Due diligence tests whether the business is what the seller says it is, across financial, legal, tax, intellectual property, employment, cybersecurity and data privacy workstreams [1][2]. Findings feed directly into price, structure, special indemnities and insurance exclusions [9]. The same work should produce the integration plan, carried out within antitrust limits on pre-closing coordination [10][11].
In this lesson you will
- List the main due diligence workstreams and the key question each answers.
- Explain what a quality-of-earnings analysis does and how it differs from an audit.
- Describe how cybersecurity, privacy, IP and employment findings change deal terms.
- Explain gun-jumping and clean-team rules that limit pre-closing integration.
- Outline a post-merger integration plan tied to the synergy case.
What diligence is for
Due diligence is the buyer's investigation of the target before it commits. It has three jobs: to confirm the facts behind the price, to find problems that should change the price or the structure, and to build the plan for running the business after closing. Akerman describes staging diligence across industry, quality-of-earnings and legal workstreams, and distinguishes financial and industry diligence from legal diligence [2]. Diligence also matters for insurance: Taft notes that insurers expect buyers to conduct due diligence commensurate with the scope of the representations requested, and that known breaches identified in diligence are excluded from representations and warranties insurance coverage [9].
Financial diligence and quality of earnings
Grant Thornton describes a quality-of-earnings analysis as a targeted financial review that goes beyond reported or audited financial statements to assess the sustainability, predictability and cash-generating nature of earnings, with the goal of determining the sustainable earnings a buyer could expect on a stand-alone basis [1]. Unlike an audit, which is retrospective and compliance-driven, a QoE analysis does not issue an audit opinion; it produces an adjusted view of earnings that is used as an input for valuation, negotiation and deal structuring [1]. The same article cautions that adjusted EBITDA is the most visible output but not, on its own, a guarantee of sustainable cash generation [1].
Financial diligence usually also covers net working capital (to set the peg), debt and debt-like items, revenue recognition, customer concentration and the quality of the forecast. Every adjustment matters, because in an EBITDA-multiple deal each $1 million of unsupported EBITDA can move the price by the full multiple.
Legal and tax diligence
Legal diligence reviews corporate records, capitalization, material contracts, litigation, permits and regulatory compliance. Contracts deserve attention for change-of-control and anti-assignment clauses: Osborn Maledon notes that an asset purchase involving many contracts can require numerous counterparty consents because of anti-assignment clauses, while a stock acquisition leaves the target's assets and liabilities in place with only its owner changing [4].
Tax diligence looks for unpaid taxes, uncertain positions and the validity of tax elections. Structure determines who carries historical exposure: under the Section 338(h)(10) regulations, even when a stock purchase is treated as a deemed asset sale, the new target remains liable for the old target's tax liabilities, including the tax on the deemed sale [3]. For S corporation targets, whether the S election has always been valid is a standard diligence question because it affects whether the buyer's planned tax benefits are available.
Intellectual property
For technology targets, IP diligence asks whether the company actually owns what it sells. An ABA Business Law Today article explains that patent rights originally vest in the named inventors and that assignment of each inventor's rights to the employer is typically the first link in the chain of title [5]. It recommends searching USPTO assignment records for gaps in the chain of title, examining the Abstract of Title for third-party rights such as security interests or liens, and auditing software for open-source license terms that could grant third parties rights in the target's patents [5].
People and employment
Employment diligence covers key-person retention, compensation and benefit plans, contractor classification, change-of-control payments and labor obligations. Restructuring plans need legal review: the Department of Labor's WARN Act guide explains that WARN applies when all or part of a business is sold, even in an asset sale, that the seller must give notice for a covered plant closing or mass layoff before the sale becomes effective, and that the buyer must give notice for one that occurs afterward [6]. The guide describes the notice requirement as generally applying to businesses with 100 or more full-time workers and requiring 60 days' notice, subject to exceptions [6].
Cybersecurity and data privacy
Cyber diligence assesses security controls, incident history and whether past breaches were properly investigated and disclosed. The consequences of a missed breach can be large. In 2018 the SEC announced that the entity formerly known as Yahoo agreed to pay a $35 million penalty for failing to disclose a 2014 breach involving hundreds of millions of user accounts; the SEC said the breach was not disclosed until 2016, when Yahoo was in the process of closing the acquisition of its operating business by Verizon [7].
Privacy diligence asks what the target promised users about their data and whether the buyer's plans are consistent with those promises. When Facebook agreed to acquire WhatsApp, the director of the FTC's Bureau of Consumer Protection wrote to both companies that WhatsApp must continue to honor its privacy promises regardless of the acquisition, and that, absent affirmative express consent, a company cannot use data in a manner materially inconsistent with promises made when the data was collected [8].
Limits on pre-closing coordination
Integration planning can begin before closing, but integration itself cannot. The FTC has explained that competitively sensitive information shared during diligence can facilitate coordination, that the parties must continue to operate independently until consummation, and that clean teams should not include personnel responsible for competitive planning, pricing or strategy [10]. Crossing the line can be costly: in January 2025 the FTC announced a record $5.6 million civil penalty against XCL Resources, Verdun Oil and EP Energy for illegal pre-merger coordination, alleging that the buyers took control over aspects of EP's operations, including halting planned well drilling, during the HSR waiting period [11].
Post-merger integration
Integration is where the synergy case is won or lost. Damodaran's lecture notes cite McKinsey research that tested acquisition programs on whether returns exceeded the cost of capital and whether the acquisitions helped the parent outperform competitors: half of the programs failed one test and a quarter failed both [12]. A practical integration plan has a few elements:
- A Day One plan covering payroll, systems access, customer communication and legal entity changes.
- An integration management office with a named owner for each synergy line and a budget for one-time costs.
- Retention arrangements for the people who hold key customer relationships or technical knowledge.
- A decision on the operating model: fully absorbed, kept stand-alone or somewhere in between.
- Tracking of realized synergies against the model used to set the price, reported to the board.
Consider a buyer that acquires a software company for its engineering team and customer base. Diligence finds that two founders never signed invention assignments, that a widely used module includes open-source code with restrictive terms, and that the company's privacy policy promises never to share user data with affiliates. The buyer can require the founders to sign assignments before closing, budget remediation of the module, take a special indemnity, and design an integration that keeps the user data separate unless users consent. Each finding changes the deal or the integration plan; none needs to end it.
Key terms
- Due diligence
- The buyer's investigation of a target's business, finances, legal position and risks before committing to a transaction.
- Quality of earnings (QoE)
- A transaction-focused review that normalizes reported earnings to estimate the sustainable earnings a buyer is acquiring; it is not an audit.
- Chain of title
- The sequence of recorded transfers showing how ownership of an IP asset passed from inventors or authors to the current owner.
- Open-source license
- A license under which software code is shared; some terms can grant third parties rights or impose obligations on the user's own code.
- WARN Act
- The federal law requiring covered employers to give advance notice of plant closings and mass layoffs, including around business sales.
- Clean team
- A restricted group, often outside advisers, allowed to review competitively sensitive information during diligence under strict protocols.
- Gun jumping
- Unlawful pre-closing coordination or transfer of control between merging parties during the HSR waiting period.
- Integration management office (IMO)
- The team that coordinates post-closing integration and tracks delivery of synergies against plan.
- Special indemnity
- A specific seller promise to cover losses from an identified issue, typically used for known problems excluded from insurance.
Check your understanding
Sources
- [1]Grant Thornton (Switzerland/Liechtenstein), “Understanding Quality of Earnings: a critical component of M&A due diligence,” April 16, 2026.
- [2]Akerman LLP, “Private Equity Mergers and Acquisitions, Session 1: Acquisition Process,” March 24, 2021.
- [3]Legal Information Institute, Cornell Law School, “26 CFR § 1.338(h)(10)-1 – Deemed asset sale and liquidation,” Accessed November 2026.
- [4]Osborn Maledon, P.A., “Structuring an M&A Transaction,” Accessed November 2026.
- [5]Business Law Today (American Bar Association), “Intellectual Property Due Diligence: Review of Patent Ownership and Title,” March 10, 2025.
- [6]U.S. Department of Labor, Employment and Training Administration, “Worker Adjustment and Retraining Notification (WARN) Act: Employer's Guide to Advance Notice of Closings and Layoffs,” Accessed November 2026.
- [7]U.S. Securities and Exchange Commission, “Altaba, Formerly Known as Yahoo!, Charged With Failing to Disclose Massive Cybersecurity Breach; Agrees To Pay $35 Million,” April 24, 2018.
- [8]Federal Trade Commission, Bureau of Consumer Protection, “Letter from Jessica L. Rich to Facebook, Inc. and WhatsApp Inc.,” April 10, 2014.
- [9]Taft Stettinius & Hollister LLP, “Representations and Warranties Insurance: Introduction and Policy Framework,” July 29, 2024.
- [10]Federal Trade Commission (Competition Matters blog), “Avoiding antitrust pitfalls during pre-merger negotiations and due diligence,” March 20, 2018.
- [11]Federal Trade Commission, “Oil Companies to Pay Record FTC Gun-Jumping Fine for Antitrust Law Violation,” January 7, 2025.
- [12]Aswath Damodaran, NYU Stern School of Business, “Valuation, Session 24: Acquirers Anonymous – Seven Steps Back to Sobriety (lecture slides),” Fall 2016.
Educational content only — not legal, tax, or investment advice, or an offer to sell or a solicitation of an offer to buy any security. Rules and data are described as of November 2026 and may change. Securities offered through Umergence LLC, Member FINRA/SIPC.

