Due Diligence Questionnaires (DDQs): 170 Questions to Ask in 2026

A due diligence questionnaire (DDQ) is the structured list of questions a buyer, investor, or acquirer sends to a target company to gather the information needed to evaluate a deal. It turns diligence from a scattered email chase into a systematic, category-by-category review that produces complete, comparable answers.

Quick recap

• A due diligence questionnaire (DDQ) is a formal set of written questions sent to a target company during M&A, fundraising, or private equity diligence.
• A DDQ differs from a checklist: a checklist lists documents to collect, while a questionnaire asks specific questions that require written answers plus supporting evidence.
• Most DDQs are organized into five workstreams: financial, legal and compliance, commercial, operational, and technology.
• A full DDQ can run past 170 questions, but you should customize the set to the deal type and industry rather than sending every question.
• Questions are sent in phases, financial and legal first, so sellers are not overwhelmed with everything at once.
• Responses and supporting files are best collected in a virtual data room organized by diligence category with granular permissions and an audit trail.
• Typical response time is 2 to 4 weeks for a comprehensive questionnaire, shorter for smaller deals.

What a due diligence questionnaire actually is

A due diligence questionnaire is the backbone of any structured diligence process. Where a data room holds documents and a checklist tells you which documents to gather, the questionnaire is where you ask the pointed questions that documents alone do not answer. It is how an acquirer or investor moves from "show me your files" to "explain to me how this business works, where the risks are, and whether the numbers hold up." Every serious M&A, fundraising, or private equity process runs on one.

The reason the DDQ matters so much is that it forces both sides to be systematic. Instead of a buyer firing off ad hoc emails and a seller answering whatever comes to mind, the questionnaire lays out every topic in a defined order. Sellers know exactly what is being asked, buyers know nothing has been skipped, and the answers arrive in a format that can be compared, filed, and revisited. A well-built DDQ shortens the diligence timeline, reduces the number of follow-up rounds, and leaves a clean paper trail if a dispute ever arises after close.

DDQs also travel across deal types. A venture investor writing a Series A check, a private equity firm buying a majority stake, and a strategic acquirer folding in a competitor all use the same underlying structure, tuned to their concerns. The financial and legal questions stay largely constant; the commercial, operational, and technology sections flex to match the industry and the size of the transaction. For a broader picture of the whole workflow, see our guide to the M&A due diligence process.

How a DDQ differs from a checklist and a template

People use "questionnaire", "checklist", and "template" interchangeably, but in a diligence context they do three different jobs, and knowing the difference keeps your process clean. A checklist is a list of documents to collect, financial statements, contracts, cap table, and so on. A questionnaire is a list of questions that require written answers, usually backed by those same documents. A template is the reusable shell, the empty structure you copy for each new deal and then fill in.

In practice you use all three together. The checklist tells the seller which files to upload, the questionnaire asks them to explain and contextualize those files, and the template is what lets you spin up the whole apparatus in an afternoon rather than rebuilding it from scratch. A raw balance sheet tells you the company has debt; the questionnaire is where you ask about the covenants, the maturity, and whether they are in compliance. That layer of narrative is exactly what documents cannot supply on their own.

If you are looking for the document side of the process rather than the questions, our due diligence checklist and examples and our reusable due diligence template cover those. This article stays focused on the questions themselves: what to ask, how to group it, and how to run the response process without drowning the seller.

How to structure a due diligence questionnaire

A strong DDQ is organized into workstreams that map to the specialists who will read the answers. The finance team reads the financial section, counsel reads legal and compliance, the deal team reads commercial, and technical reviewers read operations and technology. Structuring the questionnaire this way means each section can be sent to the right responder on the seller side and routed to the right reviewer on the buyer side without anyone wading through irrelevant material.

The five sections below form the standard skeleton. Financial diligence tests whether the numbers are real and durable. Legal and compliance surfaces contracts, intellectual property, and regulatory exposure. Commercial diligence probes the market, customers, and competitive position. Operational diligence examines the team, processes, and infrastructure. Technology diligence, most relevant for SaaS and software targets, digs into architecture, security, and engineering practice. Within each workstream, questions run from broad context toward specific, evidence-backed detail.

You do not have to send all of these to every seller. The sections that follow give you the full bank of questions; the "How to run the DDQ process" section later explains how to select from them, stage them, and collect the answers.

Financial due diligence questionnaire

Financial diligence is where most deals are won or lost, so this section is usually the longest and the first to go out. The goal is not just to see the numbers but to understand their quality: how revenue is earned, how durable it is, what it costs to produce, and how much of it converts to cash. Start with the company's structure and ownership so you know exactly what you are buying, then work through revenue, profitability, cash flow, debt, and projections.

Pay particular attention to concentration and recurrence. A business where one customer drives forty percent of revenue carries a different risk profile than one with a long tail of accounts, and recurring revenue is worth more than one-time sales. The projection questions matter just as much as the historicals, because you are pricing the future, not the past. Ask for the assumptions behind the forecast, not only the forecast itself.

Company overview and structure

1. Provide a brief business description and history.
2. What is your current legal entity structure?
3. List all subsidiaries, affiliates, and related entities.
4. Who are the current shareholders and what are their ownership percentages?
5. Have there been any recent changes in ownership or capital structure?

Revenue and customers

6. What are your revenue streams by product or service?
7. What is your revenue breakdown by customer segment and geography?
8. Who are your top 10 customers by revenue over the last 12 months?
9. What percentage of revenue comes from your largest customer?
10. What is your cohort-based customer retention rate?
11. What is your annual customer churn rate?
12. Describe your pricing model and any recent price changes.
13. What percentage of revenue is recurring versus one-time?
14. What is your average contract length?
15. Do you have deferred revenue? Provide a schedule.

Expenses and profitability

16. Provide a COGS breakdown by major category.
17. What are your operating expenses by department?
18. What is your monthly burn rate, if you are pre-profit?
19. What is your gross margin by product or service line?
20. What is your EBITDA for the last 3 years?
21. Are there any one-time or non-recurring expenses to adjust for?
22. What are your customer acquisition costs (CAC)?
23. What is your customer lifetime value (LTV)?

Cash flow and working capital

24. Provide monthly cash flow statements for the last 12 months.
25. What is your current cash balance?
26. What are your working capital requirements?
27. Provide an aging accounts receivable report.
28. Provide an aging accounts payable report.
29. What is your average collection period?
30. What is your inventory turnover, if applicable?

Debt and liabilities

31. List all outstanding debt (loans, credit lines, leases).
32. What are the terms and covenants of your debt agreements?
33. Are you in compliance with all debt covenants?
34. Do you have any contingent liabilities?
35. List any off-balance-sheet items or commitments.
36. Describe any related-party transactions.
37. What are your outstanding tax liabilities or disputes?

Projections and forecasts

38. Provide 3-year financial projections (revenue, expenses, cash flow).
39. What are the key assumptions behind your revenue growth?
40. What are the main risks to achieving projections?
41. Have you conducted scenario or sensitivity analysis?
42. What capital expenditures do you anticipate over the next 3 years?

Accounting and tax

43. Who is your external auditor? Provide audit reports for the last 3 years.
44. What accounting standards do you follow (GAAP, IFRS)?
45. Have there been any recent changes to accounting policies?
46. Provide tax returns for the last 3 years.
47. Do you have any tax loss carryforwards (NOLs)?
48. Are there any ongoing tax audits or disputes?
49. Describe your transfer pricing policies, if applicable.

Legal and compliance due diligence questionnaire

Legal diligence answers a simple but critical question: does the company actually own what it says it owns, and is anything about to blow up? Counsel reads this section looking for change-of-control provisions that could void key contracts on close, intellectual property that was never properly assigned, litigation that could follow the business, and regulatory gaps that could carry fines or force remediation. Because these findings can kill a deal or reshape the price, legal questions usually go out alongside financial ones in the first phase.

Contracts and intellectual property deserve the closest reading. A customer contract with a change-of-control clause can let a key account walk the moment the deal signs, and IP that founders or contractors never formally assigned to the company is not really the company's IP at all. Employment questions matter too, because non-compete gaps, misclassified contractors, and unresolved disputes all transfer to the buyer.

Corporate governance

50. Provide the certificate of incorporation and bylaws.
51. Provide board meeting minutes for the last 2 years.
52. Provide shareholder meeting minutes for the last 2 years.
53. List all current board members and their affiliations.
54. Describe any shareholder agreements or voting arrangements.
55. Have there been any stockholder disputes or litigation?

Contracts and agreements

56. Provide copies of your top 10 customer contracts.
57. Provide standard customer contract templates.
58. Do any customer contracts contain change-of-control provisions?
59. List all supplier and vendor agreements over $50K annually.
60. Do you have any exclusive agreements (supply, distribution, reseller)?
61. Provide any partnership or joint venture agreements.
62. List contracts that expire within the next 12 months.

Intellectual property

63. List all patents, issued and pending.
64. List all trademark and service mark registrations.
65. List all copyright registrations.
66. List all domain names owned.
67. Provide IP assignment agreements from founders and employees.
68. Do you use any third-party IP under license?
69. What open-source software is used in your product?
70. Have you received any IP infringement claims?

Employment and HR

71. Provide employment agreements for all executives.
72. Provide employment agreements for key employees.
73. Do employees have non-compete and non-solicitation agreements?
74. Provide your employee handbook.
75. Describe your equity compensation plan and grants.
76. List all employees with titles, salaries, and start dates.
77. What is your employee turnover rate?
78. Do you have any union contracts or collective bargaining agreements?
79. Describe your benefits plans (health, retirement, and so on).
80. Are there any pending or threatened employment disputes?

Regulatory and compliance

81. List all licenses and permits required to operate.
82. Are you in compliance with all applicable regulations?
83. Have you had any regulatory violations in the last 3 years?
84. Describe your data privacy and security policies.
85. Are you GDPR compliant? Provide documentation.
86. Are you SOC 2 compliant? Provide the report.
87. Do you have HIPAA compliance requirements? Provide documentation.
88. Describe your export control compliance, if applicable.
89. Describe your anti-corruption and FCPA compliance.

Litigation and insurance

90. List all pending lawsuits, claims, or disputes.
91. List all settled litigation in the last 3 years.
92. Have you received any demand letters or legal threats?
93. What insurance policies do you maintain? Provide certificates.
94. Have you filed any insurance claims in the last 3 years?
95. Provide D&O insurance policy details.

Commercial due diligence questionnaire

Commercial diligence tests the story the seller tells about its market and its growth. Financials show what happened; commercial questions probe whether it can keep happening. Here you are sizing the market, gauging competitive position, and pressure-testing the go-to-market engine. The deal team reads these answers to decide whether the growth in the projections is credible or wishful. Our dedicated guide to commercial due diligence goes deeper on the analysis.

Look for evidence, not adjectives. "We have a strong moat" means little without a concrete explanation of what protects the business, whether that is switching costs, network effects, proprietary data, or brand. Similarly, ask for acquisition channels and sales-cycle metrics rather than accepting a headline growth rate, because the durability of growth depends on how repeatable and how expensive it is to buy each new customer.

Market and competition

96. What is your total addressable market (TAM)?
97. What is your current market share?
98. What is the market growth rate?
99. Who are your top 5 competitors?
100. How do you differentiate from competitors?
101. What are your competitive advantages or moats?
102. What regulatory trends affect your market?

Customers and sales

103. How would you segment your customer base?
104. What are your primary customer acquisition channels?
105. What is your average sales cycle length?
106. What is your sales conversion rate by channel?
107. What is your customer satisfaction score (NPS, CSAT)?
108. Provide customer testimonials or case studies.
109. What is your sales team structure and headcount?
110. What is your average deal size?
111. Describe your sales compensation structure.

Product and strategy

112. Describe your product roadmap for the next 12 to 24 months.
113. How do you prioritize product features?
114. Describe your pricing strategy and positioning.
115. What evidence do you have of product-market fit?
116. What are your brand awareness metrics?
117. How much do you invest in R&D as a percentage of revenue?
118. What are your growth initiatives for the next 3 years?
119. Do you have plans for new market expansion?
120. Do you have M&A or partnership plans?

Operational due diligence questionnaire

Operational diligence looks at whether the business can run without its founders in the room and whether the machinery behind the revenue is documented and repeatable. Buyers use this section to find key-person risk, undocumented processes, and single points of failure in the supply chain or infrastructure. A company that depends entirely on a handful of irreplaceable people is worth less, and harder to integrate, than one with mature systems and clear succession. For a fuller treatment, see our guide to operational due diligence.

The organizational and process questions matter most for integration planning. Knowing who the critical employees are, whether there is a succession plan, and how core processes are documented tells the buyer how much institutional knowledge would survive a transition. Supply chain questions surface concentration risk on the vendor side, mirroring the customer-concentration risk on the revenue side.

Organization and team

121. Provide an organizational chart.
122. Who are the key employees critical to the business?
123. What is your succession plan for leadership?
124. Describe your hiring and onboarding process.
125. What training and development programs do you offer?
126. How do you measure employee engagement?
127. What is your remote or hybrid work policy?

Operations and processes

128. Describe your core operational processes.
129. Do you have documented standard operating procedures (SOPs)?
130. What quality control processes do you have?
131. Describe your supply chain and key suppliers.
132. Do you have backup suppliers for critical components?
133. Where are your facilities located? Provide lease agreements.
134. What is your manufacturing or production capacity?
135. How do you handle inventory management?

Technology and systems

136. What is your technology stack?
137. What SaaS tools and software do you use?
138. Describe your IT infrastructure (cloud, on-premise).
139. What cybersecurity measures do you have in place?
140. Describe your disaster recovery and business continuity plans.
141. How do you back up data?
142. Do you outsource any IT functions?

Technology due diligence questionnaire (SaaS)

For software and SaaS targets, technology diligence carries as much weight as the financials, because the product is the asset. This section digs into architecture, security posture, engineering practice, and hosting to determine whether the codebase is a durable asset or a liability full of technical debt. Technical reviewers read it looking for scalability limits, security gaps, over-reliance on a single engineer, and compliance certifications that either exist or conspicuously do not.

Security and compliance questions deserve particular scrutiny here. A SOC 2 Type II report, recent penetration test results, and a clean incident history signal a company that takes its obligations seriously, which matters enormously when the buyer will inherit the customer data and the breach exposure. The development and infrastructure questions round out the picture of whether the team can keep shipping after the deal closes.

Product and architecture

143. Describe your system architecture.
144. What is your technology stack (frontend, backend, database)?
145. Do you have API documentation?
146. What has your system uptime been over the last 12 months?
147. What third-party services or APIs do you depend on?
148. What open-source licenses are you using?
149. Have you conducted a technical debt assessment?

Security and compliance

150. Are you SOC 2 Type II certified? Provide the report.
151. When was your last penetration test? Provide results.
152. When was your last vulnerability scan? Provide results.
153. Have you had any security incidents? Describe them.
154. How do you encrypt data at rest and in transit?
155. Describe your authentication and authorization mechanisms.
156. Are you GDPR compliant? How do you handle data subject requests?

Development and DevOps

157. Describe your development team structure.
158. What is your development process (Agile, Scrum, and so on)?
159. How frequently do you deploy code?
160. What is your CI/CD pipeline setup?
161. Describe your testing and QA processes.
162. How do you handle rollbacks?
163. What monitoring and alerting tools do you use?

Infrastructure and hosting

164. Where do you host your infrastructure (AWS, GCP, Azure)?
165. What are your monthly infrastructure costs?
166. How do you scale your infrastructure?
167. What is your database architecture?
168. Do you use a CDN? Which one?
169. What are your API rate limits?
170. Have you optimized your infrastructure costs?

Case study: running a DDQ for a SaaS acquisition

Fathomline Analytics, a hypothetical mid-market data-visualization company, receives an acquisition offer from a larger strategic buyer. The buyer's deal team opens diligence by sending a tailored DDQ drawn from the bank above, roughly 120 questions once they strip out the manufacturing and inventory items that do not apply to a pure-software business. They stage it deliberately: financial and legal questions in week one, commercial and operational in week three, and the full technology section in week four.

Fathomline's CFO is named the response coordinator. She routes the financial questions to her finance lead, the legal section to outside counsel, the commercial questions to the head of sales, and the technology block to the CTO. Rather than emailing answers back, the team uploads written responses and every supporting file into a virtual data room, organized into folders that mirror the five workstreams. Each answer sits next to its evidence, so when the buyer asks about the forty-one percent revenue concentration in question nine, the top-customer contract is one click away.

Two findings emerge that reshape the deal. The buyer's counsel discovers that a change-of-control clause in Fathomline's largest customer contract, surfaced by question fifty-eight, could let that account terminate on close. Separately, the CTO's answer to question sixty-seven reveals that two early contractors never signed IP assignment agreements. Neither kills the deal, but both feed into the purchase agreement: the buyer negotiates a holdback tied to renewing the at-risk contract and requires the missing assignments as a closing condition. The structured questionnaire turned two buried risks into priced, managed terms rather than post-close surprises.

How to run the DDQ process

Having the questions is only half the job. Running the process well is what keeps diligence on schedule and keeps the seller cooperative rather than exhausted. The four practices below turn the question bank into a workable workflow, and they apply whether you are a private equity firm, a strategic acquirer, or a venture investor.

Customize for your deal. Not every question applies to every transaction, and sending irrelevant questions signals a copy-paste process that erodes seller trust. Trim the bank to the deal type before it goes out. A SaaS acquisition leans heavily on the technology section and can drop most operational and inventory questions. A real estate deal skips technology entirely and concentrates on legal and financial. A manufacturing buyout adds depth on supply chain, facilities, and production capacity. Start from the full 170 and cut, rather than building up from nothing.

Send in phases. Dropping all 170 questions on a seller at once is the fastest way to slow a deal down. Sequence the questionnaire so the deal-critical topics come first and the rest follow once early answers check out. A typical cadence looks like this:

• Phase 1 (weeks 1 to 2): Financial and legal, the questions most likely to reveal a deal-breaker.
• Phase 2 (weeks 3 to 4): Commercial and operational, once the fundamentals hold up.
• Phase 3 (weeks 4 to 5): Technology, where applicable, often the deepest dive.

Organize responses in a data room. Answers and their supporting documents belong in one structured place, not scattered across email threads. Set up a virtual data room with a folder per workstream, and inside each, a place for the written questionnaire responses and the underlying files:

/Financial Due Diligence
  /Questionnaire Responses
  /Supporting Documents
/Legal Due Diligence
  /Questionnaire Responses
  /Supporting Documents

Follow up on vague answers. Initial responses almost always raise new questions. A one-line answer to a concentration or covenant question is an invitation to dig deeper, not a closed topic. Build a second round into your timeline from the start, and treat "we do not track that" as a finding worth understanding rather than a dead end.

How Papermark helps you run due diligence questionnaires

Once the questionnaire is written and staged, the hard part is collecting the answers securely and keeping track of who has seen what. This is exactly what a purpose-built virtual data room does, and it is where Papermark fits into the DDQ workflow. Instead of emailing sensitive questionnaire responses back and forth, both sides work inside a single secure virtual data room organized around the five diligence workstreams, so every answer lives next to its supporting evidence.

Granular permissions are what make a multi-section DDQ manageable. Because a questionnaire is naturally split across finance, legal, commercial, and technical responders, Papermark lets you share the financial folder with the buyer's finance team, the legal folder with counsel, and the technology folder with technical reviewers, all from the same data room without exposing everything to everyone. NDA gating requires each viewer to accept a confidentiality agreement before they reach a single response, and dynamic watermarking stamps every page with the viewer's email and a timestamp so confidential answers cannot circulate anonymously.

The analytics are what turn a static document exchange into a live view of the process. Page-by-page analytics and a full audit trail show exactly when the buyer opened the financial responses, which supporting files they lingered on, and what they downloaded, so a seller can see interest building and a buyer can prove what was disclosed. Full-text search lets reviewers find any answer instantly across hundreds of files, and the platform's SOC 2 Type II posture and custom domains keep the whole exchange on-brand and compliant. Papermark's Data Rooms plan starts at €99 per month, a fraction of what legacy VDR providers charge for the same diligence workflow.

Page-by-page analytics show exactly when and how a buyer reviews each questionnaire response and supporting document.

Key takeaways

Due diligence questionnaires structure the entire diligence process, ensuring that information gathering is comprehensive and comparable rather than ad hoc. The five workstreams, financial, legal, commercial, operational, and technology, cover the full picture, and the full bank runs past 170 questions.

The discipline is in the execution. Customize the questions to the deal so you are not sending manufacturing questions to a software company, send them in phases so the seller can keep up, organize every answer and supporting file in a data room by category, and always follow up on vague responses. A questionnaire that is well-built but badly run still stalls a deal; one that is well-run turns buried risks into priced, managed terms.

FAQ