchase agreements, vesting schedules, and filed 83(b) elections.
[ ] SAFEs and convertible notes: conversion mechanics on a change of control (many convert at a discount or pay a multiple of principal — model both).
[ ] Acceleration provisions: single-trigger and double-trigger, in plan documents and in individual employment agreements.
[ ] IRC § 280G "golden parachute" analysis for any C-corp payments to disqualified individuals; model the excise tax and the private-company stockholder-approval cleansing vote.

Why it matters, and the traps. Options priced below fair market value are a § 409A problem for the optionee, and the resulting employee fury lands on the buyer at closing. Options granted with no board consent may simply not exist. Promised equity that was never granted — the "we told Priya she'd get 0.5%" problem — surfaces in the escrow claim, not the data room. And an option pool that has issued more shares than the plan reserved is a real, common, and fully avoidable defect. Confirm the 409A valuations were prepared by a qualified independent appraiser within twelve months of each grant, which is what supports the presumption of reasonableness under the § 409A regulations. Founder-side hygiene is covered in Founder Equity, Vesting, and the 83(b) Election: A Practical Checklist and Incorporating a Startup the Right Way: A Founder's Legal Checklist; the sell-side view of everything in this phase is Getting Diligence-Ready Before You Raise: A Comprehensive Guide for Founders.

Phase 3 — Material contracts: change-of-control, anti-assignment, exclusivity, MFN

[ ] Full copies of the top 20 customer contracts by revenue and all contracts above a defined dollar threshold, including amendments, SOWs, and side letters.
[ ] Supplier and vendor agreements, especially sole-source and single-source dependencies.
[ ] Read every agreement for: anti-assignment clauses, change-of-control clauses (which can be triggered by a stock deal even when the anti-assignment clause is not), termination-for-convenience rights, exclusivity, most-favored-nation pricing, uncapped liability or uncapped indemnities, auto-renewal, and non-compete or non-solicit covenants binding the target.
[ ] Build a consents matrix: counterparty, clause, whether the deal structure triggers it, who asks, and by when.
[ ] Identify which consents are conditions to closing and which are merely "commercially reasonable efforts."
[ ] Government contracts: novation requirements, price-reduction and audit clauses, and the special assignment rules that apply.

Why it matters, and the traps. Deal structure and contract language interact in a way that costs buyers money every year. A stock purchase leaves the target entity intact, so a garden-variety anti-assignment clause is generally not triggered — but a change-of-control clause is. A reverse triangular merger has been treated by the Delaware Court of Chancery as not effecting an assignment by operation of law for purposes of a standard anti-assignment clause — the well-known analysis is Meso Scale Diagnostics, LLC v. Roche Diagnostics GmbH, 62 A.3d 62 (Del. Ch. 2013) — but that is a narrow reading of specific contract language under Delaware law, other states have not uniformly followed it, and you cannot bank on it: read the clause. An asset purchase transfers contracts by assignment and triggers everything.

Cordwell's team finds that Tidewater's second-largest customer, a 19% revenue account, has a clause permitting termination on 30 days' notice upon "any change in control of Vendor." That is not a legal problem. It is a valuation problem — and it becomes a closing condition. For clause-level review technique, see The Commercial Contracts Toolkit: Drafting, Reviewing, and Enforcing Business Agreements.

Phase 4 — Intellectual property: chain of title, invention assignments, and contractor gaps

[ ] Schedule of all registered IP: patents and applications, trademark registrations and applications, copyright registrations, domain names. Pull the USPTO assignment records yourself — do not trust the schedule.
[ ] Signed proprietary information and invention assignment agreements (PIIAs) for every current and former employee who touched the product. Every one. Match the list against payroll and against the git commit history.
[ ] Signed IP assignment provisions in every independent contractor, consultant, and agency agreement.
[ ] Confirm founder IP developed before incorporation was assigned into the company (the technology assignment agreement).
[ ] Search for liens: UCC-1 financing statements, and security interests recorded against patents at the USPTO or copyrights at the Copyright Office.
[ ] Inbound licenses: what the product depends on, and whether those licenses survive a change of control.
[ ] Outbound licenses: exclusivity grants, field-of-use restrictions, and any license that would restrict the buyer's own business post-closing.
[ ] Trade secret hygiene: confidentiality agreements, access controls, and whether the target can actually prove reasonable measures.

Why it matters, and the traps. This is where deals break. Two statutes do most of the work: 17 U.S.C. § 204(a) requires a transfer of copyright ownership to be in a writing signed by the transferor, and 35 U.S.C. § 261 requires patent assignments to be in writing. There is no oral assignment of copyright. There is no implied assignment by invoice. Absent the nine enumerated categories and a signed written work-made-for-hire instrument under 17 U.S.C. § 101, an independent contractor owns the copyright in the code they write — the Supreme Court settled the employee/contractor line for these purposes in Community for Creative Non-Violence v. Reid, 490 U.S. 730 (1989). A software developer is virtually never an "employee" for work-made-for-hire purposes unless they are a common-law employee, and commissioned software is not one of the nine categories.

Week three. Cordwell's IP counsel runs the git history against Tidewater's HR roster and finds that 31% of the Ledgerline forecasting engine was committed by "p.lindqvist" — Petra Lindqvist, a Swedish contractor engaged in 2021 through a two-page statement of work that says the work product is "for the exclusive use of Tidewater Metrics" and says nothing else. No assignment. No work-made-for-hire language. Under § 204(a), Tidewater does not own the copyright in the code that makes it worth $58 million. At best it has an implied nonexclusive license — which is not a transferable, exclusive right, and is not what Cordwell is buying.

The fix is unglamorous: Tidewater must obtain a signed, retroactive assignment from Lindqvist, for consideration, before closing. That becomes a condition precedent. Lindqvist, now aware of her leverage, is entitled to ask for money — which is exactly why sellers should paper this on day one. The doctrine and the drafting are in Employee Invention Assignment Agreements: Securing Clean Title Across Jurisdictions and Determining Work Made for Hire: A Practical Checklist; the transactional map is The IP Transactions Toolkit: A Roadmap for Licensing, Assignments, and Diligence. To test whether the target's secrets are actually protected, run Auditing Your Trade Secrets: A Practical Checklist.

Phase 5 — Open source and third-party code: copyleft exposure and remediation

[ ] Obtain (or commission) a software composition analysis scan of the full codebase, including build tooling, containers, and vendored dependencies.
[ ] Produce a bill of materials: component, version, license, and how it is linked or distributed.
[ ] Flag strong copyleft: GPL-2.0, GPL-3.0, and especially AGPL-3.0, whose § 13 network-use provision reaches SaaS products that never "distribute" anything.
[ ] Flag weak copyleft (LGPL, MPL-2.0, EPL) and confirm the file-level or library-level boundaries are actually respected.
[ ] Verify attribution and notice compliance for permissive licenses (MIT, BSD, Apache-2.0) — the easiest violations to find and the easiest to fix.
[ ] Check whether the target has an OSS policy, an approval workflow, and any history of a compliance inquiry or takedown demand.
[ ] For each material finding, price the remediation: replace the component, isolate it behind a process boundary, obtain a commercial license, or comply.

Why it matters, and the traps. Open source licenses are enforceable — courts have treated their conditions as both license conditions supporting a copyright claim (Jacobsen v. Katzer, 535 F.3d 1373 (Fed. Cir. 2008)) and as contractual obligations. AGPL in a SaaS codebase is the finding that most often forces an escrow or a price cut, because the remedy — releasing the corresponding source of the product you just bought — is not a remedy the buyer will accept. Treat "we don't distribute, so copyleft doesn't apply" as an assertion to be tested, not a conclusion. The full treatment is Open Source Software Licenses, Compliance, and Risk: A Comprehensive Guide and, for the operational scan-and-remediate loop, Open Source Software Compliance: A Practical Checklist.

Phase 6 — Employment and benefits: classification, wage-and-hour, restrictive covenants, WARN

[ ] Full employee census: name, role, location, hire date, exempt/non-exempt classification, compensation, visa status.
[ ] List of every independent contractor, with tenure, hours, and what they do. Run each against the applicable classification test.
[ ] Employment agreements, offer letters, severance agreements, and any change-of-control or retention arrangements.
[ ] Wage-and-hour exposure: exempt classifications under 29 U.S.C. § 213 and 29 C.F.R. Part 541; off-the-clock work; unpaid overtime; state-law meal-and-rest and pay-timing rules.
[ ] Restrictive covenants: non-competes, non-solicits, and whether they are enforceable in the states where the workforce sits.
[ ] Benefit plans: ERISA plan documents, Forms 5500, determination letters; multiemployer pension participation and withdrawal liability exposure (29 U.S.C. § 1381 et seq.); COBRA administration.
[ ] I-9 compliance and E-Verify history (8 U.S.C. § 1324a); in an asset deal, plan for re-verification of the transferred workforce.
[ ] WARN Act analysis (29 U.S.C. § 2101 et seq.): 60 days' notice for a plant closing or mass layoff at covered employers (generally 100+ employees). Then check the state mini-WARN — New York requires 90 days (N.Y. Lab. Law § 860 et seq.) and California's Cal-WARN (Cal. Lab. Code § 1400 et seq.) has a lower headcount trigger. These are state statutes; confirm each jurisdiction where the target has people.

Why it matters, and the traps. Misclassification is the quiet liability that compounds: a contractor who should have been an employee generates back payroll taxes, unpaid overtime, benefits claims, and — in the IP context — a copyright ownership problem, because a contractor owns their work absent a signed assignment. The two exposures are the same fact pattern viewed from two statutes. Non-competes are state law and the landscape moves: California voids nearly all of them (Cal. Bus. & Prof. Code § 16600), and other states impose income thresholds, notice requirements, or garden-leave rules — do not assume a target's covenants are worth anything until you check the employee's state. If the buyer plans post-closing headcount reductions, run the WARN math before signing, because notice is calendar-driven and cannot be bought back. See Classifying Workers: Employee or Independent Contractor — A Practical Checklist, Wage and Hour Law Under the FLSA: A Comprehensive Guide, The Future of Non-Competes: FTC Rulemaking and the State-Law Patchwork, and The Employment Law Toolkit: From Hiring to Separation.

Phase 7 — Litigation, disputes, and regulatory investigations

[ ] Schedule of all pending and threatened litigation, arbitration, and administrative proceedings, with counsel contact and current status.
[ ] Five-year look-back on closed matters and settlements — especially settlements with ongoing obligations or admissions.
[ ] Demand letters, cease-and-desist letters, and IP assertions (including from non-practicing entities).
[ ] EEOC charges, state fair-employment agency charges, DOL or state wage-agency audits, OSHA citations.
[ ] Government subpoenas, CIDs, and any open regulatory investigation.
[ ] Litigation-hold status: has the target preserved what it must preserve?
[ ] Request outside counsel's assessment letters — and negotiate a common-interest agreement before privileged material moves, so review does not waive privilege.

Why it matters, and the traps. Litigation reserves are almost always optimistic, and the disclosure schedule is almost always about pending matters. Ask separately about threatened matters and about the pattern behind the matters: three separate discrimination charges from the same manager is not three data points, it is one. If the target has an open government investigation, understand that inheriting it can mean inheriting cooperation obligations; the mechanics are in Responding to a Government Subpoena or Investigation: A Practical Checklist. Employment claims cluster around the same facts you found in Phase 6 — see Employment Discrimination Law: A Comprehensive Guide.

Phase 8 — Tax: returns, nexus, payroll, and unclaimed liabilities

[ ] Federal, state, and local income tax returns for the past five years, plus any amended returns.
[ ] Confirm the target's federal tax classification and the validity of any S election (a blown S election is a classic and expensive find).
[ ] Payroll tax filings and evidence of deposits; confirm no unpaid trust-fund taxes (IRC § 7501; personal liability under § 6672).
[ ] Sales and use tax nexus analysis, state by state, post-South Dakota v. Wayfair, Inc., 138 S. Ct. 2080 (2018) — economic nexus means an unregistered SaaS seller may owe tax in twenty states it has never visited.
[ ] State income tax nexus and apportionment; franchise tax filings and any delinquencies.
[ ] Unclaimed property/escheat compliance (state law; Delaware audits aggressively).
[ ] R&D credits claimed, NOL carryforwards, and § 382 limitation on their use after an ownership change.
[ ] Tax structuring: for a stock deal, evaluate an IRC § 338(h)(10) or § 336(e) election to obtain a stepped-up basis; for an asset deal, agree the § 1060 purchase price allocation in the agreement, not after.
[ ] Confirm open statutes of limitations (generally three years under IRC § 6501, six on a substantial omission).

Why it matters, and the traps. Federal income tax is federal law and uniform; sales-and-use tax is a fifty-state problem, and it is the most under-reserved liability in small-company M&A. A software target that has never charged sales tax in a state that taxes SaaS has been accruing exposure quietly for years. Quantify it, then decide: a voluntary disclosure agreement before closing, a specific escrow, or a price reduction. On entity-level tax posture generally, see Choosing a Tax Entity: A Practical Checklist and The Business Tax Toolkit.

Phase 9 — Privacy and data security: consents, transfers, breaches, and the data you are buying

[ ] Data map: what personal data the target collects, from whom, where it lives, who it is shared with, and how long it is kept.
[ ] Every version of the privacy policy in force during the collection period — not just the current one.
[ ] Confirm the policies permit transfer of personal data in a merger or asset sale. If they do not, you may not be able to use the data you are paying for.
[ ] Vendor/processor agreements with the required data-processing terms (GDPR Art. 28; CCPA service-provider terms).
[ ] Consumer rights request handling: volume, response times, and backlog under the CCPA/CPRA (Cal. Civ. Code § 1798.100 et seq.) and its state analogues.
[ ] Breach history — including incidents the target concluded were not notifiable, and why it concluded that.
[ ] Security posture: penetration test reports, SOC 2 report and exceptions, encryption, access controls, MFA.
[ ] If health data (HIPAA) or children's data (COPPA) is in scope, treat it as its own workstream.
[ ] Cross-border transfer mechanism for any EU/UK personal data.

Why it matters, and the traps. Privacy diligence is the newest category and the one most often skipped, and it has a structural feature buyers miss: the promises made at collection follow the data. The FTC's long-standing position, under FTC Act § 5 (15 U.S.C. § 45), is that a buyer who uses acquired personal data in ways the original privacy policy prohibited engages in a deceptive practice — the Toysmart matter is the origin of that doctrine, and it has been applied repeatedly since. So if the target promised "we will never share your data with third parties" in 2019, that promise constrains the acquirer. Read the historical policies. See The Privacy and Data Protection Toolkit: Building and Operating a Compliance Program, Standing Up a Privacy Compliance Program: A Practical Checklist, and, for the target's breach history, Responding to a Data Breach: A Notification and Incident Response Checklist.

Phase 10 — Insurance: policies, claims history, and the tail

[ ] Copies of all policies — not certificates: general liability, property, cyber, E&O/professional liability, D&O, EPLI, workers' compensation, key-person.
[ ] Five-year loss runs and claims history; open claims and reserves.
[ ] Confirm whether coverage is claims-made or occurrence-based. Claims-made policies terminate on a change of control and leave a gap.
[ ] Price and place a D&O run-off (tail) policy — six years is the market convention — for the target's departing directors and officers. It is almost always required by the merger agreement.
[ ] Check each policy for change-of-control and assignment provisions; historical occurrence-based policies can be valuable assets and are sometimes not assignable without consent.
[ ] Evaluate representation and warranty insurance as an alternative or supplement to a seller escrow.

Why it matters, and the traps. Insurance is state law — policy interpretation, the duty to defend, and bad-faith standards vary meaningfully by jurisdiction, and there is no national rule. The trap is structural rather than doctrinal: a claims-made E&O policy that lapses at closing leaves the buyer holding pre-closing acts with no coverage. Buy the tail, and buy it before closing. See Insurance Coverage Law: A Comprehensive Guide for Policyholders and The Business Insurance and Coverage Toolkit.

Phase 11 — Real estate and leases: consents and assignment restrictions

[ ] Schedule of all owned and leased real property; obtain the full lease file for each (lease, amendments, side letters, estoppels, SNDAs).
[ ] Read the assignment and change-of-control clauses. Many leases prohibit assignment and deem a transfer of a controlling interest in the tenant to be an assignment.
[ ] Identify landlord consent requirements, consent-fee provisions, and any landlord recapture right (a landlord who can terminate rather than consent has real leverage).
[ ] Confirm rent, escalations, CAM reconciliations, security deposits, and any outstanding defaults or landlord notices.
[ ] Obtain estoppel certificates from material landlords as a closing deliverable.
[ ] Personal guarantees by founders on leases — these must be addressed, or the sellers will demand release as a condition.

Why it matters, and the traps. A recapture right converts a routine consent into a negotiation, and a founder guarantee that nobody flagged becomes a signing-week emergency. Read the clause with Reviewing a Commercial Lease: A Practical Checklist and, for the underlying doctrine, Commercial Leases: A Comprehensive Guide to Negotiating and Drafting.

Phase 12 — Financial and environmental

Financial

[ ] Audited or reviewed financials for three years plus current-year monthlies; quality-of-earnings report from an independent accounting firm.
[ ] Revenue recognition policy; deferred revenue balance and how it will be treated post-closing.
[ ] Debt: credit agreements, notes, guarantees, capital leases; payoff letters and lien releases as closing deliverables.
[ ] UCC-1 lien searches in every jurisdiction of organization and location; judgment and tax lien searches.
[ ] Working capital: agree the definition and the peg — this is where post-closing disputes are born.
[ ] Customer concentration, churn, and the revenue quality behind the top ten accounts.
[ ] Related-party transactions and any off-balance-sheet arrangements.

Environmental

[ ] Phase I Environmental Site Assessment (ASTM E1527-21) for any owned or industrially used property.
[ ] Permits, notices of violation, and any history of releases.
[ ] Preserve the bona fide prospective purchaser defense under CERCLA (42 U.S.C. §§ 9601(40), 9607(r)) by completing "all appropriate inquiries" before acquiring the property — the defense is unavailable if you skip the Phase I.

Why it matters, and the traps. CERCLA liability is strict, joint and several, and retroactive, and the BFPP defense is one of the few reliable escapes — but it is a pre-acquisition diligence requirement. You cannot cure it later. On the financial side, the quality-of-earnings report is the buyer's most cost-effective diligence dollar: it converts the seller's EBITDA into the buyer's EBITDA, and the difference is the negotiation.

Phase 13 — Translate findings into deal terms: price, structure, reps, indemnity, escrow, and walk-away

[ ] For each finding, choose the instrument:
- Price — quantifiable, certain liabilities (unpaid sales tax; accrued overtime). Deduct them.
- Structure — pervasive or unquantifiable entity-level liability. Shift from a stock deal to an asset purchase to leave the liabilities behind.
- Representation — a defined, disclosable fact you want the seller to stand behind, backed by the indemnity.
- Special indemnity — a known risk. General reps cover unknowns; a known problem needs its own indemnity, uncapped or separately capped, with its own survival period.
- Escrow / holdback — a known risk with a delayed resolution (the Lindqvist assignment; the sales-tax VDA).
- Closing condition — anything that must be fixed before you pay (material consents; the retroactive IP assignment).
- Walk-away — fraud, an unfixable copyleft contamination of the core product, or a liability that exceeds the equity value.
[ ] Confirm the disclosure schedules actually disclose what diligence found — an undisclosed known issue is a rep breach on day one, which is a claim, not a plan.
[ ] Negotiate survival periods: fundamental reps (organization, authority, capitalization, title) survive longest; IP and tax typically get extended survival; general reps commonly 12–18 months.
[ ] Decide the sandbagging posture: does the buyer retain indemnity rights for breaches it knew about at signing? Say so expressly — Delaware generally enforces a pro-sandbagging clause; silence produces argument.
[ ] Run the findings tracker against this map before the first markup of the purchase agreement:

Finding	Typical instrument
Unremitted sales tax in eleven states, quantified	Price reduction + voluntary disclosure agreement as a covenant
Contractor with no signed IP assignment	Closing condition (retroactive assignment) + special indemnity
AGPL component in the distributed core product	Escrow for remediation, or walk-away if the core cannot be separated
Customer with a change-of-control termination right	Closing condition (consent), or price reduction if consent is refused
Minute book gaps and unpapered consents	Cleanup covenant + fundamental rep on capitalization
Pending discrimination charge, reserve set	Special indemnity with its own cap and survival
Claims-made E&O policy lapsing at closing	Seller-funded run-off (tail) as a closing deliverable
Pervasive, unquantifiable entity-level exposure	Restructure as an asset purchase

[ ] Model successor liability even in an asset deal. Asset purchasers are generally not liable for the seller's debts, but state-law exceptions apply: express or implied assumption, de facto merger, mere continuation, fraudulent transfer (Uniform Voidable Transactions Act), and — in some states — a product-line exception (Ray v. Alad Corp., 560 P.2d 3 (Cal. 1977)). Employment, environmental, and tax liabilities are especially prone to following the assets. This is state law and it varies; check the relevant jurisdictions.

Why it matters, and the traps. Cordwell closes at $56.4 million: $1.1 million off for the sales-tax exposure, $500,000 off for open-source remediation on two LGPL components, a signed Lindqvist assignment as a condition precedent, a $2 million special indemnity for IP title surviving 36 months, and a closing condition that the 19% customer consent be delivered. The finding that could have killed the deal instead reallocated $1.6 million and a clause. That is what diligence is for.

Note the buyer's other lever: a material adverse effect condition. Delaware sets a famously high bar for invoking one — Akorn, Inc. v. Fresenius Kabi AG, 198 A.3d 724 (Del. 2018) remains the rare case where a buyer successfully terminated — so an MAE is a backstop, not a diligence substitute. Find it before you sign.

Common mistakes to avoid

Treating diligence as document collection. A complete data room with no findings tracker is a filing cabinet, not a diligence process.
Trusting the cap table spreadsheet. Tie every security to a signed document and a board consent. Spreadsheets lie by omission.
Assuming the anti-assignment clause is the change-of-control clause. They are different clauses, triggered by different structures. Read both.
Skipping the git-history-to-payroll reconciliation. It is the single highest-yield hour in software diligence, and it is how you find the contractor nobody remembers.
Believing "we don't distribute" resolves copyleft. AGPL § 13 exists precisely to defeat that argument.
Ignoring historical privacy policies. The promise made at collection binds the buyer.
Forgetting the D&O tail. It costs a few tens of thousands of dollars and it is the first thing sellers' counsel asks for.
Doing the WARN analysis after signing. Notice periods are calendar-driven and cannot be accelerated with money.
Letting the business team read the clean-team file. Unfixable, and it survives the failed deal.
Papering a known issue with a general representation. Known risks need specific indemnities. A general rep on a known problem is a lawsuit with extra steps.
Waiving the Phase I to save $3,000. You are waiving the CERCLA bona fide prospective purchaser defense.
Assuming an asset deal leaves all liabilities behind. De facto merger, mere continuation, and fraudulent transfer say otherwise.

The consolidated diligence checklist

[ ] Set-up: NDA, clean team, data room, request list, Q&A log, findings tracker, HSR assessment, gun-jumping instructions.
[ ] Corporate: charter, bylaws, good standing, complete minute book, subsidiary chart, stockholder agreements, required vote, appraisal exposure.
[ ] Equity: cap table tied to source documents, plan reserve vs. grants, 409A valuations, 83(b) elections, SAFEs/notes conversion, acceleration, § 280G.
[ ] Contracts: top customers and suppliers, change-of-control and anti-assignment audit, consents matrix, exclusivity/MFN, uncapped liability.
[ ] IP: registered IP verified at the USPTO, signed PIIAs for every contributor, contractor assignments, founder tech assignment, lien searches, in/outbound licenses.
[ ] Open source: SCA scan, bill of materials, copyleft and AGPL exposure, attribution compliance, remediation cost.
[ ] Employment: census, classification, wage-and-hour, restrictive covenants by state, ERISA and withdrawal liability, I-9, WARN and state mini-WARN.
[ ] Litigation: pending, threatened, closed; regulatory investigations; litigation holds; common-interest agreement.
[ ] Tax: returns, S election validity, payroll/trust-fund taxes, sales-tax nexus, escheat, NOLs and § 382, structuring election, § 1060 allocation.
[ ] Privacy: data map, historical policies, transfer permissions, processor terms, breach history, security posture.
[ ] Insurance: all policies, loss runs, claims-made vs. occurrence, D&O tail, R&W insurance.
[ ] Real estate: lease files, assignment and change-of-control clauses, estoppels, SNDAs, founder guarantees.
[ ] Financial and environmental: quality of earnings, working capital peg, debt and liens, customer concentration, Phase I ESA, CERCLA BFPP.
[ ] Translation: every finding resolved into price, structure, rep, indemnity, escrow, closing condition, or accepted — and reflected in the disclosure schedules.

Primary Authority

Federal statutes

Hart-Scott-Rodino Antitrust Improvements Act, 15 U.S.C. § 18a; Clayton Act § 7, 15 U.S.C. § 18; Sherman Act § 1, 15 U.S.C. § 1
Worker Adjustment and Retraining Notification Act, 29 U.S.C. § 2101 et seq.
Fair Labor Standards Act, 29 U.S.C. § 201 et seq. (exemptions at § 213)
Employee Retirement Income Security Act, 29 U.S.C. § 1001 et seq.; multiemployer withdrawal liability, 29 U.S.C. § 1381 et seq.
Copyright Act, 17 U.S.C. §§ 101 (work made for hire), 204(a) (signed writing required for transfer)
Patent Act, 35 U.S.C. § 261 (written assignment)
Internal Revenue Code §§ 83(b), 280G, 338(h)(10), 336(e), 382, 409A, 1060, 6501, 6672, 7501
CERCLA, 42 U.S.C. § 9601 et seq.; bona fide prospective purchaser, 42 U.S.C. §§ 9601(40), 9607(r)
FTC Act § 5, 15 U.S.C. § 45
Immigration Reform and Control Act, 8 U.S.C. § 1324a (I-9)

Regulations

16 C.F.R. Parts 801–803 (HSR); 29 C.F.R. Part 541 (white-collar exemptions); 40 C.F.R. Part 312 (all appropriate inquiries); Treasury regulations under IRC § 409A

State law (corporate governance is state law; Delaware is the reference point)

Delaware General Corporation Law, 8 Del. C. §§ 141, 144, 203, 251 (mergers), 262 (appraisal), 271 (sale of substantially all assets)
California Business & Professions Code § 16600 (non-competes void); California Labor Code § 1400 et seq. (Cal-WARN); New York Labor Law § 860 et seq. (NY WARN)
California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq.
Uniform Voidable Transactions Act (as adopted state by state); common-law successor liability doctrines (express/implied assumption, de facto merger, mere continuation, fraudulent transfer)

Cases

Community for Creative Non-Violence v. Reid, 490 U.S. 730 (1989) (employee vs. independent contractor for work made for hire)
Jacobsen v. Katzer, 535 F.3d 1373 (Fed. Cir. 2008) (open source license conditions enforceable in copyright)
South Dakota v. Wayfair, Inc., 138 S. Ct. 2080 (2018) (economic nexus for sales tax)
Akorn, Inc. v. Fresenius Kabi AG, 198 A.3d 724 (Del. 2018) (material adverse effect; buyer termination)
Smith v. Van Gorkom, 488 A.2d 858 (Del. 1985) (informed board decision-making in a sale)
Revlon, Inc. v. MacAndrews & Forbes Holdings, Inc., 506 A.2d 173 (Del. 1986) (board duties in a change-of-control sale)
Meso Scale Diagnostics, LLC v. Roche Diagnostics GmbH, 62 A.3d 62 (Del. Ch. 2013) (reverse triangular merger and anti-assignment clauses; Delaware)
Ray v. Alad Corp., 560 P.2d 3 (Cal. 1977) (product-line successor liability exception; California)

Note on scope: the federal statutes above apply nationwide. Corporate law, successor liability, non-compete enforceability, insurance policy interpretation, escheat, and mini-WARN statutes are state law. Delaware is this checklist's corporate reference point because most venture-backed targets are Delaware corporations — it is not a national rule, and the target's actual state of incorporation and its employees' states of residence govern.

Secondary Sources

American Bar Association, Model Stock Purchase Agreement with Commentary (2d ed.) — the canonical due diligence request list and disclosure-schedule architecture
American Bar Association, Model Asset Purchase Agreement with Commentary
ASTM E1527-21, Standard Practice for Phase I Environmental Site Assessments
Nimmer on Copyright (transfers and the § 204(a) writing requirement)
Restatement (Third) of Agency (attribution of employee conduct to the entity)

Related UpLaw Resources

Related Guides & Articles

Related Checklists

Related Toolkits

This checklist is general legal information from UpLaw (uplaw.us), not legal advice, and does not create an attorney-client relationship. Laws vary by state and change over time; verify current requirements and consult qualified counsel before acting.