A due diligence data room checklist covers eight to ten document categories: corporate and governance records; financial statements and tax filings; intellectual property and material contracts; employee and benefits documentation; regulatory permits and antitrust filings; insurance policies; physical assets and environmental reports; and data privacy and cybersecurity records. What goes inside each category, and how cleanly it’s organized, directly affects deal speed and price. Gaps and disorganization are among the most common reasons transactions stall, reprice, or fall apart.
Corporate and Governance Records
Begin with the documents that prove the company legally exists and is authorized to operate. Load the certificate of incorporation or articles of organization along with every amendment filed with the secretary of state. Add the bylaws or operating agreement, a current certificate of good standing from the state of formation, and foreign qualification certificates for every other state where the company is registered to do business. These cost little to obtain, and their absence is an immediate red flag.
Include board minutes, shareholder meeting minutes, and written consents in lieu of meetings. The stock ledger belongs here as well, showing every issuance, transfer, and cancellation of equity, together with any shareholder agreements, voting agreements, or rights of first refusal that restrict ownership transfers.1Justia. Delaware Code Title 8 – Corporations – Form of Records
Round out this section with organizational charts showing every subsidiary, joint venture, and minority investment, plus the governing documents for any entities the company holds an interest in. Buyers need to trace the full corporate family tree to understand what they’re acquiring.
Financial Records and Tax Compliance
Financial documentation is where buyers spend the most time, and gaps here slow deals more than anything else. Include audited financial statements for the last three to five fiscal years: balance sheets, income statements, cash flow statements, and statements of stockholders’ equity. If audited statements aren’t available, reviewed or compiled statements paired with internal general ledgers and trial balances give the buyer’s accountants enough to work with.
Add monthly or quarterly management financials for the trailing twelve months, accounts receivable and payable aging reports, and a revenue breakdown by customer and product line. Customer concentration matters. If one client accounts for 20% or more of revenue, expect heavy scrutiny of that relationship.
Quality of Earnings Support
Sophisticated buyers run a Quality of Earnings analysis that strips out one-time events, owner perks, and accounting anomalies to show what the business actually earns on a recurring basis. Provide what the QoE analyst needs: adjusted EBITDA calculations with supporting detail for every addback, working capital schedules showing month-by-month trends, and proof-of-cash reconciliations tying bank statements to the general ledger. If a sell-side QoE already exists, upload it. The buyer will do their own regardless, but a seller-commissioned report signals confidence and shortens the review.
Tax Returns and Attributes
Load federal, state, and local income tax returns for at least the last three years. Include correspondence with the IRS or state authorities on audits, assessments, or disputes. Buyers are hunting for undisclosed liabilities, unfiled returns, and pending examinations.
Tax attributes deserve a separate subfolder. When a company undergoes an ownership change, federal law caps the pre-change net operating losses that can offset taxable income each year at the value of the company multiplied by the long-term tax-exempt rate published by the IRS.2Office of the Law Revision Counsel. 26 USC 382 – Limitation on Net Operating Loss Carryforwards and Certain Built-In Losses Following Ownership Change An ownership change is triggered when one or more major shareholders increase their combined stake by more than 50 percentage points over a three-year testing period. If the buyer is pricing in the value of NOLs, give them the NOL schedule, any prior Section 382 studies, and a current shareholder ownership history.
Debt and Liens
Document every piece of outstanding debt: term loans, revolving credit facilities, promissory notes, equipment financing, and any mezzanine or subordinated debt. Pay close attention to change-of-control provisions, which frequently let lenders accelerate repayment on a sale. Include intercreditor agreements where multiple lenders are involved, plus any guarantees the company or its owners have provided.
Run a UCC lien search through the secretary of state in the state of formation and upload the results, along with any subordination or payoff letters already obtained. Unexpected liens are one of the fastest ways to erode trust in a transaction.
Intellectual Property and Material Contracts
In many deals, intellectual property is what the buyer is really paying for. Catalog every patent, trademark registration, and copyright with its registration number, filing date, jurisdiction, and expiration date. Include pending applications; their status affects valuation. Add domain name registrations, software licenses, and any open-source software used in the company’s products.
Trade secrets need different documentation. Because trade secrets lose protection once improperly disclosed, show that the company has taken reasonable steps to keep them confidential: nondisclosure agreements with employees and contractors, restricted-access protocols, and confidentiality provisions in vendor and partner agreements.
Material Contracts and Change-of-Control Clauses
Upload every contract that’s material to the business. The standard threshold is any agreement representing 5% or more of annual revenue or any contract that would be difficult to replace. That includes customer agreements, supplier contracts, distribution deals, licensing arrangements, and joint venture agreements.
The detail that most often catches sellers off guard is the change-of-control clause. Many commercial contracts let the counterparty terminate or renegotiate if the company is sold. Some require prior written consent before any transfer. Others impose assignment fees or require the acquiring entity to formally assume all obligations. Flag every contract with a change-of-control trigger and note whether consent has already been obtained or still needs to be negotiated. A key customer contract that terminates on sale can fundamentally alter deal value.
Litigation and Settlements
Include a litigation summary covering all pending lawsuits, threatened claims, arbitration proceedings, and regulatory investigations. For each matter, list the parties, the nature of the dispute, the amount at stake, and the company’s assessment of likely outcome. Add settlement agreements from resolved disputes, since they sometimes contain ongoing obligations or confidentiality terms that still bind the company.
Employees, Benefits, and Worker Classification
Workforce liabilities are among the most underestimated risks in any acquisition. Start with organizational charts, a headcount summary by department and location, and the current employee handbook. Upload full employment agreements for executives and key employees, along with non-compete, non-solicitation, and invention assignment agreements.
Classification and Wage Compliance
Misclassification of employees as independent contractors is one of the highest-risk areas in HR diligence. The Department of Labor’s current framework, codified at 29 CFR Part 795, uses a multi-factor economic reality test to determine whether a worker is an employee entitled to minimum wage and overtime protections.3U.S. Department of Labor. Misclassification of Employees as Independent Contractors Under the Fair Labor Standards Act If the company relies heavily on contractors, include the contracts governing those relationships, any written classification analysis, and IRS or state audit history related to worker status.
On wage and hour, the Fair Labor Standards Act requires overtime pay for non-exempt employees who work more than 40 hours in a week.4U.S. Department of Labor. Fact Sheet 17A – Exemption for Executive, Administrative, Professional, Computer and Outside Sales Employees Under the Fair Labor Standards Act The salary threshold for the white-collar exemptions currently sits at $684 per week following the federal court’s vacatur of the 2024 rule that would have raised it.5U.S. Department of Labor. Earnings Thresholds for the Executive, Administrative, and Professional Employees Document how each exempt employee meets both the salary and duties tests. Back pay claims for misclassified exempt workers can reach back two or three years, and liability stacks up fast across a large workforce.
Benefits, Retirement Plans, and Severance
Retirement and health plan documentation must comply with ERISA, which sets minimum standards for plan funding, fiduciary duties, and participant disclosures.6U.S. Department of Labor. Employee Retirement Income Security Act (ERISA) Include plan documents for every benefit plan, the most recent Form 5500 filings, current summary plan descriptions, and the latest funding status reports for any defined benefit pension. For a 401(k) with employer matching, include compliance testing results and any corrective distributions.
Pay close attention to severance agreements and change-of-control provisions in executive contracts. Some guarantee lump-sum payments upon a sale, and the cumulative cost across the leadership team can be substantial. Add vacation accrual balances and bonus plan documents, which create immediate post-closing liabilities the buyer inherits.
Regulatory Permits, Licenses, and HSR
Every business operates under some form of regulatory oversight. Load a master list of all government permits, licenses, registrations, and regulatory approvals required to operate, along with copies of each. Industry-specific approvals matter especially: FDA clearances for medical device or pharmaceutical companies, FCC licenses for telecom businesses, state professional licenses for healthcare, law, or financial services firms.
Disclose any correspondence with regulators, including warning letters, consent orders, and audit findings. Buyers find these eventually. Discovering them outside the data room damages credibility more than the underlying issue usually warrants.
Hart-Scott-Rodino Thresholds
Transactions above a certain size trigger mandatory premerger notification under the Hart-Scott-Rodino Act. As of February 2026, the size-of-transaction threshold is $133.9 million, so deals at or above that value generally require both parties to file with the Federal Trade Commission and the Department of Justice before closing.7Federal Trade Commission. Current Thresholds Filing fees range from $35,000 for transactions under $189.6 million to $2.46 million for deals of $5.869 billion or more.8Federal Trade Commission. New HSR Thresholds and Filing Fees for 2026 Include any antitrust analysis already performed, prior HSR filings if applicable, and market share data regulators would need to evaluate competitive effects.
Insurance Policies and D&O Tail Coverage
Insurance defines the risk the buyer inherits and the risk that disappears at closing. Include copies of every active policy: general liability, professional liability or errors and omissions, product liability, property and casualty, cyber liability, umbrella or excess coverage, workers’ compensation, and key person life insurance.
For each policy, provide the declarations page, policy limits, deductible or self-insured retention, pending claims, and the loss run history for the last three to five years. Loss runs show the company’s actual claims experience and often surface risks that don’t appear anywhere else in the data room.
Directors and officers insurance needs special handling. Most D&O policies are claims-made, meaning they cover claims reported during the policy period regardless of when the underlying conduct occurred. When the company changes hands, the existing policy typically stops covering new claims. Securing “tail” coverage extends the reporting window, often for six years, so former directors and officers remain protected for pre-closing conduct. Policies frequently require prompt notice of a change in management control to preserve tail rights, and missing that window can result in a complete denial of coverage. Load the current D&O policy, any prior policies still within their reporting period, and documentation of any tail coverage already negotiated or quoted.
Real Estate, Equipment, and Environmental Reports
Tangible assets need clear ownership or lease documentation. For company-owned real estate, include deeds, title insurance policies, and recent surveys. For leased properties, include the full lease with all amendments, renewal options, and any landlord consent requirements triggered by a change of ownership. A rent roll summarizing each location’s monthly obligation, lease expiration, and renewal terms gives the buyer a quick snapshot of the real estate footprint.
A fixed asset schedule listing major equipment, vehicles, and machinery should indicate whether each item is owned, financed, or leased. Include associated loan or lease agreements and note any equipment subject to UCC liens. For businesses where production capacity matters, the condition and remaining useful life of key equipment can meaningfully affect valuation.
Phase I Environmental Site Assessments
For any transaction involving real property, a Phase I Environmental Site Assessment is the standard tool for evaluating contamination risk. A buyer who conducts “all appropriate inquiries” into the property’s history before acquisition can qualify for the innocent landowner defense against cleanup liability under federal environmental law.9Office of the Law Revision Counsel. 42 USC 9601 – Definitions The ASTM E1527-21 standard governs how these assessments are conducted. A Phase I must be completed no more than 180 days before the acquisition date to be presumed viable. An assessment up to one year old can still be used if five specific components are updated within the 180-day window: interviews with property owners and occupants, searches for environmental cleanup liens, government records review, a visual site inspection, and the environmental professional’s declaration.10ASTM International. E1527 Standard Practice for Environmental Site Assessments
If a Phase I identifies potential contamination, a Phase II assessment involving soil or groundwater sampling typically follows. Include any existing Phase I or Phase II reports, along with records of underground storage tanks, hazardous materials handling, waste disposal practices, and ongoing remediation obligations. Environmental cleanup liabilities can dwarf the purchase price of a property.
Data Privacy and Cybersecurity Records
Privacy and security have become a standalone diligence category. Include the company’s written privacy policies for customers, employees, and website visitors, along with internal information security policies covering physical, administrative, and technical safeguards.
Document any data breaches or unauthorized access incidents from the last three to five years, along with the incident response plan. If the company has undergone a SOC 2 audit or similar third-party security assessment, include the most recent report. SOC 2 reports are one of the fastest ways for a buyer to gauge whether a company takes data security seriously.
Regulatory compliance documentation belongs here too. If the company collects personal data from consumers, it likely has obligations under one or more state privacy laws. Include data processing agreements with third-party vendors, records of consumer data access or deletion requests, and the name and title of whoever functions as privacy officer or chief information security officer. For companies handling health data, payment card data, or children’s data, add the relevant HIPAA, PCI-DSS, or COPPA compliance documentation.
Setting Up and Securing the Data Room
The documents only matter if the buyer can find them and trust the environment they’re stored in. Choose a virtual data room provider offering AES-256 encryption for data in transit and at rest, multi-factor authentication, and granular permission controls down to the individual document. View-only access with disabled downloads, copy restrictions, and dynamic watermarking that stamps each page with the viewer’s email and IP address helps prevent unauthorized distribution.
Organize the room using a numbered index that mirrors the categories above. Each top-level folder corresponds to a diligence category, with subfolders for specific document types. A consistent naming convention covering document type, date, and version saves the review team hours of guesswork. Upload documents as searchable PDFs rather than scanned images wherever possible.
Permission Tiers and Clean Rooms
Not everyone on the buyer’s team needs the same level of access. Set permission tiers so that, for example, the buyer’s legal counsel can view employment agreements while financial analysts see only the financials. Many data rooms allow a restricted “clean room” folder for competitively sensitive material like customer-level pricing or proprietary technology details, accessible only to a limited group of pre-approved reviewers operating under a separate confidentiality agreement.
Once the room is live, monitor activity through the platform’s audit logs. These logs track who accessed which documents, when, and for how long, which supports both security and the seller’s read on where the buyer’s concerns are landing.