Due diligence red flags CFOs miss in M&A deals

The post-merger integration literature is full of deals that looked clean on paper. HP's $11 billion write-down on Autonomy in 2012, or Microsoft's $7.6 billion impairment on Nokia in 2015, were not failures of financial modeling. They were failures of scrutiny applied to the wrong things. Finance teams ran rigorous EBITDAEBITDAEBITDA (Earnings Before Interest, Taxes, Depreciation, and Amortization) measures a company's operating profitability before financing and accounting decisions, used to compare core performance across firms.View full definition → analysis while missing revenue recognition manipulation, cultural incompatibility, and technology debt that made the target's core product nearly unmaintainable. In 2026, with deal volumes recovering and private equity sponsors moving faster than ever to put dry powder to work, the pressure on CFOs to close rather than probe is intense. That pressure is where value gets destroyed.

The good news is that the most damaging red flags follow recognizable patterns. They are not random. And most of them show up in the same four or five places, deal after deal.

A structured approach to catching what your team will miss

Start with revenue quality, not revenue size

The first move in any diligence process should be disaggregating reported revenue into its constituent parts: recurring versus one-time, contracted versus at-will, customer-concentrated versus distributed. A target reporting 20% year-over-year growth may be masking the fact that 40% of that revenue came from two customers on contracts expiring within 18 months. Ask for customer-level revenue data going back five years. Request renewal rates by cohort, not blended averages. If the seller's team cannot produce this within 48 hours, that itself is a signal.

Watch for channel stuffing in product companies. Quarterly revenue that spikes in the final two weeks of each period, combined with rising days sales outstanding, is a classic sign. Pull the AR aging schedule and mapmapUsing software to automate repetitive marketing tasks and campaigns, enabling personalisation at scale across channels like email, web, and social.View full definition → it against the customer list. If your largest revenue contributors also appear in the 90-plus days past due column, the revenue is not real in any practical sense.

Interrogate working capitalworking capitalWorking capital is the difference between a company's current assets and current liabilities, measuring short-term liquidity and the funds available to run daily operations.View full definition → with the same rigor as EBITDA

Working capital adjustments are where deals bleed out post-closing. Sellers have strong incentives to inflate working capital in the months before signing by delaying payables, accelerating collections, or running inventory lean. A normalized working capital peg calculated from 12 months of monthly data, not just a point-in-time snapshot at quarter end, will often differ materially from what the seller proposes.

Request monthly balance sheet data for the trailing 24 months. Calculate working capital at each month end. If you see a pattern where it peaks in September and December, the months sellers typically use as reference dates, you are looking at managed balances.

Do not skip the technology and data infrastructure review

This is the area most CFOs under-resource. Financial acquirers in particular treat IT diligence as a checkbox rather than a value driver. The cost to remediate technical debt, migrate off legacy platforms, or replace end-of-life infrastructure frequently runs to 3-5% of deal value, and it rarely shows up in the seller's financial statements.

Engage an independent technical review team, not the integration consultant who also wants the post-close engagement. Have them assess the target's core systems against three specific questions: what is the cost to maintain current functionality for the next 24 months, what would it cost to migrate to the acquirer's stack, and are there any unresolved security vulnerabilities or open-source license violations that create legal exposure. On that last point, software companies built on GPL-licensed open-source components with proprietary wrappers have ended up in costly litigation. Check the software composition analysis reports if they exist. If they do not, commission one.

Map the people risk explicitly

Key-person dependency is one of the most commonly acknowledged and least rigorously analyzed risks in M&A. Acknowledging that a target's CTO is important is not diligence. Diligence is establishing what happens to product roadmap execution, customer relationships, and institutional knowledge if that person leaves within six months of closing, and then verifying whether retention mechanisms are legally enforceable and economically sufficient.

Go further than the org chart. Ask the target's leadership team to name the five people the business cannot afford to lose. Then cross-reference those names against LinkedIn activity, recent equity vesting schedules, and any non-compete agreements that may or may not hold up under applicable law (non-competes are increasingly unenforceable in several US states following FTC guidance and state-level legislation).

Stress-test the regulatory and ESG exposure

Environmental liabilities have a long history of appearing after closing. Superfund liability at former manufacturing sites, for example, can attach to acquirers even when the contamination predates the acquisition. Request Phase I and Phase II environmental assessments for any target with physical operations. For deals in regulated industries, model the cost of compliance gaps independently rather than accepting the seller's representation that the business is "substantially compliant."

On ESG specifically: institutional LPLPA standalone web page built for a single campaign goal, designed to maximise conversions by removing distractions and focusing visitors on one action.View full definition → pressure and incoming EU and US disclosure requirements mean that acquiring a business with undisclosed emissions data gaps or supply chain labor issues creates reputational and compliance cost post-close that did not exist five years ago. This is not theoretical. Conduct Scope 1 and 2 emissions verification as part of diligence, and if the target has material Scope 3 exposure through its supply chain, flag it explicitly in the risk register.

Pitfalls that derail even experienced teams

Compressing diligence timelines to accommodate competitive auction pressure is the single most common failure mode. A four-week diligence period on a complex business is not diligence, it is a tour. If the seller will not accommodate a thorough process, that refusal is itself a data point.

Relying entirely on the target's management presentations without independent verification is the second. Management decks are marketing documents. Cross-reference every material claim against underlying source data.

Finally, siloing financial, legal, technical, and commercial workstreams so they never share findings is structurally dangerous. The insight that a target's largest customer is in contract renewal discussions only becomes a risk when the financial team's revenue concentration finding is combined with the commercial team's customer health assessment. Build explicit cross-workstream synthesis sessions into the diligence timeline.

Quick wins to start this week

• Pull the last six months of monthly financial statements on your current pipelinepipelineAll active sales opportunities across the stages of the sales process, together with their combined potential value and probability of closing.View full definition → target and calculate working capital at each period end before the seller proposes a peg.
• Add a software composition analysis to your standard technical diligence checklist if it is not already there.
• Require the deal team to produce a cross-workstream findings memo at the midpoint of diligence, not just at the end.
• Check enforceability of non-compete agreements against the jurisdiction-specific legal landscape before treating them as retention tools.
• Commission an independent Phase I environmental assessment on any target with physical operations, even if the seller provides one.

The red flags that cost acquirers the most money are rarely hidden. They are present in the data and simply not looked for because the process did not allocate time, resources, or cross-functional coordination to find them. Tightening the process on those five specific areas, before exclusivity closes off your leverage, is where the CFO earns the deal.