What does due diligence cover in a tech company sale?
Due diligence on a lower-middle-market tech company covers 200 or more individual request items. The request list arrives within days of a signed letter of intent, and the buyer expects responses to start flowing in the first week.
The requests fall into six workstreams: financial, legal, tax, technology, commercial, and HR. Financial diligence tests whether reported revenue and EBITDA survive a quality of earnings review. Legal diligence tests whether the company cleanly owns its IP, its customer contracts, its equity history, and its corporate records. Tax diligence hunts for sales tax exposure, contractor misclassification, R&D credit problems, and cross-border structure issues.
Technology diligence examines code quality, architecture, security posture, and open-source license compliance. Commercial diligence tests the durability of the customer base through churn analysis and market interviews. HR diligence looks for misclassified contractors and unfunded obligations, and it maps how much of the business depends on specific employees.
In what order does diligence happen?
Diligence runs in a set sequence. The quality of earnings review comes first, because every later workstream prices risk against the financial baseline the QoE establishes.
Legal and contract review follows the QoE. Lawyers work through corporate records, customer agreements, IP assignments, and employment terms while the accountants finish their fieldwork. Commercial diligence and management calls run next.
Customer reference calls come last. Reference calls put the deal in front of the seller’s own customers, so a disciplined process holds the calls until every other workstream has cleared and the buyer has reconfirmed price.
What are buyers actually hunting for?
Buyers hunt for four findings: revenue quality restatements, customer concentration, unbudgeted liabilities, and key-person risk. Each finding converts directly into a price argument.
A revenue restatement is the most damaging finding. A buyer that finds one-time services revenue booked as recurring will restate ARR downward and reprice the whole deal off the restated figure. Customer concentration converts into structure, with value pushed into earnouts tied to retention of the largest accounts.
Unbudgeted liabilities, such as uncollected sales tax or misclassified contractors, come off the price dollar for dollar or land in escrow. Key-person risk converts into holdbacks and multi-year employment conditions for the founder.
How does diligence lead to a retrade?
Diligence findings are the standard justification for a late price cut. The buyer presents a finding, attaches a number to it, and proposes a reduced price inside exclusivity, after the seller has dismissed every other bidder. Roughly one in three signed LOIs fails to close on original terms, and diligence findings drive most of the renegotiations.
The defense is sell-side preparation. A sell-side quality of earnings review costs $40,000 to $100,000 and surfaces every restatement argument before any buyer can. A clean, staged data room removes the discovered-document surprises that fund a buyer’s discount case.
Preparation also protects competitive position. The Proprietary Discount, the gap between what a serial acquirer pays in an unbanked bilateral negotiation and what the same business clears in a competitive process, runs 15 to 25 percent of enterprise value, and unprepared diligence is one of the main mechanisms that produces it.
What should a seller never hand over early?
A seller should never release customer names, source code, employee-level compensation data, or granular pricing before exclusivity. Sensitive material is sequenced so the most competitively dangerous items open last.
Customer names in a competitor’s hands become a call list if the deal dies. Source code review happens in a controlled environment or through third-party escrow review, and only for a buyer that has confirmed price and terms. Pricing detail tells a strategic acquirer exactly how to undercut the seller in the next sales cycle.
Staging is normal practice, and experienced buyers expect it. A buyer demanding full access at the indication-of-interest stage is signaling either inexperience or an intelligence-gathering exercise.
How long does due diligence take?
Confirmatory diligence takes 30 to 60 days inside exclusivity when the seller is prepared. Buyers ask for 30 to 90 days of exclusivity as a standard opening position, and Windsor Drake recommends granting 30 to 45 days with extensions tied to milestones. The letter of intent sets that exclusivity clock.
An unprepared seller takes multiples of 30 to 60 days. Each stale financial statement and each missing contract extends the clock, and time works for the buyer, because seller fatigue and expiring exclusivity are both negotiating assets for the buy side.
How does a seller prepare for each workstream?
A seller prepares by running each buyer test internally before any buyer runs it. The table below maps the six workstreams to the preparation that defuses each one.
| Workstream | What the buyer tests | Seller preparation that defuses it |
|---|---|---|
| Financial | Revenue recognition and EBITDA adjustments | Sell-side QoE, at $40,000 to $100,000, completed before buyer contact |
| Legal | Contract assignability and IP ownership | Contract audit and IP assignment cleanup during preparation |
| Tax | Sales tax nexus and contractor classification | Nexus study with exposure quantified and disclosed on the seller’s terms |
| Technology | Code quality and open-source license exposure | Independent code scan and license audit before the process starts |
| Commercial | Churn and customer concentration | Cohort retention analysis and a concentration explanation built into the CIM |
| HR | Key-person dependence and compensation liabilities | Retention plans and a documented second-tier management layer |
Diligence readiness is the core argument for running a prepared process instead of reacting to a single buyer, and the case for professional help is set out in do I need a banker. Founders fielding inbound interest can start at the offer-received hub. For a founder holding a live offer with a diligence request list already arriving, Windsor Drake’s Approach Response engagement builds the diligence defense while the deal is in motion.
Questions founders ask
How many diligence requests should a seller expect?
A lower-middle-market tech seller should expect 200 or more request items across financial, legal, tax, technology, commercial, and HR workstreams, delivered within days of the signed LOI.
What does a quality of earnings review cost?
A quality of earnings review costs $40,000 to $100,000 for a lower-middle-market company. A sell-side QoE completed before buyer contact surfaces restatement arguments before any buyer can use them.
Should a seller run a QoE before going to market?
Yes. A sell-side QoE finds revenue recognition and EBITDA issues while the seller controls the timeline and the framing, instead of handing the buyer a repricing argument mid-exclusivity.
Can a seller refuse to share customer names during diligence?
Yes, until exclusivity. Customer names, source code, and employee-level data are tier-four disclosures that open only for the single buyer under a signed LOI.
What happens when diligence finds a problem?
The buyer attaches a number to the finding and proposes a price reduction. A seller who found and disclosed the issue first, with a fix or a reserve, removes most of the repricing argument.
How long should exclusivity run for confirmatory diligence?
Buyers ask for 30 to 90 days as a standard opening position. Windsor Drake recommends granting 30 to 45 days, with extensions granted only against completed milestones.
Last reviewed July 28, 2026 by Jeff Barrington, Founder and Managing Director, Windsor Drake. Content on this page may be cited with attribution and a link to https://windsordrake.com/process/due-diligence/