1. Define the buyer-decision architecture
Translate the likely investment committee, financing, regulatory, integration and risk decisions into explicit questions before documents are collected.
The controlled review should reconcile buyer thesis, transaction perimeter, timetable, approval path and value thresholds. Every item records the entity, period, assertion, source, owner, authority, sensitivity, version, decision link and exception status. The immediate output is an approved buyer-decision map.
Testing should separate document presence from evidential sufficiency. Reviewers inspect native records, trace samples to source systems, reperform critical reconciliations, compare explanations with behaviour over time and seek disconfirming evidence. Reliability depends on provenance, completeness, accuracy, consistency, approval and fitness for the specific buyer decision.
Material gaps should be quantified and assigned an accountable owner, corrective action, required proof and decision date. Consequences flow into the model, investment case, financing, regulatory analysis, negotiation, disclosure and integration plan. The room retains the exception until evidence resolves it or authorised decision-makers explicitly accept and allocate the residual risk.
2. Reconcile the transaction perimeter
Align legal entities, ownership, assets, operations, jurisdictions, carve-outs and excluded matters to the proposed transaction.
The controlled review should reconcile corporate records, cap tables, organisation charts, licences, financial statements and perimeter schedules. Every item records the entity, period, assertion, source, owner, authority, sensitivity, version, decision link and exception status. The immediate output is a controlled transaction-perimeter ledger.
Testing should separate document presence from evidential sufficiency. Reviewers inspect native records, trace samples to source systems, reperform critical reconciliations, compare explanations with behaviour over time and seek disconfirming evidence. Reliability depends on provenance, completeness, accuracy, consistency, approval and fitness for the specific buyer decision.
Material gaps should be quantified and assigned an accountable owner, corrective action, required proof and decision date. Consequences flow into the model, investment case, financing, regulatory analysis, negotiation, disclosure and integration plan. The room retains the exception until evidence resolves it or authorised decision-makers explicitly accept and allocate the residual risk.
3. Map buyer theses and disconfirming evidence
State each value thesis, synergy, risk hypothesis and credible reason it could fail.
The controlled review should reconcile strategy materials, valuation cases, market evidence, management records and buyer questions. Every item records the entity, period, assertion, source, owner, authority, sensitivity, version, decision link and exception status. The immediate output is a thesis-and-disconfirmation register.
Testing should separate document presence from evidential sufficiency. Reviewers inspect native records, trace samples to source systems, reperform critical reconciliations, compare explanations with behaviour over time and seek disconfirming evidence. Reliability depends on provenance, completeness, accuracy, consistency, approval and fitness for the specific buyer decision.
Material gaps should be quantified and assigned an accountable owner, corrective action, required proof and decision date. Consequences flow into the model, investment case, financing, regulatory analysis, negotiation, disclosure and integration plan. The room retains the exception until evidence resolves it or authorised decision-makers explicitly accept and allocate the residual risk.
4. Build the evidence taxonomy
Organise evidence by decision, assertion, source system, period, entity, owner, sensitivity and reliability.
The controlled review should reconcile request lists, workstreams, source systems, data dictionaries and document inventories. Every item records the entity, period, assertion, source, owner, authority, sensitivity, version, decision link and exception status. The immediate output is a decision-centred evidence taxonomy.
Testing should separate document presence from evidential sufficiency. Reviewers inspect native records, trace samples to source systems, reperform critical reconciliations, compare explanations with behaviour over time and seek disconfirming evidence. Reliability depends on provenance, completeness, accuracy, consistency, approval and fitness for the specific buyer decision.
Material gaps should be quantified and assigned an accountable owner, corrective action, required proof and decision date. Consequences flow into the model, investment case, financing, regulatory analysis, negotiation, disclosure and integration plan. The room retains the exception until evidence resolves it or authorised decision-makers explicitly accept and allocate the residual risk.
5. Create the request-to-decision graph
Connect every material request and response to the buyer question, assertion, test, exception and decision it informs.
The controlled review should reconcile diligence lists, Q&A logs, issue trackers and investment committee requirements. Every item records the entity, period, assertion, source, owner, authority, sensitivity, version, decision link and exception status. The immediate output is a traceable request-to-decision graph.
Testing should separate document presence from evidential sufficiency. Reviewers inspect native records, trace samples to source systems, reperform critical reconciliations, compare explanations with behaviour over time and seek disconfirming evidence. Reliability depends on provenance, completeness, accuracy, consistency, approval and fitness for the specific buyer decision.
Material gaps should be quantified and assigned an accountable owner, corrective action, required proof and decision date. Consequences flow into the model, investment case, financing, regulatory analysis, negotiation, disclosure and integration plan. The room retains the exception until evidence resolves it or authorised decision-makers explicitly accept and allocate the residual risk.
6. Define source authority and provenance
Distinguish native records, controlled reports, extracts, models, presentations, explanations and third-party evidence.
The controlled review should reconcile system metadata, approvals, timestamps, owners, reconciliations and audit trails. Every item records the entity, period, assertion, source, owner, authority, sensitivity, version, decision link and exception status. The immediate output is an evidence-provenance standard.
Testing should separate document presence from evidential sufficiency. Reviewers inspect native records, trace samples to source systems, reperform critical reconciliations, compare explanations with behaviour over time and seek disconfirming evidence. Reliability depends on provenance, completeness, accuracy, consistency, approval and fitness for the specific buyer decision.
Material gaps should be quantified and assigned an accountable owner, corrective action, required proof and decision date. Consequences flow into the model, investment case, financing, regulatory analysis, negotiation, disclosure and integration plan. The room retains the exception until evidence resolves it or authorised decision-makers explicitly accept and allocate the residual risk.
7. Reconcile legal entities and ownership
Prove incorporation, authority, ownership, beneficial interests, securities, options, liens and governance rights across the perimeter.
The controlled review should reconcile registries, constitutional documents, cap tables, shareholder agreements, board records and financing documents. Every item records the entity, period, assertion, source, owner, authority, sensitivity, version, decision link and exception status. The immediate output is a legal-ownership reconciliation.
Testing should separate document presence from evidential sufficiency. Reviewers inspect native records, trace samples to source systems, reperform critical reconciliations, compare explanations with behaviour over time and seek disconfirming evidence. Reliability depends on provenance, completeness, accuracy, consistency, approval and fitness for the specific buyer decision.
Material gaps should be quantified and assigned an accountable owner, corrective action, required proof and decision date. Consequences flow into the model, investment case, financing, regulatory analysis, negotiation, disclosure and integration plan. The room retains the exception until evidence resolves it or authorised decision-makers explicitly accept and allocate the residual risk.
8. Reconcile financial statements to source ledgers
Tie reported revenue, costs, assets, liabilities, cash and equity to controlled accounting records and consolidation logic.
The controlled review should reconcile audited accounts, trial balances, general ledger, subledgers, journals and consolidation files. Every item records the entity, period, assertion, source, owner, authority, sensitivity, version, decision link and exception status. The immediate output is a financial-statement evidence bridge.
Testing should separate document presence from evidential sufficiency. Reviewers inspect native records, trace samples to source systems, reperform critical reconciliations, compare explanations with behaviour over time and seek disconfirming evidence. Reliability depends on provenance, completeness, accuracy, consistency, approval and fitness for the specific buyer decision.
Material gaps should be quantified and assigned an accountable owner, corrective action, required proof and decision date. Consequences flow into the model, investment case, financing, regulatory analysis, negotiation, disclosure and integration plan. The room retains the exception until evidence resolves it or authorised decision-makers explicitly accept and allocate the residual risk.
Table 1. Evidence reliability hierarchy
| Evidence class | Control test | Buyer use |
|---|---|---|
| native record | system provenance | high reliance |
| controlled report | reconciliation and approval | analytical input |
| management model | assumptions and sensitivity | scenario use |
| explanation | corroboration required | issue resolution |
Illustrative analytical design; company-specific facts and authorised advice govern.
Values are illustrative readiness indices and require transaction-specific evidence.
9. Build the quality-of-earnings evidence chain
Separate recurring performance from timing, classification, one-offs, estimates, related parties and unsupported adjustments.
The controlled review should reconcile monthly accounts, transaction detail, policies, contracts, bank records and adjustment schedules. Every item records the entity, period, assertion, source, owner, authority, sensitivity, version, decision link and exception status. The immediate output is a quality-of-earnings decision pack.
Testing should separate document presence from evidential sufficiency. Reviewers inspect native records, trace samples to source systems, reperform critical reconciliations, compare explanations with behaviour over time and seek disconfirming evidence. Reliability depends on provenance, completeness, accuracy, consistency, approval and fitness for the specific buyer decision.
Material gaps should be quantified and assigned an accountable owner, corrective action, required proof and decision date. Consequences flow into the model, investment case, financing, regulatory analysis, negotiation, disclosure and integration plan. The room retains the exception until evidence resolves it or authorised decision-makers explicitly accept and allocate the residual risk.
10. Test forecasts and operating assumptions
Trace forecast drivers to historical evidence, contracts, capacity, pipeline, resources, dependencies and management ownership.
The controlled review should reconcile integrated model, budgets, operating plans, initiatives, variance records and approvals. Every item records the entity, period, assertion, source, owner, authority, sensitivity, version, decision link and exception status. The immediate output is a forecast-assumption substantiation file.
Testing should separate document presence from evidential sufficiency. Reviewers inspect native records, trace samples to source systems, reperform critical reconciliations, compare explanations with behaviour over time and seek disconfirming evidence. Reliability depends on provenance, completeness, accuracy, consistency, approval and fitness for the specific buyer decision.
Material gaps should be quantified and assigned an accountable owner, corrective action, required proof and decision date. Consequences flow into the model, investment case, financing, regulatory analysis, negotiation, disclosure and integration plan. The room retains the exception until evidence resolves it or authorised decision-makers explicitly accept and allocate the residual risk.
11. Reconcile working capital, debt and liquidity
Explain seasonality, normalisation, cash conversion, facilities, covenant headroom, restricted cash and closing mechanics.
The controlled review should reconcile aging reports, bank statements, facility agreements, covenant certificates and cash forecasts. Every item records the entity, period, assertion, source, owner, authority, sensitivity, version, decision link and exception status. The immediate output is a working-capital and debt bridge.
Testing should separate document presence from evidential sufficiency. Reviewers inspect native records, trace samples to source systems, reperform critical reconciliations, compare explanations with behaviour over time and seek disconfirming evidence. Reliability depends on provenance, completeness, accuracy, consistency, approval and fitness for the specific buyer decision.
Material gaps should be quantified and assigned an accountable owner, corrective action, required proof and decision date. Consequences flow into the model, investment case, financing, regulatory analysis, negotiation, disclosure and integration plan. The room retains the exception until evidence resolves it or authorised decision-makers explicitly accept and allocate the residual risk.
12. Substantiate customers and revenue
Connect concentration, retention, pricing, volumes, backlog, churn and credit exposure to contracts and system evidence.
The controlled review should reconcile CRM, billing, contracts, usage, order books, collections and customer correspondence. Every item records the entity, period, assertion, source, owner, authority, sensitivity, version, decision link and exception status. The immediate output is a customer-revenue evidence cube.
Testing should separate document presence from evidential sufficiency. Reviewers inspect native records, trace samples to source systems, reperform critical reconciliations, compare explanations with behaviour over time and seek disconfirming evidence. Reliability depends on provenance, completeness, accuracy, consistency, approval and fitness for the specific buyer decision.
Material gaps should be quantified and assigned an accountable owner, corrective action, required proof and decision date. Consequences flow into the model, investment case, financing, regulatory analysis, negotiation, disclosure and integration plan. The room retains the exception until evidence resolves it or authorised decision-makers explicitly accept and allocate the residual risk.
13. Substantiate pipeline and commercial conversion
Reconcile opportunity stages, probability, timing, ownership, pricing and capacity to realised outcomes.
The controlled review should reconcile CRM histories, proposals, approvals, win-loss records, bookings and delivery plans. Every item records the entity, period, assertion, source, owner, authority, sensitivity, version, decision link and exception status. The immediate output is a pipeline-conversion evidence file.
Testing should separate document presence from evidential sufficiency. Reviewers inspect native records, trace samples to source systems, reperform critical reconciliations, compare explanations with behaviour over time and seek disconfirming evidence. Reliability depends on provenance, completeness, accuracy, consistency, approval and fitness for the specific buyer decision.
Material gaps should be quantified and assigned an accountable owner, corrective action, required proof and decision date. Consequences flow into the model, investment case, financing, regulatory analysis, negotiation, disclosure and integration plan. The room retains the exception until evidence resolves it or authorised decision-makers explicitly accept and allocate the residual risk.
14. Test pricing, margin and unit economics
Trace price, discount, mix, input cost, delivery effort and contribution economics by customer, product and channel.
The controlled review should reconcile price lists, approval logs, invoices, cost records, time data and profitability analyses. Every item records the entity, period, assertion, source, owner, authority, sensitivity, version, decision link and exception status. The immediate output is a margin-driver decision model.
Testing should separate document presence from evidential sufficiency. Reviewers inspect native records, trace samples to source systems, reperform critical reconciliations, compare explanations with behaviour over time and seek disconfirming evidence. Reliability depends on provenance, completeness, accuracy, consistency, approval and fitness for the specific buyer decision.
Material gaps should be quantified and assigned an accountable owner, corrective action, required proof and decision date. Consequences flow into the model, investment case, financing, regulatory analysis, negotiation, disclosure and integration plan. The room retains the exception until evidence resolves it or authorised decision-makers explicitly accept and allocate the residual risk.
15. Map contracts and obligations
Identify change of control, assignment, termination, renewal, exclusivity, liability, service levels and hidden commitments.
The controlled review should reconcile contract repository, amendments, side letters, correspondence, claims and obligation registers. Every item records the entity, period, assertion, source, owner, authority, sensitivity, version, decision link and exception status. The immediate output is a contract-rights and obligations map.
Testing should separate document presence from evidential sufficiency. Reviewers inspect native records, trace samples to source systems, reperform critical reconciliations, compare explanations with behaviour over time and seek disconfirming evidence. Reliability depends on provenance, completeness, accuracy, consistency, approval and fitness for the specific buyer decision.
Material gaps should be quantified and assigned an accountable owner, corrective action, required proof and decision date. Consequences flow into the model, investment case, financing, regulatory analysis, negotiation, disclosure and integration plan. The room retains the exception until evidence resolves it or authorised decision-makers explicitly accept and allocate the residual risk.
16. Prove intellectual property and technology ownership
Trace creation, assignment, licences, open-source use, architecture, dependencies and roadmap claims to controlled evidence.
The controlled review should reconcile registrations, employment terms, repositories, scans, licences, architecture records and release histories. Every item records the entity, period, assertion, source, owner, authority, sensitivity, version, decision link and exception status. The immediate output is an IP and technology evidence pack.
Testing should separate document presence from evidential sufficiency. Reviewers inspect native records, trace samples to source systems, reperform critical reconciliations, compare explanations with behaviour over time and seek disconfirming evidence. Reliability depends on provenance, completeness, accuracy, consistency, approval and fitness for the specific buyer decision.
Material gaps should be quantified and assigned an accountable owner, corrective action, required proof and decision date. Consequences flow into the model, investment case, financing, regulatory analysis, negotiation, disclosure and integration plan. The room retains the exception until evidence resolves it or authorised decision-makers explicitly accept and allocate the residual risk.
Table 2. Request-to-decision linkage
| Request | Assertion tested | Decision |
|---|---|---|
| customer cohort | revenue durability | valuation case |
| facility terms | liquidity headroom | financing |
| IP assignments | ownership and control | closing condition |
| incident register | risk and remediation | protection |
Illustrative analytical design; company-specific facts and authorised advice govern.
Values are illustrative readiness indices and require transaction-specific evidence.
17. Control cyber, privacy and data evidence
Show governance, assets, incidents, controls, testing, data rights, lawful sharing and remediation without exposing unnecessary personal data.
The controlled review should reconcile security inventories, assessments, logs, incident records, privacy registers, contracts and technical tests. Every item records the entity, period, assertion, source, owner, authority, sensitivity, version, decision link and exception status. The immediate output is a controlled cyber-and-data diligence room.
Testing should separate document presence from evidential sufficiency. Reviewers inspect native records, trace samples to source systems, reperform critical reconciliations, compare explanations with behaviour over time and seek disconfirming evidence. Reliability depends on provenance, completeness, accuracy, consistency, approval and fitness for the specific buyer decision.
Material gaps should be quantified and assigned an accountable owner, corrective action, required proof and decision date. Consequences flow into the model, investment case, financing, regulatory analysis, negotiation, disclosure and integration plan. The room retains the exception until evidence resolves it or authorised decision-makers explicitly accept and allocate the residual risk.
18. Reconcile workforce and key-person evidence
Connect headcount, roles, skills, incentives, attrition, disputes, succession and workforce cost to source records.
The controlled review should reconcile HR systems, payroll, contracts, surveys, performance records and succession plans. Every item records the entity, period, assertion, source, owner, authority, sensitivity, version, decision link and exception status. The immediate output is a people and continuity evidence file.
Testing should separate document presence from evidential sufficiency. Reviewers inspect native records, trace samples to source systems, reperform critical reconciliations, compare explanations with behaviour over time and seek disconfirming evidence. Reliability depends on provenance, completeness, accuracy, consistency, approval and fitness for the specific buyer decision.
Material gaps should be quantified and assigned an accountable owner, corrective action, required proof and decision date. Consequences flow into the model, investment case, financing, regulatory analysis, negotiation, disclosure and integration plan. The room retains the exception until evidence resolves it or authorised decision-makers explicitly accept and allocate the residual risk.
19. Map licences and regulatory permissions
Prove which activities, entities, products, people and jurisdictions depend on each approval and the consequences of change.
The controlled review should reconcile licences, filings, correspondence, inspections, conditions and compliance attestations. Every item records the entity, period, assertion, source, owner, authority, sensitivity, version, decision link and exception status. The immediate output is a regulatory-permissions decision map.
Testing should separate document presence from evidential sufficiency. Reviewers inspect native records, trace samples to source systems, reperform critical reconciliations, compare explanations with behaviour over time and seek disconfirming evidence. Reliability depends on provenance, completeness, accuracy, consistency, approval and fitness for the specific buyer decision.
Material gaps should be quantified and assigned an accountable owner, corrective action, required proof and decision date. Consequences flow into the model, investment case, financing, regulatory analysis, negotiation, disclosure and integration plan. The room retains the exception until evidence resolves it or authorised decision-makers explicitly accept and allocate the residual risk.
20. Evidence compliance in operation
Test whether policies, risk assessments, training, controls, investigations and remediation work in practice.
The controlled review should reconcile case files, monitoring, audits, third-party records, attestations and remediation evidence. Every item records the entity, period, assertion, source, owner, authority, sensitivity, version, decision link and exception status. The immediate output is an operating-compliance evidence pack.
Testing should separate document presence from evidential sufficiency. Reviewers inspect native records, trace samples to source systems, reperform critical reconciliations, compare explanations with behaviour over time and seek disconfirming evidence. Reliability depends on provenance, completeness, accuracy, consistency, approval and fitness for the specific buyer decision.
Material gaps should be quantified and assigned an accountable owner, corrective action, required proof and decision date. Consequences flow into the model, investment case, financing, regulatory analysis, negotiation, disclosure and integration plan. The room retains the exception until evidence resolves it or authorised decision-makers explicitly accept and allocate the residual risk.
21. Reconcile tax positions
Map registrations, filings, elections, losses, transfer pricing, indirect taxes, disputes and transaction consequences by entity and jurisdiction.
The controlled review should reconcile returns, computations, correspondence, rulings, policies and tax ledgers. Every item records the entity, period, assertion, source, owner, authority, sensitivity, version, decision link and exception status. The immediate output is a tax-position reconciliation.
Testing should separate document presence from evidential sufficiency. Reviewers inspect native records, trace samples to source systems, reperform critical reconciliations, compare explanations with behaviour over time and seek disconfirming evidence. Reliability depends on provenance, completeness, accuracy, consistency, approval and fitness for the specific buyer decision.
Material gaps should be quantified and assigned an accountable owner, corrective action, required proof and decision date. Consequences flow into the model, investment case, financing, regulatory analysis, negotiation, disclosure and integration plan. The room retains the exception until evidence resolves it or authorised decision-makers explicitly accept and allocate the residual risk.
22. Map litigation, claims and contingent liabilities
Connect disputes, investigations, provisions, insurance, remedies and scenario exposure to source evidence and legal advice.
The controlled review should reconcile case registers, pleadings, correspondence, accounting records and insurance notices. Every item records the entity, period, assertion, source, owner, authority, sensitivity, version, decision link and exception status. The immediate output is a claims-and-contingencies decision file.
Testing should separate document presence from evidential sufficiency. Reviewers inspect native records, trace samples to source systems, reperform critical reconciliations, compare explanations with behaviour over time and seek disconfirming evidence. Reliability depends on provenance, completeness, accuracy, consistency, approval and fitness for the specific buyer decision.
Material gaps should be quantified and assigned an accountable owner, corrective action, required proof and decision date. Consequences flow into the model, investment case, financing, regulatory analysis, negotiation, disclosure and integration plan. The room retains the exception until evidence resolves it or authorised decision-makers explicitly accept and allocate the residual risk.
23. Substantiate sustainability and conduct claims
Trace material environmental, social, governance and conduct assertions to definitions, boundaries, methods, controls and funded plans.
The controlled review should reconcile reports, metrics, source data, methodologies, audits, incidents and board approvals. Every item records the entity, period, assertion, source, owner, authority, sensitivity, version, decision link and exception status. The immediate output is a sustainability-claims evidence register.
Testing should separate document presence from evidential sufficiency. Reviewers inspect native records, trace samples to source systems, reperform critical reconciliations, compare explanations with behaviour over time and seek disconfirming evidence. Reliability depends on provenance, completeness, accuracy, consistency, approval and fitness for the specific buyer decision.
Material gaps should be quantified and assigned an accountable owner, corrective action, required proof and decision date. Consequences flow into the model, investment case, financing, regulatory analysis, negotiation, disclosure and integration plan. The room retains the exception until evidence resolves it or authorised decision-makers explicitly accept and allocate the residual risk.
24. Prove operating performance and resilience
Connect capacity, service, quality, safety, downtime, incidents and recovery capability to commercial and financial outcomes.
The controlled review should reconcile operating systems, maintenance, service records, quality logs, incidents and continuity tests. Every item records the entity, period, assertion, source, owner, authority, sensitivity, version, decision link and exception status. The immediate output is an operating-resilience evidence pack.
Testing should separate document presence from evidential sufficiency. Reviewers inspect native records, trace samples to source systems, reperform critical reconciliations, compare explanations with behaviour over time and seek disconfirming evidence. Reliability depends on provenance, completeness, accuracy, consistency, approval and fitness for the specific buyer decision.
Material gaps should be quantified and assigned an accountable owner, corrective action, required proof and decision date. Consequences flow into the model, investment case, financing, regulatory analysis, negotiation, disclosure and integration plan. The room retains the exception until evidence resolves it or authorised decision-makers explicitly accept and allocate the residual risk.
Table 3. Permission architecture
| Tier | Typical content | Control |
|---|---|---|
| core bidder | standard diligence set | NDA and logging |
| clean team | competition-sensitive data | restricted membership |
| specialist | bounded technical evidence | purpose-limited access |
| confirmatory | high-sensitivity items | late-stage approval |
Illustrative analytical design; company-specific facts and authorised advice govern.
Values are illustrative readiness indices and require transaction-specific evidence.
25. Reconcile assets, capex and maintenance
Prove ownership, condition, utilisation, commitments, useful lives, maintenance backlog and investment requirements.
The controlled review should reconcile fixed-asset registers, titles, inspections, capex approvals, invoices and maintenance systems. Every item records the entity, period, assertion, source, owner, authority, sensitivity, version, decision link and exception status. The immediate output is an asset-and-capex decision model.
Testing should separate document presence from evidential sufficiency. Reviewers inspect native records, trace samples to source systems, reperform critical reconciliations, compare explanations with behaviour over time and seek disconfirming evidence. Reliability depends on provenance, completeness, accuracy, consistency, approval and fitness for the specific buyer decision.
Material gaps should be quantified and assigned an accountable owner, corrective action, required proof and decision date. Consequences flow into the model, investment case, financing, regulatory analysis, negotiation, disclosure and integration plan. The room retains the exception until evidence resolves it or authorised decision-makers explicitly accept and allocate the residual risk.
26. Map supply-chain and third-party exposure
Trace concentration, performance, substitution, sanctions, cyber, continuity and contractual protections across material dependencies.
The controlled review should reconcile supplier masters, contracts, spend, performance, assessments, incidents and alternatives. Every item records the entity, period, assertion, source, owner, authority, sensitivity, version, decision link and exception status. The immediate output is a third-party dependency map.
Testing should separate document presence from evidential sufficiency. Reviewers inspect native records, trace samples to source systems, reperform critical reconciliations, compare explanations with behaviour over time and seek disconfirming evidence. Reliability depends on provenance, completeness, accuracy, consistency, approval and fitness for the specific buyer decision.
Material gaps should be quantified and assigned an accountable owner, corrective action, required proof and decision date. Consequences flow into the model, investment case, financing, regulatory analysis, negotiation, disclosure and integration plan. The room retains the exception until evidence resolves it or authorised decision-makers explicitly accept and allocate the residual risk.
27. Reconcile insurance and risk transfer
Test coverage, exclusions, limits, deductibles, claims, notifications and change-of-control effects against material exposures.
The controlled review should reconcile policies, schedules, broker advice, claims histories, notices and risk registers. Every item records the entity, period, assertion, source, owner, authority, sensitivity, version, decision link and exception status. The immediate output is an insurance-coverage gap analysis.
Testing should separate document presence from evidential sufficiency. Reviewers inspect native records, trace samples to source systems, reperform critical reconciliations, compare explanations with behaviour over time and seek disconfirming evidence. Reliability depends on provenance, completeness, accuracy, consistency, approval and fitness for the specific buyer decision.
Material gaps should be quantified and assigned an accountable owner, corrective action, required proof and decision date. Consequences flow into the model, investment case, financing, regulatory analysis, negotiation, disclosure and integration plan. The room retains the exception until evidence resolves it or authorised decision-makers explicitly accept and allocate the residual risk.
28. Identify related parties and conflicts
Map ownership, control, relationships, transactions, balances, approvals and non-arm's-length economics.
The controlled review should reconcile registers, contracts, ledgers, board records, declarations and correspondence. Every item records the entity, period, assertion, source, owner, authority, sensitivity, version, decision link and exception status. The immediate output is a related-party and conflict ledger.
Testing should separate document presence from evidential sufficiency. Reviewers inspect native records, trace samples to source systems, reperform critical reconciliations, compare explanations with behaviour over time and seek disconfirming evidence. Reliability depends on provenance, completeness, accuracy, consistency, approval and fitness for the specific buyer decision.
Material gaps should be quantified and assigned an accountable owner, corrective action, required proof and decision date. Consequences flow into the model, investment case, financing, regulatory analysis, negotiation, disclosure and integration plan. The room retains the exception until evidence resolves it or authorised decision-makers explicitly accept and allocate the residual risk.
29. Prove governance and decision authority
Connect formal delegations, committees and reserved matters to observed decisions, challenge, escalation and follow-through.
The controlled review should reconcile constitutions, authorities, agendas, minutes, approvals, action logs and system permissions. Every item records the entity, period, assertion, source, owner, authority, sensitivity, version, decision link and exception status. The immediate output is a governance operating-evidence file.
Testing should separate document presence from evidential sufficiency. Reviewers inspect native records, trace samples to source systems, reperform critical reconciliations, compare explanations with behaviour over time and seek disconfirming evidence. Reliability depends on provenance, completeness, accuracy, consistency, approval and fitness for the specific buyer decision.
Material gaps should be quantified and assigned an accountable owner, corrective action, required proof and decision date. Consequences flow into the model, investment case, financing, regulatory analysis, negotiation, disclosure and integration plan. The room retains the exception until evidence resolves it or authorised decision-makers explicitly accept and allocate the residual risk.
30. Design redaction and privacy controls
Apply purpose limitation, minimisation, privilege, confidentiality, competition sensitivity and staged disclosure to every evidence class.
The controlled review should reconcile data maps, legal bases, clean-team protocols, redaction rules and access logs. Every item records the entity, period, assertion, source, owner, authority, sensitivity, version, decision link and exception status. The immediate output is a defensible disclosure-control matrix.
Testing should separate document presence from evidential sufficiency. Reviewers inspect native records, trace samples to source systems, reperform critical reconciliations, compare explanations with behaviour over time and seek disconfirming evidence. Reliability depends on provenance, completeness, accuracy, consistency, approval and fitness for the specific buyer decision.
Material gaps should be quantified and assigned an accountable owner, corrective action, required proof and decision date. Consequences flow into the model, investment case, financing, regulatory analysis, negotiation, disclosure and integration plan. The room retains the exception until evidence resolves it or authorised decision-makers explicitly accept and allocate the residual risk.
31. Design permission tiers and clean teams
Segment bidders, advisers, lenders, specialists and management by need, conflict, sensitivity and transaction stage.
The controlled review should reconcile user rosters, confidentiality terms, conflicts, access policies and activity logs. Every item records the entity, period, assertion, source, owner, authority, sensitivity, version, decision link and exception status. The immediate output is a tiered access architecture.
Testing should separate document presence from evidential sufficiency. Reviewers inspect native records, trace samples to source systems, reperform critical reconciliations, compare explanations with behaviour over time and seek disconfirming evidence. Reliability depends on provenance, completeness, accuracy, consistency, approval and fitness for the specific buyer decision.
Material gaps should be quantified and assigned an accountable owner, corrective action, required proof and decision date. Consequences flow into the model, investment case, financing, regulatory analysis, negotiation, disclosure and integration plan. The room retains the exception until evidence resolves it or authorised decision-makers explicitly accept and allocate the residual risk.
32. Control the Q&A workflow
Route questions to accountable owners, preserve source linkage, approve responses, record commitments and close follow-ups.
The controlled review should reconcile question logs, response drafts, approvals, evidence links and issue records. Every item records the entity, period, assertion, source, owner, authority, sensitivity, version, decision link and exception status. The immediate output is a controlled diligence Q&A ledger.
Testing should separate document presence from evidential sufficiency. Reviewers inspect native records, trace samples to source systems, reperform critical reconciliations, compare explanations with behaviour over time and seek disconfirming evidence. Reliability depends on provenance, completeness, accuracy, consistency, approval and fitness for the specific buyer decision.
Material gaps should be quantified and assigned an accountable owner, corrective action, required proof and decision date. Consequences flow into the model, investment case, financing, regulatory analysis, negotiation, disclosure and integration plan. The room retains the exception until evidence resolves it or authorised decision-makers explicitly accept and allocate the residual risk.
Table 4. Q&A control gates
| Gate | Required evidence | Failure signal |
|---|---|---|
| received | question and decision link | unclear purpose |
| drafted | source-linked answer | unsupported assertion |
| approved | accountable sign-off | inconsistent position |
| closed | buyer acceptance and record | repeat follow-up |
Illustrative analytical design; company-specific facts and authorised advice govern.
Values are illustrative readiness indices and require transaction-specific evidence.
33. Establish version and change control
Keep one authoritative item, record replacements, reconcile changed facts and notify affected analyses and users.
The controlled review should reconcile document identifiers, hashes, timestamps, supersession records, change logs and alerts. Every item records the entity, period, assertion, source, owner, authority, sensitivity, version, decision link and exception status. The immediate output is an evidence change-control register.
Testing should separate document presence from evidential sufficiency. Reviewers inspect native records, trace samples to source systems, reperform critical reconciliations, compare explanations with behaviour over time and seek disconfirming evidence. Reliability depends on provenance, completeness, accuracy, consistency, approval and fitness for the specific buyer decision.
Material gaps should be quantified and assigned an accountable owner, corrective action, required proof and decision date. Consequences flow into the model, investment case, financing, regulatory analysis, negotiation, disclosure and integration plan. The room retains the exception until evidence resolves it or authorised decision-makers explicitly accept and allocate the residual risk.
34. Operate an exception and issue system
Convert missing, inconsistent, late or adverse evidence into quantified issues with owners, dates and transaction consequences.
The controlled review should reconcile gap logs, risk ratings, scenarios, remediation plans and decision records. Every item records the entity, period, assertion, source, owner, authority, sensitivity, version, decision link and exception status. The immediate output is a decision-linked issue register.
Testing should separate document presence from evidential sufficiency. Reviewers inspect native records, trace samples to source systems, reperform critical reconciliations, compare explanations with behaviour over time and seek disconfirming evidence. Reliability depends on provenance, completeness, accuracy, consistency, approval and fitness for the specific buyer decision.
Material gaps should be quantified and assigned an accountable owner, corrective action, required proof and decision date. Consequences flow into the model, investment case, financing, regulatory analysis, negotiation, disclosure and integration plan. The room retains the exception until evidence resolves it or authorised decision-makers explicitly accept and allocate the residual risk.
35. Govern analytics and AI-assisted review
Use extraction, classification, reconciliation and anomaly detection with human review, provenance, security and reproducibility.
The controlled review should reconcile approved tools, prompts, access controls, validation samples, logs and reviewer sign-off. Every item records the entity, period, assertion, source, owner, authority, sensitivity, version, decision link and exception status. The immediate output is a controlled diligence-analytics protocol.
Testing should separate document presence from evidential sufficiency. Reviewers inspect native records, trace samples to source systems, reperform critical reconciliations, compare explanations with behaviour over time and seek disconfirming evidence. Reliability depends on provenance, completeness, accuracy, consistency, approval and fitness for the specific buyer decision.
Material gaps should be quantified and assigned an accountable owner, corrective action, required proof and decision date. Consequences flow into the model, investment case, financing, regulatory analysis, negotiation, disclosure and integration plan. The room retains the exception until evidence resolves it or authorised decision-makers explicitly accept and allocate the residual risk.
36. Prepare management presentations from evidence
Build a coherent narrative whose claims, exhibits and forecast answers link directly to governed evidence.
The controlled review should reconcile presentation drafts, evidence citations, rehearsals, Q&A bank and approval records. Every item records the entity, period, assertion, source, owner, authority, sensitivity, version, decision link and exception status. The immediate output is an evidence-backed management presentation.
Testing should separate document presence from evidential sufficiency. Reviewers inspect native records, trace samples to source systems, reperform critical reconciliations, compare explanations with behaviour over time and seek disconfirming evidence. Reliability depends on provenance, completeness, accuracy, consistency, approval and fitness for the specific buyer decision.
Material gaps should be quantified and assigned an accountable owner, corrective action, required proof and decision date. Consequences flow into the model, investment case, financing, regulatory analysis, negotiation, disclosure and integration plan. The room retains the exception until evidence resolves it or authorised decision-makers explicitly accept and allocate the residual risk.
37. Create buyer-specific decision views
Present the same controlled evidence through strategic, financial, financing, regulatory and integration lenses without creating inconsistent facts.
The controlled review should reconcile decision maps, permission rules, dashboards, issue views and export controls. Every item records the entity, period, assertion, source, owner, authority, sensitivity, version, decision link and exception status. The immediate output is buyer-specific controlled views.
Testing should separate document presence from evidential sufficiency. Reviewers inspect native records, trace samples to source systems, reperform critical reconciliations, compare explanations with behaviour over time and seek disconfirming evidence. Reliability depends on provenance, completeness, accuracy, consistency, approval and fitness for the specific buyer decision.
Material gaps should be quantified and assigned an accountable owner, corrective action, required proof and decision date. Consequences flow into the model, investment case, financing, regulatory analysis, negotiation, disclosure and integration plan. The room retains the exception until evidence resolves it or authorised decision-makers explicitly accept and allocate the residual risk.
38. Run a buyer-readiness simulation
Test whether representative questions can be answered accurately, quickly and consistently from the room under timed conditions.
The controlled review should reconcile mock requests, user tests, response times, errors, follow-ups and management observation. Every item records the entity, period, assertion, source, owner, authority, sensitivity, version, decision link and exception status. The immediate output is a data-room readiness test report.
Testing should separate document presence from evidential sufficiency. Reviewers inspect native records, trace samples to source systems, reperform critical reconciliations, compare explanations with behaviour over time and seek disconfirming evidence. Reliability depends on provenance, completeness, accuracy, consistency, approval and fitness for the specific buyer decision.
Material gaps should be quantified and assigned an accountable owner, corrective action, required proof and decision date. Consequences flow into the model, investment case, financing, regulatory analysis, negotiation, disclosure and integration plan. The room retains the exception until evidence resolves it or authorised decision-makers explicitly accept and allocate the residual risk.
39. Connect findings to disclosure and protection
Translate residual uncertainty into disclosure schedules, conditions, covenants, price mechanisms, indemnities, escrow and integration actions.
The controlled review should reconcile issue register, quantification, legal analysis, negotiation positions and draft documents. Every item records the entity, period, assertion, source, owner, authority, sensitivity, version, decision link and exception status. The immediate output is a risk-to-remedy options paper.
Testing should separate document presence from evidential sufficiency. Reviewers inspect native records, trace samples to source systems, reperform critical reconciliations, compare explanations with behaviour over time and seek disconfirming evidence. Reliability depends on provenance, completeness, accuracy, consistency, approval and fitness for the specific buyer decision.
Material gaps should be quantified and assigned an accountable owner, corrective action, required proof and decision date. Consequences flow into the model, investment case, financing, regulatory analysis, negotiation, disclosure and integration plan. The room retains the exception until evidence resolves it or authorised decision-makers explicitly accept and allocate the residual risk.
40. Issue the evidence-room conclusion and archive
Confirm completeness, decision coverage, provenance, access, open issues, reliance limits, retention and authorised closure.
The controlled review should reconcile master index, decision graph, access logs, exceptions, approvals and archive records. Every item records the entity, period, assertion, source, owner, authority, sensitivity, version, decision link and exception status. The immediate output is a buyer-ready evidence-room assurance report.
Testing should separate document presence from evidential sufficiency. Reviewers inspect native records, trace samples to source systems, reperform critical reconciliations, compare explanations with behaviour over time and seek disconfirming evidence. Reliability depends on provenance, completeness, accuracy, consistency, approval and fitness for the specific buyer decision.
Material gaps should be quantified and assigned an accountable owner, corrective action, required proof and decision date. Consequences flow into the model, investment case, financing, regulatory analysis, negotiation, disclosure and integration plan. The room retains the exception until evidence resolves it or authorised decision-makers explicitly accept and allocate the residual risk.
Table 5. Buyer-ready room certificate
| Gate | Required proof | Decision use |
|---|---|---|
| complete | perimeter and inventory reconciled | coverage |
| traceable | source-to-decision links | reliance |
| controlled | access, version and Q&A logs | confidentiality |
| actionable | issues quantified and allocated | transaction design |
Illustrative analytical design; company-specific facts and authorised advice govern.
Values are illustrative readiness indices and require transaction-specific evidence.
References
- Financial Reporting Council, ISA UK 500 Audit Evidence, updated September 2025, https://www.frc.org.uk/library/standards-codes-policy/audit-assurance-and-ethics/auditing-standards/isa-uk-500/
- Information Commissioner's Office, Due diligence when sharing data following mergers and acquisitions, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/due-diligence/
- US Department of Justice, Evaluation of Corporate Compliance Programs, September 2024, https://www.justice.gov/criminal/criminal-fraud/page/file/937501
- IFRS Foundation, IFRS 3 Business Combinations, https://www.ifrs.org/issued-standards/list-of-standards/ifrs-3-business-combinations/
- IFRS Foundation, IFRS 15 Revenue from Contracts with Customers, https://www.ifrs.org/issued-standards/list-of-standards/ifrs-15-revenue-from-contracts-with-customers/
- IFRS Foundation, IAS 7 Statement of Cash Flows, https://www.ifrs.org/issued-standards/list-of-standards/ias-7-statement-of-cash-flows/
- IFRS Foundation, IAS 24 Related Party Disclosures, https://www.ifrs.org/issued-standards/list-of-standards/ias-24-related-party-disclosures/
- IFRS Foundation, IAS 36 Impairment of Assets, https://www.ifrs.org/issued-standards/list-of-standards/ias-36-impairment-of-assets/
- IFRS Foundation, IAS 37 Provisions Contingent Liabilities and Contingent Assets, https://www.ifrs.org/issued-standards/list-of-standards/ias-37-provisions-contingent-liabilities-and-contingent-assets/
- US Securities and Exchange Commission, Regulation S-K, https://www.sec.gov/rules-regulations/staff-guidance/corporation-finance-interpretations/regulation-s-k
- US Securities and Exchange Commission, Cybersecurity Risk Management Strategy Governance and Incident Disclosure, https://www.sec.gov/rules-regulations/2023/07/s7-09-22
- Public Company Accounting Oversight Board, AS 1105 Audit Evidence, https://pcaobus.org/oversight/standards/auditing-standards/details/AS1105
- National Institute of Standards and Technology, Cybersecurity Framework 2.0, https://doi.org/10.6028/NIST.CSWP.29
- National Institute of Standards and Technology, AI Risk Management Framework, https://www.nist.gov/itl/ai-risk-management-framework
- International Organization for Standardization, ISO IEC 27001 Information Security Management Systems, https://www.iso.org/isoiec-27001-information-security.html
- International Organization for Standardization, ISO 31000 Risk Management Guidelines, https://www.iso.org/iso-31000-risk-management.html
- COSO, Internal Control Integrated Framework, https://www.coso.org/guidance-on-ic
- UK Government, Data Protection Act 2018, https://www.legislation.gov.uk/ukpga/2018/12/contents
- European Union, General Data Protection Regulation, https://eur-lex.europa.eu/eli/reg/2016/679/oj
- UK Government, Companies Act 2006, https://www.legislation.gov.uk/ukpga/2006/46/contents
- UK Government, Bribery Act 2010, https://www.legislation.gov.uk/ukpga/2010/23/contents
- US Department of Justice and US Securities and Exchange Commission, A Resource Guide to the US Foreign Corrupt Practices Act, https://www.justice.gov/criminal/criminal-fraud/file/1292051/dl
- UK Competition and Markets Authority, Merger Assessment Guidelines, updated June 2026, https://www.gov.uk/government/publications/merger-assessment-guidelines/merger-assessment-guidelines-html-version
- US Federal Trade Commission, HSR Notification Forms Instructions and Guidance, https://www.ftc.gov/enforcement/premerger-notification-program/hsr-notification-forms-instructions-guidance
- UK Takeover Panel, The Takeover Code, https://www.thetakeoverpanel.org.uk/the-code/download-code
- International Auditing and Assurance Standards Board, ISA 500 Audit Evidence, https://www.iaasb.org/publications/international-standard-auditing-isa-500-audit-evidence
