Private Equity Due Diligence: Workstreams, Timeline, and Checklist
Private equity due diligence is the investigation a sponsor runs before it buys a company, testing whether the target's earnings, market, technology, security, people, and legal exposure support the price, the debt, and the value creation plan. It runs as parallel workstreams led by the deal team and staffed by accountants, lawyers, and specialist advisers, and most of the work happens inside an exclusivity period, typically 60 to 90 days, after the letter of intent. Each material finding changes the deal in one of five ways: the price, an escrow, a specific indemnity, an exclusion from representations and warranties (R&W) insurance, or an item in the 100-day plan.
This guide sets out the workstreams, a realistic timeline from indication of interest to closing, how platform and add-on diligence differ, what R&W underwriters expect, and the red flags that move price. BD Emerson performs technology, cybersecurity, operational, and commercial due diligence, and quality of earnings through its financial due diligence practice. Legal and tax workstreams belong with deal counsel and tax advisers.
What are the workstreams in private equity due diligence?
A buyout diligence runs ten workstreams. Each one answers a different question about the investment thesis, and the deal team owns the synthesis.
| Workstream | Question it answers | Usually performed by | When it runs |
|---|---|---|---|
| Commercial | Is the market as large and growing as the thesis says, and will customers keep buying? | Strategy advisers or the deal team, with customer interviews | Before the IOI, deepening before the LOI |
| Financial and quality of earnings | Are EBITDA and cash flow real and repeatable, what working capital is normal, and what counts as debt? | Accounting or financial due diligence firm | Light scope before the LOI, full scope in exclusivity |
| Tax | What tax exposure comes with the target, and which structure fits? | Tax advisers | Structure early in exclusivity, exposure review through signing |
| Legal | Do contracts, litigation, IP, permits, and records support the deal? | Deal counsel | Exclusivity through closing |
| Technology | Will the systems and software support the plan, and what will they cost to fix or scale? | Technology diligence specialists | Red-flag review before the LOI, full review in exclusivity |
| Cybersecurity | Has the target been breached, and do its controls meet what customers, regulators, and insurers require? | Cyber diligence specialists | External scan before the LOI, full review in exclusivity |
| Operational | Can operations, suppliers, and facilities deliver the plan without unbudgeted spending? | Operational diligence specialists or operating partners | Exclusivity |
| Management and HR | Can this team execute the plan, and what do retention, compensation, and benefits cost? | Deal team, executive assessors, HR advisers | Management meetings through signing |
| ESG and environmental | Are there environmental liabilities, permit gaps, or practices limited partners will question? | Environmental and ESG consultants | Exclusivity |
| Insurance and risk | Is the insurance program adequate, and what will R&W insurance cover? | Insurance brokers and underwriters | The last three to four weeks before signing |
Quality of earnings moves price most directly because the purchase multiple applies to every adjustment: at 10 times EBITDA, a $1 million reduction in adjusted EBITDA takes $10 million off enterprise value. That arithmetic is why a quality of earnings report is standard on platform deals. Technology and cybersecurity findings change structure more often than headline price, through escrows, special indemnities, and 100-day plan items. Two workstreams carry named standards worth knowing. Environmental review usually includes a Phase I site assessment under ASTM E1527-21, which the EPA recognizes under its All Appropriate Inquiries rule, and tax review tests sales tax exposure in every state where the target sells, because South Dakota v. Wayfair (2018) lets states require out-of-state sellers to collect sales tax without a physical presence.
How long does private equity due diligence take?
A sponsor-led buyout usually takes three to seven months from the first look to closing, and the heaviest diligence runs inside the exclusivity period. The ranges below are BD Emerson planning ranges. Three facts move a deal within them: whether a vendor due diligence report exists, how complete the data room is on day one, and whether the deal needs antitrust or other regulatory clearance.
| Phase | What happens | BD Emerson planning range |
|---|---|---|
| Confidential information memorandum to indication of interest (IOI) | The sponsor reviews the memorandum, builds a first model, and submits a nonbinding price range | 2 to 4 weeks |
| IOI to letter of intent (LOI) | Management meetings, first data room access, outside-in commercial work, and red-flag reviews narrow the price | 3 to 6 weeks |
| Exclusivity and confirmatory diligence | Full workstreams, financing commitments, R&W underwriting, and purchase agreement negotiation | 60 to 90 days |
| Signing to closing | Simultaneous sign and close, or a gap for antitrust clearance, consents, and financing | 0 to 8 weeks |
| First 100 days | Execution of the plan built from diligence findings | About 3 months |
Signing and closing often happen on the same day. In the ABA's 2025 Private Target Deal Points Study, 42 of 139 deals signed and closed simultaneously. A deferred closing usually waits on antitrust clearance under the Hart-Scott-Rodino (HSR) Act, third-party consents, or financing. For 2026, the FTC's adjusted size-of-transaction threshold is $133.9 million, and deals between $133.9 million and $535.5 million also depend on the parties' sizes. A reportable deal cannot close until a 30-day waiting period under 15 U.S.C. 18a ends, and a second request extends it. Deal counsel owns the filing analysis.
How does diligence differ for a platform acquisition and an add-on?
A platform gets the full scope because the sponsor is underwriting a new thesis, a new management team, and the infrastructure that later add-ons will plug into. An add-on gets a narrower, faster review of what the platform will absorb. Add-ons are most of the deal flow: they were 72.9% of US private equity buyouts in 2025, according to PitchBook's 2025 Annual US PE Breakdown.
| Dimension | Platform acquisition | Add-on acquisition |
|---|---|---|
| Scope | All ten workstreams | Earnings, customers, people, legal, and the systems to be integrated |
| Timeline | Full exclusivity period | Often 4 to 8 weeks, as a BD Emerson planning range |
| Technology question | Can this stack carry the whole buy-and-build plan? | What will it cost to move this target onto the platform's stack? |
| Cybersecurity question | Is the platform's security program fit to absorb acquisitions? | What risk does connecting this target's network and identities bring? |
| Antitrust question | HSR thresholds and overlap with the sponsor's other portfolio companies | Whether the series of acquisitions concentrates a local or niche market |
The antitrust row matters more than it used to. Guideline 8 of the 2023 Merger Guidelines, which the Justice Department's Antitrust Division said in February 2025 it would continue to use, lets the agencies examine a series of acquisitions as a whole, which reaches buy-and-build strategies built on small add-ons.
What is vendor due diligence, and how do sponsors use it?
Vendor due diligence is diligence the seller commissions before a sale process, most often quality of earnings and tax, and increasingly technology and cybersecurity, so that every bidder starts from the same tested facts. Sponsors use it from both sides. As sellers, they commission it to shorten the process, surface problems while there is time to fix them, and defend the price. As buyers, they treat it as a starting point: they read it, test its scope and the adviser's independence, and commission confirmatory work on the areas that carry their thesis. A vendor report does not cover the buyer's integration plan or value creation case, so technology and cyber work for the 100-day plan stays with the buyer.
What do R&W insurance underwriters expect to see?
R&W underwriters expect a complete, third-party diligence record, and they exclude what the buyer already knew or did not examine. Norton Rose Fulbright's overview of the underwriting process describes the underwriter reading the acquisition agreement, the disclosure schedules, and every diligence report, expecting legal review by outside counsel and a financial and tax review by an accounting firm, and then holding an underwriting call that typically runs about two hours. Known issues are excluded. Gallagher's 2026 R&W insurance overview puts pricing at around or slightly above a 3% rate on line, meaning the premium divided by the limit, describes limits of about 10% of enterprise value, and lists standard exclusions for matters known to the buyer, asbestos and certain pollutants, and the availability of net operating losses.
Cyber coverage depends on cyber diligence. McGriff's 2022 advisory on cyber risk and R&W insurance warns that insurers restrict coverage when a target's cyber exposure is only partially diligenced, and that they apply conditional exclusions until outstanding diligence arrives. Claims data shows where diligence misses become losses. In Aon's 2026 global claims study, financial statements breaches drove 38% of North American R&W paid loss since 2019, material contracts 21%, compliance with laws 15.1%, and intellectual property 11%, and 51% of claims were notified more than 12 months after closing. R&W insurance is now common: 63% of deals in the ABA's 2025 study referenced it, according to K&L Gates' summary.
Which red flags change price or structure?
In our experience, six findings change price or structure most often in sponsor deals. The table shows what diligence finds and the mechanism each one usually triggers. Our article on technology due diligence red flags gives BD Emerson's planning ranges for the technology items.
| Red flag | What diligence finds | How it shows up in the deal |
|---|---|---|
| Quality of earnings adjustments | Non-recurring revenue, owner costs, add-backs that fail testing, working capital below its normal level | Price, through the multiple, and the working capital peg |
| Customer concentration | A customer whose loss would move EBITDA materially, short contracts, change-of-control termination rights | Price, an earnout, or a closing condition for customer consent |
| Deferred capex and technical debt | Unsupported software, end-of-life infrastructure, manual workarounds, an underfunded roadmap | Price for one-time costs, and the 100-day plan for remediation |
| Security incidents and weak controls | Undisclosed breaches, missing multifactor authentication on remote access, untested backups | Specific indemnity or escrow, an R&W exclusion, and day-one plan items |
| Open source license exposure | Copyleft components in distributed code and license conflicts | Specific indemnity, escrow, or remediation before closing |
| Key-person risk | Revenue, code, or customer relationships held by one or two people | Retention packages, rollover equity or an earnout, and documentation in the 100-day plan |
The mechanism follows the type of finding. A recurring cost hits the multiple, a one-time cost comes off the price dollar for dollar, a contingent liability goes to an escrow, an indemnity, or the insurance policy, and an uncertain outcome goes to an earnout. The illustration below assumes a purchase price of 10 times EBITDA.
| Finding type | Example | Deal mechanism | Effect on price |
|---|---|---|---|
| Recurring cost | $400,000 a year of cloud spend missing from adjusted EBITDA | Lower adjusted EBITDA | $4.0 million off enterprise value |
| One-time cost | $1.5 million to replace an unsupported billing system | Price reduction or a seller-funded fix | $1.5 million |
| Contingent liability | A past breach that could still draw regulatory fines | Escrow, specific indemnity, or R&W exclusion | Held back rather than deducted |
| Uncertain outcome | A large renewal due after closing | Earnout or deferred payment | Paid only if the renewal lands |
Security incidents show how a finding becomes money. In February 2017, after Yahoo disclosed its data breaches, Verizon and Yahoo cut the purchase price by $350 million to about $4.48 billion, and Yahoo agreed to bear 50% of certain cash liabilities from the breaches after closing. The cost can also arrive years later. Marriott acquired Starwood in 2016, attackers had been inside Starwood's guest reservation system since 2014, the breach was found in 2018, and the UK Information Commissioner's Office fined Marriott £18.4 million in 2020, according to Herbert Smith Freehills Kramer's summary. The ICO said due diligence on data operations is not a one-off requirement.
Open source exposure is close to universal. Black Duck's 2026 Open Source Security and Risk Analysis found license conflicts in 68% of the 947 codebases it analyzed, up from 56%, according to its February 2026 announcement, and its M&A summary reports license conflicts in 94% of transactions. A software composition scan belongs in every software deal for that reason.
How should the request list and data room be organized?
Organize the data room by workstream, number every folder, and run every request through one log with an owner, a due date, and a status. In our experience, sellers who build the room this way before launch answer requests in days, and sellers who build it during exclusivity answer them in weeks. This folder structure works for most buyouts:
- Corporate and legal: formation documents, cap table, board minutes, material contracts, and litigation.
- Financial: three years of monthly financials, audit reports, quality of earnings support, working capital detail, and debt schedules.
- Tax: returns, state nexus analysis, audits, and transfer pricing.
- Commercial: revenue by customer, top contracts, pipeline, pricing history, and churn.
- Technology: architecture diagrams, system inventory, software bill of materials, code repository access, roadmap, and cloud invoices.
- Cybersecurity and privacy: policies, penetration test reports, incident history, SOC 2 reports, privacy notices, and data inventory.
- People: organization chart, compensation, employment agreements, benefits, and retention arrangements.
- Operations: suppliers, facilities, capital expenditure history, and operating metrics.
- Environmental, health, and safety: permits, Phase I reports, and incident logs.
- Insurance: policies, loss runs, and open claims.
Our software due diligence checklist breaks folder 5 into specific requests, and our commercial due diligence checklist does the same for folder 4.
How do technology and cyber findings feed the value creation plan?
Each technology and cyber finding should leave diligence with an owner, a cost range, and a date, because that is the form a 100-day plan and an investment model can use. We sort findings into three groups. Fix-before-close items, such as an active compromise or a copyleft problem in shipped code, go to price, escrow, or a closing condition. Day-one and 100-day items, such as missing multifactor authentication, untested backups, or no asset inventory, become dated tasks with owners. Value creation items, such as consolidating duplicate systems across add-ons or cutting cloud spend that grows faster than revenue, go into the model as capital spending with a return.
Findings that cannot be resolved before signing become structure. If diligence cannot confirm whether a product launch or a large renewal will land, the sponsor can use an earnout to pay for it only if it happens. Our technology due diligence and cybersecurity due diligence teams write findings in this form so the deal team can price them and the operating partner can run them after closing.
Frequently asked questions
What is private equity due diligence? Private equity due diligence is the investigation a sponsor runs before buying a company to test whether its earnings, market, technology, security, people, and legal exposure support the price, the debt, and the value creation plan. It runs as parallel workstreams, including quality of earnings, commercial, legal, tax, technology, and cybersecurity, mostly during exclusivity after the letter of intent.
How long does private equity due diligence take? A sponsor-led buyout usually takes three to seven months from the first look to closing, with the heaviest diligence inside an exclusivity period of 60 to 90 days. These are BD Emerson planning ranges. A vendor due diligence report and a complete data room shorten the timeline, and an antitrust filing or other regulatory approval lengthens the gap between signing and closing.
What should a private equity due diligence checklist include? A checklist should cover ten workstreams: commercial, financial and quality of earnings, tax, legal, technology, cybersecurity, operational, management and HR, ESG and environmental, and insurance. Each item should name the question it answers, the document or test that answers it, the owner, and the date. Track every request in one log so the deal team can see open items before signing.
How is add-on due diligence different from platform due diligence? Platform diligence covers every workstream because the sponsor is underwriting a new thesis and management team. Add-on diligence is narrower and faster, often 4 to 8 weeks as a BD Emerson planning range, and focuses on earnings, customers, people, legal exposure, and the cost of integrating the target's systems onto the platform. Add-ons were 72.9% of US private equity buyouts in 2025, according to PitchBook.
Do representations and warranties insurers require a quality of earnings report? Underwriters expect third-party financial and tax diligence from an accounting firm, and for most private equity buyouts that means a quality of earnings report. They read it alongside the purchase agreement, the disclosure schedules, and the legal diligence, and they hold an underwriting call before binding. Areas the buyer did not diligence, and issues the buyer already knows about, are typically excluded from coverage.
What are the biggest red flags in private equity due diligence? The findings that most often change a deal are quality of earnings adjustments, customer concentration, deferred capital spending and technical debt, security incidents and weak controls, open source license exposure, and key-person risk. Each one shows up as a lower price, an escrow, a specific indemnity, an exclusion from R&W insurance, or a dated item in the 100-day plan.
If you are preparing to bid, our M&A due diligence team can run the technology, cybersecurity, operational, commercial, and quality of earnings workstreams on your exclusivity timeline and deliver findings with owners, cost ranges, and dates your model and 100-day plan can use.
About the author
