Private Equity Due Diligence in 2026: Process and Checklist

Due diligence makes or breaks private equity deals. Miss a critical issue and you'll overpay or inherit problems that destroy returns. Do it right and you'll uncover value drivers others missed.

After helping dozens of PE firms run diligence processes through Papermark's data rooms, I've seen what separates thorough diligence from checkbox exercises. This guide covers how PE firms should approach due diligence to maximize returns and minimize risk.

Quick Recap: PE Due Diligence Process

Here's the private equity due diligence workflow in numbered steps:

1. Sign NDA and get data room access - secure confidential information
2. Initial screening - quick review of CIM and management presentation
3. Form diligence team - assign workstreams (financial, legal, commercial, IT)
4. Create diligence checklist - comprehensive list of required documents
5. Financial analysis - quality of earnings, working capital, customer concentration
6. Commercial review - market position, competitive dynamics, growth drivers
7. Operational assessment - processes, systems, key person dependencies
8. Legal review - contracts, IP, litigation, regulatory compliance
9. IT and cybersecurity - technology stack, security posture, technical debt
10. Identify red flags and risks - document deal-breakers and price adjusters
11. Value creation plan - specific initiatives to drive returns
12. Final investment memo - recommendation to IC with risk assessment

Why PE Due Diligence Is Different

Private equity due diligence goes deeper than strategic M&A for good reason: you're betting your fund's returns on getting it right.

Key Differences

Time pressure - You typically have 4-8 weeks between LOI and SPA, not months. You need to be thorough without slowing the process.

Operational focus - Strategic buyers care about fit with existing business. PE firms focus on operational improvements that'll drive returns. Can you reduce costs? Improve pricing? Accelerate growth?

Exit strategy - From day one, you're thinking about exit. What will this company look like in 3-5 years? Who will buy it? What multiple will they pay?

Management assessment - Can the current team scale the business? If not, who needs to be replaced?

Value creation thesis - You need a specific plan for how you'll improve EBITDA and grow the business. Vague "operational improvements" don't fly.

The stakes are higher. One bad deal can sink your entire fund's returns.

Setting Up Your Diligence Team

PE due diligence is a team sport. You need specialists in multiple domains working in parallel.

Core Team Structure

Deal lead - Senior partner or principal who owns the investment thesis and final decision. Coordinates all workstreams.

Financial diligence - Usually external accounting firm (Big Four or similar). Reviews quality of earnings, working capital, and financial projections.

Commercial diligence - External consultants or internal team. Validates market size, competitive position, and growth assumptions.

Legal diligence - External law firm. Reviews contracts, litigation, IP, and regulatory compliance.

Operational diligence - Often internal or operational consultants. Assesses processes, systems, and improvement opportunities.

IT/Tech diligence - For tech-enabled businesses. Reviews technology stack, security, and technical debt.

HR diligence - Especially for service businesses. Reviews compensation, retention, culture, and key person risks.

External Advisors vs. Internal Team

Most PE firms use a hybrid approach:

Always external:

• Legal review (conflicts of interest if you use internal)
• Quality of earnings (accounting firms have specialized expertise)
• Industry-specific technical reviews (e.g., environmental for manufacturing)

Often internal:

• Commercial diligence (if you have sector expertise)
• Operational review (if you have operational partners)
• IT review (for smaller deals)

Budget considerations: A typical mid-market PE deal (€50-200M) might spend €300-800K on diligence:

• Legal: €150-300K
• Financial: €100-200K
• Commercial: €50-150K
• IT/Tech: €30-80K
• Other specialists: €50-100K

Don't skimp on diligence. €500K spent uncovering a €10M problem is a bargain.

Financial Due Diligence

This is the foundation of your valuation. You need to understand the true earnings power of the business.

Quality of Earnings (QoE)

A QoE report takes reported EBITDA and adjusts for:

Revenue quality issues:

• Non-recurring revenue included in run rate
• Channel stuffing or revenue pulled forward
• Customer credits or returns not properly accounted for
• Revenue recognition policy issues

Cost normalization:

• Owner/related party expenses
• One-time costs (restructuring, professional fees)
• Above/below market compensation for key people
• Below-market rent (if owner owns the property)

Common adjustments:

• Add back: owner's personal expenses, one-time legal fees, excess compensation
• Subtract: deferred maintenance, below-market rent, understated reserves

A €10M EBITDA business might normalize to €8.5M after adjustments. This changes valuation significantly at a 6-8x multiple.

Working Capital Analysis

Understand the cash conversion cycle and working capital needs:

Key metrics:

• Days sales outstanding (DSO) - how long to collect receivables
• Days inventory outstanding (DIO) - how long inventory sits
• Days payable outstanding (DPO) - how long before you pay suppliers

Red flags:

• Increasing DSO (customers paying slower)
• Rising inventory relative to sales
• Aged receivables (>90 days past due)
• Seasonal working capital swings not accounted for

You'll typically negotiate a working capital peg at closing. If the business needs €5M to operate but only has €3M at closing, the seller owes you €2M.

Customer and Revenue Concentration

Customer concentration risk:

• Top 3 customers >30% of revenue is a major risk
• Top customer >20% is a yellow flag
• Any customer you can't afford to lose

Revenue diversification:

• Product mix (is 80% from one product line?)
• Geographic concentration
• Channel concentration (all revenue through one distributor)

If there's heavy concentration, you need:

• Contracts with key customers
• Redundancy plans
• Pricing power with remaining customers
• Diversification strategy post-close

Financial Projections Review

Management always presents optimistic projections. Your job is to pressure-test them.

Growth assumptions - Is 30% growth realistic given:

• Historical growth rates (usually 50-70% of management's projection)
• Market growth (faster than market growth needs explanation)
• Competition and market share gains required
• Sales capacity and pipeline

Margin expansion - Can gross margins really improve from 40% to 50%?

• What specific initiatives drive this?
• Have they been tried before?
• What investment is required?

Build a base, upside, and downside case:

• Base: Conservative assumptions you have high confidence in
• Upside: Management's plan if executed well
• Downside: What happens if key assumptions fail

You'll model returns under all three scenarios. If you can't hit your return hurdles in the base case, it's not a good deal.

Commercial Due Diligence

Financial statements tell you what happened. Commercial diligence tells you what will happen.

Market Analysis

Market size and growth - Don't just accept management's numbers. Triangulate:

• Third-party market research (Gartner, Forrester, IDC)
• Competitor revenue (if public or known)
• Bottom-up calculation (# of potential customers × spend per customer)

Market dynamics:

• Is the market growing or shrinking?
• What's driving growth (regulation, technology shifts, demographic trends)?
• Are there headwinds (consolidation, new competition, substitute products)?

Competitive Positioning

Who are the real competitors?

• Direct competitors (same product, same customers)
• Indirect competitors (different product, same need)
• New entrants (startups, tech companies entering the space)

Competitive advantages:

• What makes this company win deals?
• How defensible are those advantages?
• Can competitors easily replicate them?

Win/loss analysis:

• Review recent sales wins and losses
• Why did you win? (price, features, relationships, brand)
• Why did you lose? (usually price or missing features)
• Is the win rate improving or declining?

Pricing power:

• Can they raise prices without losing customers?
• How price-sensitive are customers?
• What % of revenue is at-risk if a competitor undercuts by 10-20%?

Customer Interviews

Talk directly to 10-20 customers. You'll learn things management won't tell you:

Questions to ask:

• Why did you choose this vendor?
• What do they do well? Where do they fall short?
• How likely are you to renew? What would cause you to switch?
• Are you buying more or less from them over time?
• How do they compare to alternatives?
• What would you change about their product or service?

Red flags from customer calls:

• Multiple customers mention the same product gap
• Pricing pressure ("they need to lower prices or we'll switch")
• Service quality declining
• Customers considering alternatives actively

Operational Due Diligence

This is where PE firms add the most value. Identify operational improvements that'll drive your returns.

Process and Systems Review

Key processes to evaluate:

• Order-to-cash cycle (how long from order to payment?)
• Procure-to-pay (purchasing and AP process)
• Inventory management (if applicable)
• Production planning and scheduling

Common operational improvements:

• Reduce DSO by 10-15 days (frees up working capital)
• Improve inventory turns (reduce carrying costs)
• Automate manual processes (reduce labor costs)
• Centralize purchasing (negotiate better vendor pricing)

Technology assessment:

• ERP system (SAP, Oracle, NetSuite, or custom?)
• CRM (Salesforce, HubSpot, or spreadsheets?)
• Financial systems (modern or legacy?)
• Integration between systems (manual exports or automated?)

Legacy systems create integration costs post-close but also improvement opportunities.

Management Team Assessment

Evaluate the leadership team:

• Can they scale the business to 2-3x its current size?
• Do they have experience in larger organizations?
• Are they operators or entrepreneurs (different skillsets)?
• How deep is the bench below the CEO?

Key person risk:

• Is the business dependent on the founder or CEO?
• What happens if they leave?
• How transferable is customer loyalty?

Gaps to fill:

• CFO capable of institutional-grade reporting?
• VP Sales who can build a scalable sales org?
• COO to professionalize operations?

Plan to upgrade 20-40% of senior leadership in the first 12-18 months. Budget for this in your returns model.

Facilities and CapEx

Real estate:

• Owned or leased? Lease terms and expiration dates?
• Condition of facilities (deferred maintenance?)
• Capacity vs. utilization

Capital expenditures:

• Historical CapEx as % of revenue
• Maintenance CapEx vs. growth CapEx
• Upcoming equipment replacement needs

Heavy upcoming CapEx requirements (factory equipment, IT infrastructure) reduce distributable cash flow.

Legal and Regulatory Due Diligence

Legal diligence protects you from hidden liabilities and ensures the deal structure works.

Material Contracts Review

Customer contracts:

• Top 20 customers: terms, length, auto-renewal, pricing
• Change of control clauses (do customers have the right to cancel if you acquire the company?)
• Pricing commitments or MFN (most favored nation) clauses

Supplier contracts:

• Key supplier dependencies
• Sole-source suppliers (what if they raise prices or stop supply?)
• Long-term commitments

Partnership and distribution agreements:

• Revenue-sharing terms
• Exclusivity provisions
• Termination rights

Real estate leases:

• Terms and expiration dates
• Rent escalation clauses
• Renewal options and expansion rights

Intellectual Property

What IP does the company own?

• Patents: # of patents, expiration dates, jurisdictions
• Trademarks: key brands, registration status
• Copyrights: software, content, creative works
• Trade secrets: proprietary processes, formulas, data

IP created by employees and contractors:

• Are there proper IP assignment agreements?
• Any consultants who might claim ownership?

Third-party IP:

• What software or technology is licensed from others?
• Open source software risks (GPL, copyleft licenses)

IP issues are expensive to fix post-close. Identify them now.

Litigation and Disputes

Active litigation:

• Plaintiff or defendant?
• Amount at stake and likelihood of loss
• Legal costs to defend or settle

Threatened claims:

• Demand letters or pre-litigation disputes
• Employee complaints or regulatory investigations

Historical pattern:

• Frequent customer disputes (quality issues?)
• Employment lawsuits (culture problem?)
• Regulatory enforcement (compliance gaps?)

Budget for legal reserves if there's ongoing or likely litigation.

Regulatory and Compliance

Industry-specific regulations:

• Healthcare: HIPAA compliance
• Financial services: SOC 2, PCI DSS
• Manufacturing: environmental permits, OSHA
• Data-heavy businesses: GDPR, CCPA

Compliance gaps:

• Are they actually compliant or just claiming to be?
• Any violations or warnings from regulators?
• Cost to come into full compliance?

Non-compliance can delay or kill deals. Factor remediation costs into your valuation.

IT and Cybersecurity Diligence

For any tech-enabled business, you need to understand the technology and security posture.

Technology Stack Review

Core systems:

• Infrastructure: cloud, on-premise, or hybrid?
• Applications: custom-built or off-the-shelf?
• Databases and data architecture
• APIs and integrations

Technical debt:

• Age of codebase and last major refactor
• Deprecated systems still in use
• Security vulnerabilities or outdated dependencies

Scalability:

• Can the current infrastructure handle 2-3x growth?
• What investment is needed to scale?

Cybersecurity Assessment

Security posture:

• Do they have a CISO or security lead?
• Security controls in place (firewalls, encryption, access controls)
• Vulnerability management and patching process
• Incident response plan

Compliance certifications:

• SOC 2 Type II (most SaaS companies should have this)
• ISO 27001 (information security management)
• Industry-specific certifications

Historical incidents:

• Any past breaches or security incidents?
• How were they handled?
• Lessons learned and improvements made?

Penetration testing:

• When was the last pen test?
• Were findings remediated?

A security breach post-close can destroy value. Budget for security upgrades if needed.

Creating Your Value Creation Plan

Due diligence isn't just risk identification. It's finding the levers you'll pull to drive returns.

Identify Improvement Opportunities

Revenue growth initiatives:

• Expand into adjacent markets
• Launch new products or services
• Improve pricing (most companies under-price)
• Increase sales productivity (better training, tools, comp plans)
• Cross-sell or upsell existing customers

Margin improvement:

• Reduce cost of goods sold (negotiate supplier pricing, improve yields)
• Optimize headcount (reduce spans of control, eliminate redundancies)
• Automate manual processes
• Renegotiate vendor contracts

Working capital optimization:

• Reduce DSO through better collections
• Optimize inventory levels
• Extend payment terms with suppliers

Add-on acquisitions:

• Roll up competitors to gain market share
• Buy complementary capabilities
• Enter new geographies through acquisition

Quantify the Impact

For each initiative, estimate:

• EBITDA impact ($ per year)
• Investment required ($ and timeline)
• Risk level (high, medium, low)
• Time to realize (quick wins in 0-6 months, longer-term 12-24 months)

Example:

• Initiative: Implement dynamic pricing
• EBITDA impact: +€2M/year (4% price increase on 50% of revenue)
• Investment: €300K (pricing software + consulting)
• Risk: Medium (some customer resistance)
• Timeline: 6-9 months to implement

Your value creation plan should show a clear path to your target returns.

Due Diligence Data Rooms

Sellers organize all their documents in a virtual data room. Buyers review hundreds or thousands of documents during diligence.

What You'll Find in a Data Room

Typical folder structure:

📁 Corporate
   - Articles of Incorporation
   - Shareholder Agreements
   - Board Minutes
   
📁 Financial
   - Audited Financials (3-5 years)
   - Management Accounts
   - Budget vs. Actual
   - Customer Contracts and Invoices
   
📁 Legal
   - Material Contracts
   - IP Documents
   - Litigation Files
   - Regulatory Filings
   
📁 Commercial
   - Sales Pipeline
   - Customer Lists
   - Marketing Materials
   - Competitive Analysis
   
📁 HR
   - Org Chart
   - Compensation Data
   - Employment Agreements
   - Benefits Plans
   
📁 IT
   - Network Diagrams
   - Security Policies
   - Software Licenses
   - SOC 2 Reports

How Papermark Improves Due Diligence

PE firms use Papermark to run more efficient diligence processes:

For sellers:

• Organize documents professionally - folder structure and permissions
• Control access - different buyers see different documents
• Track engagement - which buyers are actually reviewing documents?
• Answer questions inline - Q&A workflow tied to specific documents
• Watermark downloads - prevent leaks with dynamic watermarks

For buyers:

• Better organization - clear structure vs. messy shared drives
• Activity tracking - see what your diligence team has reviewed
• Collaboration - tag documents, add notes, assign follow-ups
• Audit trail - complete record of what was in the data room

A well-organized data room signals a professional seller. A messy data room suggests operational issues.

Red Flags That Kill Deals

Some findings should make you walk away or significantly reduce your offer.

Deal-Breakers

Revenue quality issues:

• Significant portion of revenue not recurring or at-risk
• Customer concentration >50% in top 3 customers who might not renew
• Fraudulent revenue recognition

Undisclosed liabilities:

• Material pending litigation not disclosed
• Environmental contamination
• Tax issues or audits

Management integrity:

• Lying about material facts
• Concealing information
• Personal enrichment at company expense

Regulatory non-compliance:

• Operating without required licenses
• Major GDPR or data privacy violations
• Environmental or safety violations

Insurmountable integration risks:

• Technology so outdated it can't be integrated
• Cultural misalignment that'll cause mass attrition
• Business model fundamentally broken

Price Adjusters

Some issues aren't deal-breakers but should reduce price:

Working capital gaps - If normalized working capital is €5M but they'll close with €3M, reduce purchase price by €2M.

Customer concentration - Knock 1-2x off the multiple for high concentration risk.

Deferred CapEx - If they've delayed €3M in necessary equipment replacement, reduce price by the same amount.

Revenue at-risk - If 20% of revenue comes from contracts expiring in 6 months, haircut projections accordingly.

Management gaps - If you need to hire a new CFO and COO, reduce projections by their fully-loaded costs.

Key Takeaways

Private equity due diligence separates winning deals from money-losers. Here's what matters:

• Build the right team - specialists in finance, legal, commercial, and operations
• Quality of earnings is foundational - normalize EBITDA to understand true earning power
• Commercial diligence validates growth - talk to customers, understand competitive dynamics
• Operational review finds value creation - identify specific initiatives to drive returns
• Legal diligence protects downside - uncover liabilities and deal-breakers early
• Use professional data rooms - well-organized documentation makes diligence faster and more thorough
• Create a value creation plan - show exactly how you'll achieve target returns
• Know when to walk - deal discipline beats deal volume

The best PE firms do thorough, fast diligence that uncovers both risks and opportunities.

FAQ