1. Define investibility as an evidence condition
Investibility begins when an external decision-maker can understand the enterprise, test management's claims and price the remaining uncertainty. An investor needs reliable ownership, governance, economics and risk evidence. A lender needs authority, cash-flow support, security and covenant capacity. A buyer needs those elements plus transferability after ownership changes. A family business may possess each underlying strength and still lose momentum when the evidence is incomplete, inconsistent or difficult to retrieve.
The problem often appears late. After an indicative offer, management may discover inconsistent ownership records, unsigned contracts, unexplained related-party balances, unreconciled revenue, outdated licences or undocumented intellectual property. Each gap creates delay and negotiation leverage for the counterparty.
A digital due-diligence pack is an operating control. It links each material assertion to a current source, owner and reconciliation. It records open issues, closure actions and access to personal, commercially sensitive or privileged information. The pack is a governed evidence system.
The 90-day objective is to reconcile decision-critical evidence, resolve high-severity defects and prepare transparent disclosure for residual issues before the board's transaction decision.
Investment readiness connects ownership, authority, economics, operations and risk through one controlled evidence layer.
2. Establish the legal and governance perimeter
The evidence pack must begin with the actual legal group. Management should list every operating company, holding company, branch, partnership, special-purpose vehicle and material joint venture. Each entity should be linked to its licence, constitutional documents, registered address, capital, shareholders, directors or managers, authorised signatories and current status. The chart should distinguish legal ownership from management reporting lines.
Federal Decree-Law No. 37 of 2022 Concerning Family Businesses provides a UAE framework for family-business ownership and governance. Its objectives include continuity, intergenerational transfer and an inclusive legal framework for ownership and governance. The law permits a family charter to address ownership, objectives, values, share valuation, profit distribution, family-member education and dispute mechanisms. The constitutional documents and applicable legislation remain decisive where a conflict exists.
The law also addresses management. A family company may appoint one or more managers and, for a family limited liability company, may establish a board subject to its constitutional documents. The due-diligence pack should therefore show the authority that exists today, rather than the authority family members assume exists. Board resolutions, powers of attorney, bank mandates, delegated limits and system roles should reconcile with the memorandum and commercial registration.
The perimeter should include family-governance documents when they affect decision-making, transfer rights, employment, distributions or succession. Qualified counsel should confirm how the charter, constitutional documents and applicable rules interact.
Table 1. Authoritative obligations and the evidence response
| Authority | Verified principle | Evidence response | Diligence question answered |
|---|---|---|---|
| UAE Federal Decree-Law No. 37 of 2022 | family-business continuity, governance, charter, management and smooth transition | constitutional documents, charter, governance rules, manager or board evidence and succession arrangements | how is ownership governed and how can the enterprise continue across generations? |
| UAE Cabinet Resolution No. 109 of 2023 | legal persons within scope maintain adequate, accurate and current real-beneficiary information and registers | ownership chain, shareholder register, real-beneficiary register, identity support and change log | who ultimately owns or controls the enterprise? |
| UAE Corporate Tax guidance | records should support return information and relevant records are retained for at least seven years | tax registrations, returns, elections, reconciliations, ledgers, asset and liability records and retention schedule | can tax filings be traced to reliable accounting evidence? |
| IAS 24 | financial statements disclose relevant related-party relationships, transactions, balances and commitments | related-party universe, transaction ledger, terms, balances, approvals and disclosure reconciliation | have family and group dealings affected earnings, cash or obligations? |
| G20/OECD Principles 2023 | material ownership, related-party transactions, foreseeable risks and governance should be transparent | board materials, ownership map, conflicts register, risk register and material disclosures | can an investor evaluate control, conflicts and material risk? |
| UAE Personal Data Protection Law | personal-data processing should be lawful, fair, purpose-specific, limited, accurate and secured | data inventory, disclosure basis, redaction, access rules, retention, processor terms and incident process | is sensitive diligence disclosure controlled lawfully and proportionately? |
Application depends on the entity, jurisdiction, transaction and current official text; qualified advisers should confirm the legal position.
3. Reconcile ownership, control and real beneficiaries
Ownership evidence should be traceable from the operating company to the natural person who ultimately owns or controls it. Cabinet Resolution No. 109 of 2023 defines the real-beneficiary test through direct or indirect ownership or voting rights of 25 per cent or more, control through other means, and a senior-management fallback where no natural person can be identified after the prescribed analysis. It also requires appropriate, accurate and current information and updates to the register when changes occur.
The ownership workstream should compare the commercial register, memorandum, share certificates, shareholder register, real-beneficiary register, nominee arrangements, trust or foundation records where applicable, shareholder agreements, inheritance documents and cap table. Differences should be recorded, investigated and resolved through the competent authority and qualified counsel. A spreadsheet cap table alone does not establish title.
Control can differ from economics. Reserved matters, voting agreements, board-appointment rights, vetoes, usufruct, pledges, options and family arrangements can shape control. The map should show direct ownership, indirect ownership, voting rights and governance rights separately. It should identify encumbrances and restrictions on transfer.
FATF's Recommendation 24 guidance supports adequate, accurate and current beneficial-ownership information. The G20/OECD Principles also connect ownership transparency with investor protection and conflict identification.
The map separates economic rights, voting control, governance power and operating authority before they are brought into one evidence chain.
4. Build the authority and decision map
An investor needs to know that the company has been validly directed and can execute the proposed transaction. The authority map should connect shareholder reserved matters, board powers, manager powers, committees, delegated limits, bank mandates, procurement authority, pricing exceptions, employment decisions, contract execution, litigation, guarantees and asset disposals.
The review should test documents and practice. Resolutions, actual payment permissions, informal family roles and board delegations can differ. Those differences should be corrected or disclosed.
Minutes and written resolutions should evidence material decisions. The pack should include an index showing date, approving body, subject, authority basis and document location. Conflicts should be recorded and handled under the applicable documents and law. Related-party decisions deserve particular attention because family, ownership and management roles can overlap.
Before outreach, counsel should confirm who can appoint advisers, approve disclosure, receive offers, negotiate, grant exclusivity and sign definitive documents, including required third-party or regulatory consents.
5. Design a secure digital data-room architecture
The data room should mirror how a decision-maker evaluates the company. A practical top level covers corporate and ownership; finance; tax; commercial; operations; people; contracts; intellectual property; technology and data; regulatory; property and assets; disputes and insurance; environment and sustainability; and transaction materials. Each folder should have an owner and an index.
Every file needs a meaningful name, date, status and version. Drafts should be separated from executed documents. The index should show entity, period, owner, source, confidentiality, review date and open issue. Missing-document placeholders should explain the gap and action.
Access should be granted by role and purpose. NIST SP 800-207 describes zero trust as a resource-focused approach in which access is not granted implicitly through network location or ownership. Authentication and authorisation precede access, and privileges are limited to the requirement. For diligence, this supports named users, strong authentication, least privilege, staged folders, watermarking where appropriate, access logs and prompt revocation.
The UAE Personal Data Protection Law requires fair, lawful, purpose-specific, limited, accurate and secured processing. Employment files, identity records, compensation, medical information and customer contacts should be minimised, redacted or aggregated. A data-protection specialist should confirm disclosure, cross-border transfer, processor and retention requirements.
Documents move from source validation through controlled disclosure, with sensitivity increasing toward the centre.
Table 2. Core digital data-room index
| Workstream | Core evidence | Reconciliation | Release control |
|---|---|---|---|
| corporate and ownership | licences, memorandum, amendments, registers, certificates, UBO evidence, agreements and encumbrances | legal group chart to registers and constitutional documents | identity redaction and restricted ownership support |
| governance and authority | board and shareholder minutes, delegations, powers, mandates, conflicts and approvals | decisions to authority basis and actual system permissions | privileged review and staged transaction approvals |
| finance and debt | audited statements, management accounts, trial balance, ledgers, cash, facilities, covenants and security | statements to trial balance, management accounts, bank and debt schedules | lender-confidential documents and read-only models |
| tax | registrations, returns, assessments, transfer-pricing support, reconciliations and correspondence | returns to ledgers, related parties and statutory accounts | tax-identification redaction and adviser privilege review |
| commercial | customer and supplier contracts, revenue data, pipeline, concentration, pricing and churn | contracts and billing data to revenue and receivables | staged names, pricing and personal contact data |
| operations and assets | process maps, licences, assets, property, inventory, quality, insurance and incidents | asset register to ledger, insurance, ownership and condition | site, security and commercially sensitive controls |
| people and succession | organisation, roles, employment terms, compensation, benefits, disputes and continuity | headcount to payroll, ledger, visas and employment records | aggregated disclosure before named restricted files |
| IP, technology and data | IP register, assignments, software, architecture, cyber, privacy, backups and incidents | registered and used IP to contracts, staff and systems | least privilege, redaction and technical-room access |
The index should be tailored to the company, transaction and confidentiality restrictions.
6. Create a single financial evidence chain
Financial diligence should trace the reported result from source systems to statutory accounts, management reporting, tax returns and cash. The company should retain the trial balance for each period, consolidation and elimination entries, chart of accounts, monthly management accounts, audited financial statements, general-ledger detail, bank reconciliations and key schedules. Periods and entities should align.
Management should document every bridge: audited revenue to ledger and customer analysis; payroll to headcount and cash; debt to lender records and covenants; and fixed assets to purchases, disposals, physical evidence and title.
UAE Corporate Tax guidance states that taxable persons should retain records and documents that support information in their returns. The FTA has identified transaction, asset, liability and share records among the essential documentation and confirms that relevant records should be kept for at least seven years after the relevant tax period. The pack should include a tax-to-ledger reconciliation and an issues schedule for uncertain positions or missing support.
Revenue recognition, inventory, provisions, leases, impairment, capitalisation, foreign exchange, related parties and consolidation can materially affect earnings and net debt. An accounting adviser should confirm the reporting treatment; the programme does not replace an audit or quality-of-earnings engagement.
7. Explain quality of earnings and cash conversion
Investors distinguish accounting profit from repeatable cash generation. The pack should bridge reported EBITDA or operating profit to a maintainable measure, then bridge earnings to operating cash flow and free cash flow. Each adjustment should have a definition, evidence, period and owner.
Common review areas include one-off income or expense, founder or family compensation, related-party rent or services, personal or non-operating items, underinvestment, capitalised cost, customer concentration, cut-off, provisions, rebates, loss-making contracts and foreign-exchange effects. A management adjustment should be identified as such and supported. The investor decides whether it is accepted.
Cash conversion requires working-capital evidence. Debtor ageing should tie to the ledger and subsequent receipts. Inventory should tie to stock records, counts, obsolescence and ownership. Payables should tie to supplier statements and subsequent payments. Contract assets, advances, retention, deposits and guarantees need clear treatment. Seasonality and growth should be separated from structural collection or inventory problems.
The financial bridge should identify facilities, shareholder balances, unpaid distributions, employee obligations, tax, litigation, capital commitments and other potential debt-like items. Final classification is deal-specific and requires advisers.
Each movement must link to a source, policy, period and responsible owner before it is used in negotiation.
Table 3. Financial evidence and reconciliation register
| Assertion | Source evidence | Reconciliation or test | Decision relevance |
|---|---|---|---|
| revenue is complete and earned | contracts, orders, delivery, invoices, ledger, tax records and receipts | customer analysis to ledger and statements; cut-off and credit notes | earnings quality, concentration and retention |
| margin is maintainable | product or project revenue, direct cost, allocation policy and loss contracts | gross margin by segment, project and cohort across periods | operating leverage, pricing and forecast credibility |
| working capital is recoverable | ageing, inventory, supplier statements, provisions and subsequent cash | ledger to schedules, counts and post-period settlement | cash conversion and completion adjustment |
| debt is complete | facilities, statements, guarantees, security, leases and shareholder balances | lender confirmation to ledger, interest and covenant model | net debt, consent and refinancing requirement |
| tax is supported | registrations, returns, calculations, elections, correspondence and payment | tax return to accounts and ledger by entity and period | exposure, warranty and cash requirement |
| adjustments are supportable | policy, invoice, contract, payroll, board decision and historical trend | adjustment bridge with evidence and counterfactual | maintainable earnings and valuation case |
| forecast is operationally grounded | backlog, pipeline, capacity, pricing, headcount, capex and working capital | forecast to historic conversion and approved operating plan | financing capacity and market-participant assumptions |
Adjustments and classifications remain management proposals until reviewed and accepted for the relevant purpose.
8. Expose related parties and normalise the boundary
Family businesses often transact with owners, relatives, sister companies and privately held property or service entities. These arrangements may be commercially sensible. They become diligence problems when the universe is incomplete, terms are undocumented, balances are unreconciled or the post-transaction boundary is unclear.
IAS 24 defines related parties through control, joint control, significant influence, key management and specified family or entity relationships. It requires relevant disclosure of relationships, transactions, balances and commitments so users can understand their effect on the financial statements. It also states that an arm's-length description should be made only when those terms can be substantiated.
Management should build a related-party universe from ownership, governance, payroll, customer, supplier, landlord, bank and ledger data. For each relationship, the register should show the party, relationship, transaction type, annual value, balance, terms, approval, settlement, tax treatment and intended post-transaction position. Intercompany balances should reconcile across entities.
The board should decide which arrangements continue, terminate, novate or reprice and quantify stranded or replacement cost. Tax and legal advisers should confirm transfer pricing, deductibility, value-added tax, corporate benefit, minority rights and documentation.
9. Validate revenue durability and customer transferability
Commercial evidence should allow an external reviewer to connect the sales story to executed contracts, delivery, invoices, cash and renewal behaviour. The company should prepare revenue by customer, product, geography, channel and cohort for consistent periods. It should show concentration, retention, churn, price, volume, backlog, pipeline conversion, credit notes, disputes and collections.
Contracts should be indexed by entity, counterparty, term, renewal, pricing, termination, change of control, assignment, service level, liability, data, intellectual property and disputes. Missing signatures, expired terms and side letters should be resolved or disclosed, with counsel reviewing material consents.
Relationship transferability matters in a family business. The pack should identify accounts that depend on a founder or family principal, then evidence multi-person coverage, account plans, delivery ownership and customer introductions. A buyer or lender will test whether revenue remains with the company when individual relationships change.
Pipeline should use documented stage criteria, customer evidence, probability rationale, timing, margin and capacity. Historical conversion, signed backlog and customer correspondence provide stronger support, subject to confidentiality and lawful disclosure.
10. Demonstrate operating capacity, assets and obligations
The operating pack should show how products and services are delivered, controlled and scaled. It should include process maps, key performance indicators, capacity, quality records, licences, regulatory permissions, supplier dependencies, procurement, inventory, property, equipment, maintenance, insurance, health and safety, incidents and business continuity.
Material assets should have title or contractual-use evidence. Fixed assets should reconcile to the ledger and physical records. Property and inventory records should establish ownership, terms, location, restrictions, valuation and condition.
Supplier evidence should identify concentration, sole-source items, lead times, price mechanisms, credit terms, quality, sanctions or compliance requirements and alternatives. Family or related suppliers should also appear in the related-party register. Outstanding claims, rebates, minimum purchases and guarantees should be captured.
The operating narrative should connect growth requirements for capital expenditure, working capital, licences, people, systems and suppliers to measurable output, timing and risk.
11. Prove ownership of intellectual property and data
Intellectual property can sit outside the company even when employees use it every day. The register should cover trademarks, patents, designs, domains, software, source code, databases, confidential know-how, content and material licences. Each item should show legal owner, creator, assignment, registration, jurisdiction, expiry, maintenance, restrictions, security and business use.
Employment, contractor, founder and licence records should support intellectual-property ownership, confidentiality, permitted use and transferability. Counsel and technical specialists should confirm defects and restrictions.
Data should be treated as governed information, rather than assumed property. The company should document sources, lawful basis, purpose, retention, access, sharing, cross-border movement, security and deletion. Customer and employee data placed in diligence should be minimised and controlled under the applicable legal basis and transaction protocol.
Cyber evidence should cover assets, identity and access, privileged accounts, backups, recovery tests, incidents, vulnerability management, third parties and remediation. NIST guidance supports resource-level authentication, authorisation and least privilege.
12. Map people, payroll and succession risk
The people pack should reconcile organisation charts, employee lists, payroll, employment contracts, visas or work authorisations where applicable, compensation, benefits, incentives, leave, disputes, contractors and key-person dependencies. Personal data should be staged and restricted.
The organisation chart should distinguish family members, employees, directors, managers, secondees and contractors. Critical roles need documented responsibility, authority, capability and continuity coverage.
Compensation evidence should identify owner remuneration, family benefits, personal costs, unpaid work, below-market roles and incentives. Any normalisation remains a management proposal supported by contracts, payroll and market evidence.
The board should identify critical employees, successors, retention risk, notice, restrictive covenants, change-of-control terms and transition actions. Employment counsel should confirm enforceability and consultation requirements.
13. Convert problems into a decision-grade issues register
The issues register turns diligence from document collection into execution. Every gap should have a concise description, source, affected entity, workstream, severity, decision effect, owner, action, target date, evidence of closure and residual risk. Duplicate issues should be linked across workstreams.
Severity should reflect transaction impact. A red issue may challenge ownership, authority, earnings, cash, licence, legal transfer, financing or personal-data disclosure. Amber may require remediation, disclosure or a valuation adjustment. Green may be an administrative improvement with limited decision effect. The definitions should be approved before scoring.
The register should distinguish missing evidence from an adverse fact. The team should investigate before characterising the outcome, then state what is known, what remains missing and which specialist must decide. Closure requires an executed document, reconciliation, system change, filing receipt, adviser conclusion or board decision.
Table 4. Red-flag and remediation register
| Issue category | Example evidence gap | Potential decision effect | Closure evidence |
|---|---|---|---|
| ownership and control | register, memorandum and ownership chart disagree | title uncertainty, approval risk or delayed KYC | corrected official records, counsel confirmation and reconciled map |
| authority | contract or bank activity exceeds documented delegation | enforceability, control and financing concern | valid resolutions, mandates, system limits and tested workflow |
| earnings | ledger, management accounts and customer revenue do not reconcile | quality-of-earnings adjustment and lower confidence | period bridge, corrected entries, source support and reviewer sign-off |
| tax and related parties | balances or terms lack support | exposure, warranty, cash or valuation adjustment | tax analysis, agreements, settlement evidence and return reconciliation |
| commercial | material contracts are unsigned, expired or personally held | revenue durability and transferability concern | executed or renewed contracts, consent plan and disclosed residual risk |
| IP and data | assignments, licences or lawful disclosure basis are unclear | restricted use, infringement, privacy or transaction delay | assignment, licence review, data protocol and specialist confirmation |
| people and succession | key roles lack contracts, retention or deputies | continuity cost, customer risk and integration delay | current agreements, retention decision and tested transition plan |
Severity and timing thresholds are illustrative management assumptions and should be calibrated to the transaction.
14. Build the management narrative from evidence
The management presentation should connect market need, customer proposition, revenue model, unit economics, operations, people, cash, growth investment and risk. Every material chart should state source, period, scope and definition.
Management should be ready to explain revenue concentration, margin, working capital, related-party boundaries, family governance, succession, capital needs and downside cases, distinguishing recorded fact, management judgement and transaction proposal.
The narrative should address open issues directly and align with the issues register. A buyer should not discover a red issue first through a data-room search.
Forecasts should link revenue to backlog, pipeline, capacity, price and retention; margin to mix, procurement and productivity; and cash to working capital, capital expenditure, tax and financing. Assumptions should be visible and sensitivity-tested.
15. Translate evidence into valuation and financing readiness
IFRS 13 defines fair value as an exit price in an orderly transaction between market participants at the measurement date. It requires the assumptions market participants would use under current market conditions, including assumptions about risk. A diligence pack cannot establish a universal valuation; it improves the evidence available to evaluate cash flow, risk and transferability.
The value-driver tree should connect commercial durability, margin quality, cash conversion, growth investment, management depth, governance and risk. Each driver should have an operating metric, evidence, downside transmission and action. Revenue concentration, related-party dependence, weak ownership evidence or missing intellectual-property assignments can affect expected cash flows, transition cost, deal protections or the required return.
The financing view is related. Lenders evaluate debt-service capacity, working capital, covenant headroom, security, authority and downside resilience. The pack should include historic and forecast cash flow, debt schedule, facility terms, security, guarantees, covenant calculations and sensitivity. Shareholder or family balances should be classified transparently.
The board can track fewer red issues, faster response, reconciled earnings, clearer cash conversion, valid authority and demonstrated customer transfer. Qualified advisers determine their effect on a specific financing or valuation.
Evidence affects valuation through the expected cash flows, transition costs and risks considered by a market participant.
16. Run the 90-day programme through four gates
Days one to fifteen establish control. The board appoints a sponsor and transaction-readiness lead, confirms the legal group, identifies advisers, defines confidentiality and approves the room architecture. Management creates the master request list, evidence index, issue taxonomy and reporting cadence. The first gate confirms scope, owners and access.
Days sixteen to thirty-five collect and reconcile priority evidence. The team completes the ownership and authority maps, financial bridges, tax index, related-party universe, contract register and data-protection protocol. It identifies red issues and assigns remediation. The second gate confirms whether the enterprise can state who owns it, who may bind it and how earnings reconcile.
Days thirty-six to sixty-five deepen commercial and operating proof. Management completes customer and supplier analyses, contract review, working-capital schedules, debt and security, people and succession, intellectual property, technology, cyber, assets, licences and disputes. It tests the data room with an independent reviewer who has not assembled it. The third gate confirms decision usability and secure access.
Days sixty-six to ninety close priority defects and prepare the transaction narrative. The team obtains executed documents, corrections, consents or specialist conclusions; updates the financial and value-driver bridges; rehearses management questions; and prepares transparent disclosure for remaining issues. The board reviews the scorecard, accepts residual risk and decides whether to approach capital providers, continue remediation or change the transaction plan.
Each phase ends with an evidence gate and a board decision, rather than a document-count target.
17. Measure readiness with evidence, not confidence
The scorecard should retain its denominator. A statement that the room is 95 per cent complete is meaningless when the missing 5 per cent contains ownership, a major customer contract or bank authority. Management should report completion by decision weight and issue severity.
Useful metrics include legal entities reconciled; ownership interests supported; material decisions with valid authority; reporting periods tied from ledger to accounts and tax; revenue covered by executed contracts; related-party value explained; key roles with succession coverage; intellectual property with ownership support; red issues closed; and data-room requests answered within the service level.
Evidence quality should also be scored. Executed documents and reconciled source-system data carry greater weight than summaries. Management estimates should be labelled in the working model. The board should review readiness weekly during the programme and after material transaction events.
Table 5. Board readiness scorecard
| Metric | Definition | Evidence owner | Board question |
|---|---|---|---|
| legal perimeter reconciled | entities with licence, constitutional documents, status and group position agreed | company secretary | do we know exactly which entities, rights and obligations are in scope? |
| ownership and UBO supported | interests traced to current official and underlying evidence | legal lead | can a counterparty complete ownership and control diligence efficiently? |
| authority validated | material decisions and transaction actions covered by valid approvals and system limits | board secretary and CFO | can the company act and bind itself through documented authority? |
| financial chain reconciled | periods tied across trial balance, accounts, tax, bank and management analysis | CFO | can reported earnings and cash be reproduced from source evidence? |
| revenue evidenced | material revenue linked to contracts, delivery, invoices and collections | commercial lead | how durable and transferable is the customer base? |
| related parties resolved | universe, transactions, balances, terms and future boundary documented | CFO and legal lead | which economics change after investment or sale? |
| critical red issues closed | high-severity issues with proof of remediation or accepted residual risk | programme lead | which unresolved issue can still delay, reprice or stop the transaction? |
| secure disclosure operating | named access, least privilege, redaction, logs and revocation tested | technology and data lead | is sensitive information disclosed lawfully and under control? |
Thresholds should reflect the company's materiality, intended transaction and risk appetite.
18. Make the board decision explicit
The final board pack should contain the legal-group chart, ownership and control map, authority matrix, financial and tax reconciliations, related-party schedule, commercial and operating summary, people and succession view, intellectual-property and data position, red-flag register, readiness scorecard, adviser conclusions and management presentation.
The board should make a recorded decision. It may authorise outreach and staged disclosure, require defined remediation before outreach, narrow the transaction perimeter, appoint additional specialists or pause the process. The decision should state conditions, owners, limits and the date for review.
After the gate, contracts, ownership, appointments, accounts, tax returns, facilities, claims, licences, systems and incidents should update the pack. The family business then maintains visible ownership, authority, economics and risk for future financing, succession or sale decisions.
Table 6. The board decision agenda
| Decision | Required evidence | Approval owner | Follow-up |
|---|---|---|---|
| confirm transaction perimeter | legal group, ownership, control, assets, liabilities and exclusions | shareholders and board under applicable authority | update after structural or scope change |
| approve disclosure protocol | data-room architecture, sensitivity, legal basis, access and revocation | board, legal and data owners | monitor access and incidents throughout diligence |
| accept financial narrative | reconciliations, accounting policies, adjustments, cash bridge and sensitivities | board and audit or finance committee | refresh for each new reporting period |
| approve remediation priorities | red issues, decision effects, cost, owner, timing and closure proof | executive committee with board oversight | weekly until closed or risk accepted |
| authorise market engagement | scorecard, management materials, adviser readiness and outreach list | board or authorised transaction committee | stage access and review counterparty feedback |
| approve residual-risk disclosure | unresolved facts, specialist advice, financial effect and proposed treatment | transaction committee with counsel | maintain disclosure log and document decisions |
| maintain the evidence system | update calendar, owners, controls and periodic independent test | board sponsor and programme owner | quarterly and after material events |
The agenda converts the 90-day programme into accountable approvals.
Implementation conclusion
A digital due-diligence pack makes a family business investible when it turns ownership, authority, earnings, cash, contracts, people, intellectual property, data and risk into one controlled evidence system. The 90-day programme focuses management on the issues that affect an external capital decision and gives the board a disciplined release gate.
The pack should remain transparent about uncertainty. Missing documents, unresolved legal questions and management adjustments belong in an issues register with accountable actions and specialist review. The company gains transaction credibility by reconciling material assertions, controlling sensitive disclosure and showing how residual risks affect cash, transferability and governance.
References
- United Arab Emirates Legislation. Federal Decree by Law No. 37 of 2022 Concerning the Family Businesses. https://uaelegislation.gov.ae/en/legislations/1608
- UAE Ministry of Economy and Tourism. Family Business. https://www.moet.gov.ae/en/family-business
- United Arab Emirates Legislation. Cabinet Resolution No. 109 of 2023 Regulating the Real Beneficiary Procedures. https://uaelegislation.gov.ae/en/legislations/2176
- UAE Ministry of Economy and Tourism. Cabinet Decision No. 109 of 2023 on the Regulation of the Real Beneficiary Procedures. https://www.moet.gov.ae/documents/20121/0/CabinetDecision_109_2023_pdf.pdf/3e5363a0-d200-d898-62da-67610520fdc4
- Federal Tax Authority. Corporate Tax FAQs. https://tax.gov.ae/en/taxes/corporate.tax/faqs.aspx
- Federal Tax Authority. Record retention and documentation for Corporate Tax, 27 August 2025. https://tax.gov.ae/en/media.centre/news/pr.28082025.aspx
- Federal Tax Authority. Corporate Tax Guides, References and Public Clarifications. https://tax.gov.ae/en/taxes/corporate.tax/corporate.tax.guides.references.aspx
- IFRS Foundation. IAS 24 Related Party Disclosures. https://www.ifrs.org/issued-standards/list-of-standards/ias-24-related-party-disclosures/
- IFRS Foundation. IFRS 13 Fair Value Measurement. https://www.ifrs.org/issued-standards/list-of-standards/ifrs-13-fair-value-measurement/
- OECD. G20/OECD Principles of Corporate Governance 2023. https://www.oecd.org/en/publications/2023/09/g20-oecd-principles-of-corporate-governance-2023_60836fcb.html
- Financial Action Task Force. Guidance on Beneficial Ownership of Legal Persons, Recommendation 24, March 2023. https://www.fatf-gafi.org/en/publications/Fatfrecommendations/Guidance-Beneficial-Ownership-Legal-Persons.html
- International Finance Corporation. Family Business Governance Handbook. https://www.ifc.org/en/insights-reports/2011/ifc-family-business-governance-handbook
- United Arab Emirates Legislation. Federal Decree by Law No. 45 of 2021 Concerning the Protection of Personal Data. https://uaelegislation.gov.ae/en/legislations/1972
- National Institute of Standards and Technology. SP 800-207, Zero Trust Architecture. https://csrc.nist.gov/pubs/sp/800/207/final
- National Institute of Standards and Technology. SP 1800-35, Implementing a Zero Trust Architecture, June 2025. https://csrc.nist.gov/pubs/sp/1800/35/final
