Due diligence is the phase in which a buyer examines your company thoroughly. For you as the seller, it is often the most demanding part of the process. If you know and organise the documents in advance, you keep control over pace, presentation and your negotiating position. This due diligence checklist shows you, from the seller’s perspective, what buyers review, what questions they ask and how you can defuse typical risks in advance.
What is due diligence in a business sale?
Due diligence is the structured review of a company by the buyer before the purchase agreement is signed. It usually takes place after the letter of intent and forms the basis for the final purchase price and the warranties in the contract. The buyer wants to know three things: are the figures correct, are there hidden risks, and will the business model still hold after the sale?
Where due diligence fits into the overall process is described in our article on the business sale process.
What types of due diligence are there?
Buyers divide the review into specialist areas, each handled by experts. Scope and depth depend on the industry, size and type of buyer.
| Review area | Focus | Typically reviewed by |
|---|---|---|
| Financial | Earning power, adjusted EBITDA, working capital, net financial debt | Auditors, transaction services |
| Tax | Tax risks, tax audits, transfer pricing | Tax advisors |
| Legal | Corporate law, contracts, litigation, IP | Lawyers |
| Commercial | Market, competition, customers, business plan | Strategy consultants, the buyer itself |
| HR | Employment contracts, key personnel, pensions | Employment lawyers, HR consultants |
| IT and cyber | Systems, licences, IT security, data protection | IT consultants |
| ESG and environmental | Contamination, permits, sustainability | Environmental experts |
| Operational | Production, supply chain, sites | Industry experts |
In addition to the comprehensive full-scope review, there is the red flag due diligence, which reports only material risks and delivers results considerably faster (source: Schlun & Elseven).
Which documents belong in the financial and tax due diligence?
Financial due diligence examines whether the earning power shown is sustainable. It is closely linked to the business valuation, because every adjustment to EBITDA has a direct effect on the price through the multiple.
| Document | Purpose | Typical buyer question |
|---|---|---|
| Annual financial statements for the last 3 to 5 years | Development of revenue and earnings | Why did the margin fall in the previous year? |
| EBITDA adjustments with supporting evidence | Sustainable earning power | Is the managing director’s salary in line with the market? |
| Working capital analysis (monthly) | Determining normal working capital | Are there seasonal fluctuations? |
| Loan and leasing agreements | Net financial debt | Which items are debt-like? |
| Plan for 3 to 5 years | Future viability | What assumptions lie behind the growth? |
| Tax assessments and audit reports | Historical tax risks | Which years are still open? |
| Transfer pricing documentation | Intra-group services | Are services to shareholders at arm’s length? |
Which documents does the legal and commercial due diligence review?
Legal due diligence examines whether the company exists and operates legally as you present it. Commercial due diligence examines whether the market and customers support the plan. When selling a German GmbH, the legal review always begins with the shareholder structure.
| Document | Purpose | Typical buyer question |
|---|---|---|
| Commercial register extract, articles of association, list of shareholders | Ownership | Do you own the shares free of encumbrances? |
| Material customer and supplier contracts | Continuity and change of control clauses | Can a major customer terminate on a change of ownership? |
| Lease and rental agreements | Security of sites | How long do the contracts run? |
| Intellectual property rights, licences, domains | Ownership of IP | Do the rights belong to the company or to the owner? |
| List of pending and threatened litigation | Litigation risks | What is the maximum exposure? |
| Customer list with revenue (anonymised for competitors) | Customer concentration | What share of revenue do the top 5 customers account for? |
Which documents belong to HR, IT, ESG and operations?
These areas are often underestimated, although buyers are reviewing them increasingly critically.
| Document | Purpose | Typical buyer question |
|---|---|---|
| Organisation chart, anonymised staff list | Structure and costs | Who are the key personnel? |
| Template employment contracts, works agreements | Employment law commitments | Is the company bound by collective agreements? |
| IT systems overview, software licences | Functionality | Are all licences transferable? |
| IT security concept, incident history | Cyber risk | Have there been data breaches? |
| Record of processing activities | Data protection compliance | Has the GDPR been implemented? |
| Environmental permits, contamination reports | Environmental risks | Is there soil contamination at the site? |
| Supplier structure, production capacities | Operational stability | Are there single-source risks? |
How do you set up the data room correctly?
A good data room follows the structure of the checklist and has an index with clear numbering. It logs who viewed which document and when, and later serves as evidence of what was disclosed.
Three rules are decisive:
- Structure: folders by review area, documents with an index number, no bundled PDFs without a table of contents.
- Q&A process: questions are handled exclusively through the Q&A module, with a single contact person on your side. Answers are written and consistent.
- Deadlines: set time windows for questions and answers. Open-ended processes without deadlines drag on.
Start filling the data room before you approach buyers. A half-empty data room signals disorder and invites price reductions.
Is a vendor due diligence worthwhile?
A vendor due diligence is a review that you as the seller commission yourself before the process. The report is made available to prospective buyers. It is worthwhile above all in auction processes and when selling to investors.
| Advantages | Disadvantages |
|---|---|
| You know the risks before the buyer finds them | Costs are incurred even if the sale fails |
| Shorter review by buyers | Buyers place only limited trust in third-party reports |
| Comparable bids on the same basis | Time required before the process starts |
| Better control over presentation | Often oversized for a single buyer |
A minimum solution for every seller is an internal preliminary review with your tax advisor and lawyer using this checklist.
How long does due diligence take?
The duration depends mainly on your preparation. A complete, well-organised data room and prompt answers in the Q&A are the most effective levers. A red flag review is faster than a full-scope review. The longer the review takes, the more time the buyer has to find reasons to renegotiate.
Which red flags should you resolve beforehand?
Red flags are findings that push the price down or jeopardise the deal. Most can be remedied, or at least explained, before the process starts.
| Red flag | Consequence in the process | Solution in advance |
|---|---|---|
| High dependence on the owner | Price reduction or earn-out | Build a second management level, plan the handover |
| Major customer with a high share of revenue | Risk discount | Conclude a long-term framework agreement |
| Change of control clauses | Risk of termination | Review contracts, prepare consent |
| Unresolved tax issues | Tax indemnity, retention | Clarify with your tax advisor, file corrections if necessary |
| IP held privately by the owner | Structural problem | Transfer the rights to the company |
| Private costs in the company | Unclear earning power | Document and adjust properly |
How such risks affect the price is explained in our article on purchase price negotiation. Dependencies are often resolved through an earn-out.
How are due diligence, warranties and W&I insurance connected?
What the buyer learns in due diligence affects your liability under the purchase agreement. Under § 442 BGB (German Civil Code), the buyer’s rights in respect of defects are generally excluded if the buyer knows of the defect when the contract is concluded. In company acquisitions, however, these questions are almost always governed by contract, through independent warranties and disclosure rules.
For you as the seller, this means: the more complete the data room, the better you can limit warranty claims by reference to the buyer’s knowledge. Negotiate for the entire content of the data room to be deemed disclosed.
Warranty and indemnity insurance shifts the warranty risk to an insurer. According to the CMS European M&A Study 2026, around 23% of the European deals examined in 2025 used W&I insurance. 58% of deals had liability caps below 50% of the purchase price. Insurers require proper due diligence. Without robust review reports, there is no cover.
This article does not replace legal or tax advice. Have the warranty catalogue and disclosure rules reviewed by a lawyer.
What applies if a competitor reviews your company?
If the buyer is a competitor, competition law limits the exchange of information. Prices, terms, margins and specific customer data are competitively sensitive.
The solution is a clean team. The European Commission’s 2023 guidelines on horizontal agreements expressly name clean teams as a safeguard when sensitive information is exchanged. In practice this means (source: Flick Gocke Schaumburg):
- Disclose only information relevant to the transaction.
- Give sensitive data only to external advisors or a clean team, not to the buyer’s sales or purchasing functions.
- Redact, aggregate or provide data as a sample.
- Conclude a clean team agreement in addition to the confidentiality agreement.
May personnel data be placed in the data room?
Personal data of employees may only be disclosed to a very limited extent in due diligence. The GDPR is decisive, in particular Art. 6. In 2024 the German Data Protection Conference (Datenschutzkonferenz) stated for asset deals that data of customers, suppliers and employees may generally not be transferred before the contract is concluded. Exceptions apply for voluntary consent or, in advanced negotiations, for data of key personnel on the basis of legitimate interests.
For the data room, this means: anonymise staff lists, aggregate salaries and show names only where they are indispensable for the valuation.
How do you take the next step?
Start with an honest review of where you stand using this due diligence checklist. Mark which documents are missing and which red flags you can resolve before the sale. You can find more on the overall process under selling a business and in our process. If you would like to review your documents together with an experienced partner, please contact us for a confidential initial meeting.
Sources
- CMS European M&A Study 2026, CMS, 2026
- Bürgerliches Gesetzbuch, § 442 Kenntnis des Käufers, Bundesministerium der Justiz, gesetze-im-internet.de
- Leitlinien zur Anwendbarkeit des Artikels 101 AEUV auf Vereinbarungen über horizontale Zusammenarbeit (2023/C 259/01), Europäische Kommission, EUR-Lex, 2023
- Kartellrecht in der Due Diligence, Flick Gocke Schaumburg, 2022
- Übermittlungen personenbezogener Daten an die Erwerberin oder den Erwerber eines Unternehmens im Rahmen eines Asset-Deals, Datenschutzkonferenz (DSK), 2024
- Verordnung (EU) 2016/679 (Datenschutz-Grundverordnung), EUR-Lex
- Due-Diligence-Prüfung beim Unternehmenserwerb, Schlun & Elseven Rechtsanwälte, 2026
Frequently asked questions
What is a due diligence checklist?
A due diligence checklist is a structured list of all the documents and information a buyer reviews before acquiring a company. It is usually organised by review area, such as finance, tax, legal, market and personnel. For sellers, it serves as a preparation plan for the data room.
How long does due diligence take?
The duration depends on the size, complexity and preparation of the company. A focused red flag review is considerably faster than a comprehensive full-scope review. Sellers themselves have the greatest leverage: a complete data room at the start shortens the review noticeably.
Which review areas are most important?
In most transactions, financial, tax, legal and commercial due diligence determine the price and contract terms. HR, IT, ESG and operations are added depending on the industry. A software company, for example, is reviewed more intensively for IT and cyber security.
Is a vendor due diligence worthwhile?
A vendor due diligence is worthwhile above all in auction processes with several interested parties and for more complex companies. It costs time and money before the sale, but gives you control over how risks are presented. With a single buyer who is already known, internal preparation is often sufficient.
Does disclosure in the data room protect against liability?
Disclosures can exclude the buyer's claims if the purchase agreement provides for this. Under § 442 of the German Civil Code (BGB), the buyer's rights in respect of defects are generally excluded if the buyer knows of the defect when the contract is concluded. In company acquisitions, however, the effect of the buyer's knowledge is usually governed expressly in the contract.
May I show a competitor who is a buyer all the data?
No. Competitively sensitive information such as prices, terms and customer data may only be shared to the extent necessary and often only with a clean team or external advisors. The EU Horizontal Guidelines of 2023 expressly name clean teams as a safeguard.
May employee data be placed in the data room?
Before the contract is concluded, personal employee data should generally only be provided in anonymised or aggregated form. The German Data Protection Conference (Datenschutzkonferenz) considers transfer before an asset deal permissible only in narrow exceptions, for example for key personnel in advanced negotiations. Have the handling of personnel data reviewed under data protection law.
What is W&I insurance?
Warranty and indemnity insurance covers claims arising from breaches of warranties in the purchase agreement. The buyer can then turn to the insurer instead of the seller. According to the CMS European M&A Study 2026, around 23% of the deals examined in 2025 included such cover.