Due Diligence Checklist: Process, Workstreams & Practical Tips

Due diligence is the central review phase in every company transaction in the DACH region. Whether it is a company sale, an investment or a merger, no deal gets done without a thorough review. This guide takes you through all workstreams and the typical process in 5 steps, and gives you a complete checklist for the Mittelstand.

What is due diligence? Definition and significance

The term due diligence comes from Anglo-American law and literally means "the care that is due". In mergers & acquisitions (M&A), due diligence is the comprehensive, systematic review of a target company by the potential buyer before a transaction closes. The due diligence review builds a detailed picture of the company, identifies risks and creates a sound basis for setting the purchase price and drafting the contract.

In the DACH Mittelstand, due diligence matters even more, because owner-managed companies often have less formalised structures than listed groups. The review typically covers areas the owner has not documented systematically in day-to-day business, from verbal agreements with key customers to tax optimisations that could fall away with a change of ownership.

The due diligence findings feed directly into the company valuation. Identified risks lead to price discounts, while value potential that had not been recognised (so-called hidden values) can raise the purchase price. Due diligence is therefore much more than a pure review exercise. It is a strategic tool for steering the transaction.

Types of due diligence: 8 workstreams at a glance

A full due diligence is split into several specialist workstreams, weighted differently depending on the type of transaction, the sector and the size of the company. In the DACH Mittelstand, financial, legal and tax due diligence form the standard scope. Larger transactions or specific sector requirements add further workstreams.

1. Financial due diligence (FDD)

Financial due diligence analyses the financial position of the target. The core focus areas are quality of earnings, the sustainability of the EBITDA margin, working capital, net debt and capital expenditure planning. The FDD is the basis for the company valuation and for deriving the enterprise value.

2. Legal due diligence (LDD)

Legal due diligence reviews the legal position of the company: corporate structure, material contracts, employment law, intellectual property, permits and ongoing litigation. In the Mittelstand, particular attention goes to verbal arrangements and agreements that were never formalised.

3. Tax due diligence (TDD)

Tax due diligence identifies tax risks and opportunities. It reviews tax returns, assessments, tax audit reports, intra-group transfer prices, loss carryforwards and the tax structuring of the transaction itself (asset deal vs. share deal). Trade tax, real estate transfer tax and VAT questions are especially relevant in the DACH region.

4. Commercial due diligence (CDD)

Commercial due diligence analyses the market position of the company, competitive dynamics, the customer structure and growth prospects. It answers the question of whether the revenues and market shares projected in the business plan are realistic. CDD is especially relevant for private equity investors and for strategic buyers from adjacent sectors.

5. Technical / operational due diligence

Review of the technical infrastructure, production processes, machinery, maintenance backlogs and technological competitiveness. For manufacturing companies in the Mittelstand, technical DD is especially important to estimate the investment needed after the acquisition.

6. IT due diligence

Analysis of the IT landscape, ERP systems, cybersecurity, licence management and degree of digitalisation. IT due diligence is becoming more important, because integrating the IT systems is often a significant cost block after the transaction and cyber risks are increasingly relevant to the deal.

7. HR / people due diligence

Review of the organisational structure, key people, pay systems, works agreements, pension obligations and company culture. In the owner-managed Mittelstand, the focus is on dependence on key people and on succession planning for critical positions.

8. ESG due diligence

Review of environmental, social and governance aspects, including legacy environmental contamination, carbon footprint, supply chain due diligence obligations (LkSG), working conditions and compliance management systems. ESG due diligence has gained a lot of weight in recent years because of regulatory requirements (EU Taxonomy, CSRD).

The due diligence process: 5 steps from planning to report

A structured due diligence process is key to an efficient, high-quality review. Below I describe the typical process in five clearly defined steps, from the letter of intent to the final due diligence report.

Step 1: Scoping and planning (week 0-1)

After the LOI is signed, the buyer and its advisers define the scope of the due diligence. The scope depends on the size of the transaction, the sector and the main risk areas identified. The individual workstreams are set, adviser teams are put together and a detailed timetable is drawn up. The buyer sends the seller a due diligence request list: a structured list of all documents and information required.

Step 2: Data room preparation (week 1-2)

The seller provides the requested documents in a virtual data room (VDR). It is organised by workstream (financial, legal, tax, commercial etc.). Ideally the seller has prepared the data room before the LOI to avoid delays. The seller's M&A adviser checks the documents provided for completeness and quality.

Step 3: Document analysis (week 2-5)

The buyer's specialist adviser teams analyse the documents and information provided in their respective fields. At the same time, follow-up questions (Q&A) go to the seller to clear up open points and request further information. The Q&A phase is iterative: in Mittelstand transactions there are typically 2 to 4 rounds with 100 to 300 individual questions in total.

Step 4: Management presentation and site visit (week 4-6)

A central element of the due diligence is the management presentation (management meeting), in which the target's leadership team presents the business strategy, operating priorities and future plans to the buyer and its advisers. Site visits add to this: production facilities, warehouses and office locations are inspected in person. These meetings are a chance to clear up questions from the document analysis face to face.

Step 5: Due diligence report and contract negotiation (week 6-8)

Each adviser team writes a DD report summarising the findings, identified risks and recommendations. The reports feed into the price negotiation: identified risks are addressed through price adjustments, warranties, indemnities or earn-out mechanisms. Based on the overall picture from all DD findings, the buyer decides whether, and on what terms, the transaction goes ahead.

Financial due diligence in detail

Financial due diligence is the central workstream of every M&A transaction. It analyses the historical and forecast financial performance of the target and is the basis for determining the EBITDA multiples and the company value derived from them.

Quality of earnings (QoE)

The quality of earnings analysis is the heart of financial due diligence. It checks whether the reported EBITDA is sustainable and recurring. One-off effects, extraordinary income and expenses, owner pay above market level and costs not needed to run the business are identified and normalised. The result is an adjusted, sustainable EBITDA (adjusted EBITDA), which serves as the basis for the purchase price.

Typical normalisations in the DACH Mittelstand include: managing director salaries above or below average, the owner's private costs (company cars, travel), one-off restructuring expenses, non-recurring consulting costs and extraordinary warranty or damage costs. Together these adjustments can change EBITDA by 10 to 30%.

Working capital analysis

The working capital analysis determines operating net working capital (NWC) and its seasonal swings. The buyer sets a normalised working capital (target working capital) as the reference value for the price adjustment at closing. If actual working capital at closing is below the target, the purchase price goes down. If it is above, the price goes up. This mechanism is in practically every purchase agreement and is prepared in the financial DD.

Net debt

The net debt analysis covers all interest-bearing liabilities less freely available cash. In the Mittelstand, shareholder loans, pension provisions, leases (IFRS 16), deferred tax liabilities and so-called debt-like items (e.g. deferred capital expenditure, litigation risks) are especially relevant. Net debt is deducted from the enterprise value in the price calculation to arrive at the equity value.

Legal due diligence in detail

Legal due diligence examines the legal position of the target in full. In the DACH Mittelstand, three areas matter most.

Contracts and business relationships

The review of material contracts covers customer contracts, supplier agreements, leases, licence agreements and joint venture agreements. Particular attention goes to change-of-control clauses, which give the counterparty termination rights on a change of ownership. In the Mittelstand there are often informal or verbal agreements with key customers that are hard to secure legally.

Compliance and regulatory requirements

The compliance review covers adherence to sector-specific regulations, data protection (GDPR), competition law, foreign trade law, anti-money laundering law and sector-specific permits. In manufacturing, environmental permits, CE marking and product liability questions come on top. Compliance breaches can lead to substantial fines and reputational damage.

Litigation and liability risks

Ongoing and threatened litigation is analysed in detail. This includes court proceedings, arbitration, investigations by authorities and potential third-party claims. For each identified risk, a probability and a potential loss are estimated. Material liability risks are addressed in the purchase agreement through specific indemnities.

Tax due diligence in detail

In the DACH region, tax due diligence is especially relevant because of the complexity of tax law and the frequency of tax audits. It identifies tax risks that could hit the buyer after the transaction.

Tax risks and deferred tax liabilities

The review covers outstanding tax assessments, open tax audit periods, differences between the tax and commercial balance sheets, tax provisions and deferred tax liabilities. In Germany, corporate income tax, trade tax, VAT and payroll tax are the main areas. Austria and Switzerland have different rules that require specific expertise.

Tax audits

The status of completed and pending tax audits is a central point of the review. Open audit periods are a potential risk that has to be addressed in the purchase agreement. The tax DD analyses the results of past tax audits for recurring objections and estimates the risk of back payments for periods not yet audited.

Transfer pricing and intra-group transactions

For companies with affiliated entities or international structures, the tax DD checks whether transfer prices are appropriate. Transfer prices that are not at arm's length can lead to substantial back taxes and penalty surcharges. The structuring of the transaction itself, as a share deal or asset deal, also has material tax implications for buyer and seller.

Commercial due diligence: market, competition & customers

Commercial due diligence (CDD) assesses the market position, competitiveness and growth prospects of the target. It answers the central question: are the business plan assumptions realistic and sustainable?

Market position and market dynamics

Analysis of the target market by size, growth rate, segmentation and barriers to entry. The CDD quantifies the target's market share and assesses its competitive positioning. In the DACH Mittelstand, many companies operate in niche markets and, as "hidden champions", hold leading market positions that often first have to be identified during deal origination.

Competitive analysis

Identification and assessment of the main competitors by size, market share, price positioning, technological capability and strategic direction. The competitive analysis assesses how durable the target's competitive advantages are (sustainable competitive advantages), for example through patents, customer relationships, brand strength or cost advantages.

Customer structure and revenue concentration

The CDD analyses the customer structure for concentration risks, customer dependencies, contract terms and notice periods. A common risk in the Mittelstand is concentration risk: if 2 to 3 customers account for more than 50% of revenue, the transaction risk rises considerably. The tie between customer relationships and the owner (key man risk) is also addressed in the CDD.

Due diligence checklist: all workstreams at a glance

The following checklist summarises the main review points of all due diligence workstreams. It gives sellers a guide for preparing the data room and buyers a guide for planning the focus of the review.

The data room: setting up a virtual data room (VDR) properly

The virtual data room (VDR) is the central platform for exchanging information during the due diligence. A professionally prepared data room can shorten the whole DD process by several weeks and signals professionalism and transparency to the buyer.

Choosing the VDR provider

Common VDR providers in the DACH M&A market are Datasite (formerly Merrill), Intralinks, Ansarada, iDeals and Brainloop. Costs are typically €3,000 to €15,000 per month, depending on storage needs and number of users. Selection criteria are data security (ISO 27001, SOC 2), ease of use, permission management, a Q&A module, activity tracking and watermarking.

Structure and organisation

The data room is usually organised by due diligence workstream. A proven folder structure includes:

• 1.0 Corporate: articles of association, commercial register, resolutions
• 2.0 Financial: annual financial statements, management accounts (BWA), planning, working capital
• 3.0 Tax: tax returns, assessments, tax audits
• 4.0 Legal: contracts, IP rights, litigation
• 5.0 HR: employment contracts, organisation chart, pensions
• 6.0 Commercial: customer lists, market data, pipeline
• 7.0 IT / Technology: system landscape, licences, cybersecurity
• 8.0 Operations: production data, facilities, quality management
• 9.0 ESG / Environment: environmental reports, LkSG, compliance
• 10.0 Insurance: insurance policies, claims history

Best practices for preparing the data room

• Start compiling 4 to 6 weeks before the planned DD start
• Name documents consistently and clearly (e.g. "2.1.1_Annual_Financial_Statements_2025_GmbH.pdf")
• Create a data room index with document descriptions
• Check all documents for completeness and currency
• Remove private or irrelevant content before uploading
• Set up differentiated access rights for different buyer groups
• Appoint an internal data room coordinator as the central contact

Typical red flags in due diligence

Certain findings immediately draw closer attention from experienced buyers and their advisers. The following red flags can lead to substantial price discounts or even to the end of the transaction.

Financial red flags

• Inconsistencies between annual financial statements, management accounts and tax returns
• Unusual revenue jumps shortly before the transaction (window dressing)
• High one-off effects that artificially inflate EBITDA
• Sharply rising receivables periods (days sales outstanding) as a sign of customers' payment problems
• Investment backlog: investments held back to boost short-term results
• Deviations between plan and actual of more than 20% in recent years

Legal red flags

• Change-of-control clauses in contracts with the largest customers
• Missing or expired permits for running the business
• Material contracts not in writing, especially common in the Mittelstand
• Ongoing litigation with an uncertain outcome and a high amount in dispute
• GDPR breaches or missing data protection documentation

Tax red flags

• Open tax audit periods covering 3 or more years
• Missing transfer pricing documentation for intra-group transactions
• Aggressive tax structuring that could be challenged in an audit
• Tax payment arrears or outstanding tax returns

Commercial red flags

• High customer concentration: the top 3 customers account for more than 50% of revenue
• Falling order intake or a shrinking pipeline
• Strong dependence on the owner in customer relationships (key man risk)
• Declining market or disruptive technological change in the target market
• Significant price pressure from new competitors or commoditisation

Cost and duration of due diligence in the DACH Mittelstand

The cost and duration of a due diligence vary widely depending on the size of the transaction, the complexity of the target and the scope of the workstreams commissioned. The following overview shows typical ranges for the DACH Mittelstand.

As a rule, the buyer bears the cost of the due diligence. In a vendor due diligence (VDD), the seller pays, because it commissions the review itself. In practice, DD costs are typically 0.5 to 2% of the transaction value. For a company value of €10 million, total costs are therefore €50,000 to €200,000.

Factors that affect the duration are the quality of the data room preparation, how quickly the seller responds to questions, the complexity of the corporate structure (foreign subsidiaries, holding structures) and the availability of management for interviews and site visits. Early and thorough preparation of the sale process is the most important lever for shortening the DD.