Running financial due diligence on a SaaS acquisition target

In the US, revenue recognition follows ASC 606 (Accounting Standards Codification Topic 606), issued by the FASB (Financial Accounting Standards Board). In Europe, the equivalent is IFRS 15 (International Financial Reporting Standard 15), issued by the IASB (International Accounting Standards Board). Both require revenue to be recognized as performance obligations are satisfied, not when cash arrives. This single rule explains most of the confusion buyers encounter.

Revenue quality: the first checklist

Before touching valuation, a buyer needs to know if reported revenue is real, recurring, and likely to persist.

Checks to run:

1. ARR bridge analysis: reconcile starting ARRARRAnnual Recurring Revenue (ARR) is the normalized, predictable revenue a subscription business expects to earn from active contracts over a single year.View full definition → to ending ARRARRAnnual Recurring Revenue (ARR) is the normalized, predictable revenue a subscription business expects to earn from active contracts over a single year.View full definition → through new business, expansion, contraction, and churn. If the target can't produce this bridge cleanly, that's a red flag.

2. Cohort retention: pull net revenue retentionnet revenue retentionNet Revenue Retention measures the percentage of recurring revenue retained and grown from existing customers over a period, including upsell and expansion, net of downgrades and churn.View full definition → (NRRNRRNet Revenue Retention measures the percentage of recurring revenue retained and grown from existing customers over a period, including upsell and expansion, net of downgrades and churn.View full definition →) by customer cohort over 12 to 24 months. Healthy US SaaS benchmarks for NRRNRRNet Revenue Retention measures the percentage of recurring revenue retained and grown from existing customers over a period, including upsell and expansion, net of downgrades and churn.View full definition → are roughly 100-120% as of recent industry surveys (estimate, source: OpenView SaaS Benchmarks); anything meaningfully below 100% signals a leaky bucket.

3. Logo churn vs. revenue churn: a company can lose many small customers (logo churnlogo churnChurn rate is the percentage of customers or revenue lost over a period. It measures how fast a business loses its existing customer base.View full definition →) while keeping revenue flat if larger accounts expand. Buyers must see both metrics separately.

4. Customer concentration: if the top 5 customers represent more than 20-25% of ARRARRAnnual Recurring Revenue (ARR) is the normalized, predictable revenue a subscription business expects to earn from active contracts over a single year.View full definition →, renewal risk on close of deal becomes a material valuation issue.

5. Bookings vs. billings vs. revenue: bookings are signed contracts, billings are invoiced amounts, revenue is what's recognized under ASC 606/IFRS 15. Sellers sometimes present bookings growth to disguise stalling revenue.

Worked example: a target reports $10 million ARRARRAnnual Recurring Revenue (ARR) is the normalized, predictable revenue a subscription business expects to earn from active contracts over a single year.View full definition → with 15% gross churn and 25% expansion within existing accounts.

• Net Revenue RetentionNet Revenue RetentionNet Revenue Retention measures the percentage of recurring revenue retained and grown from existing customers over a period, including upsell and expansion, net of downgrades and churn.View full definition → = (100% - 15% + 25%) = 110%
• That means the existing customer base alone would grow to $11 million next year with zero new sales.

This single calculation often matters more to valuation than the topline growth number the seller leads with.

Deferred revenue: the balance sheet trap

Deferred revenue (also called unearned revenue) is cash collected for a service not yet delivered. If a customer pays $120,000 upfront for a 12-month subscription, the SaaS company recognizes $10,000 in revenue per month and carries $110,000 as a liability on day one.

Why this matters in M&A:

• Deferred revenue is a liability, not an asset. A buyer inherits the obligation to deliver 11 more months of service for cash the seller already spent.
• Under ASC 606 fair value rules, acquirers often must revalue deferred revenue at closing, sometimes writing it down to reflect only the cost of fulfilling remaining obligations, plus a margin. This can shrink reported post-close revenue in year one, a phenomenon buyers must model, not get surprised by.
• Large deferred revenue balances relative to cash on hand can mean the company has been "living off" prepayments rather than sustainable unit economics.

Check to run: compare deferred revenue growth to new bookings growth. If deferred revenue is growing faster than new sales, the company may be pulling forward annual prepayments to mask a slowdown, common in down markets when reps push customers toward multi-year prepay discounts.

Contract terms: where the landmines hide

Individual customer contracts are the real source of SaaS revenue risk, and buyers should sample at least 20-30% of ARRARRAnnual Recurring Revenue (ARR) is the normalized, predictable revenue a subscription business expects to earn from active contracts over a single year.View full definition → by contract value.

Key terms to review:

• Auto-renewal vs. opt-in renewal: auto-renew clauses inflate the appearance of "sticky" revenue.
• Termination for convenience: can a customer walk away with 30 days' notice? That changes effective contract life dramatically.
• Most-favored-nation (MFN) clauses: promises of the lowest price to a customer can conflict with future price increases across the book.
• Data processing agreements (DPAs): required under GDPR (General Data Protection Regulation, EU law governing personal data) if the target processes EU personal data. Missing DPAs across a customer base is a compliance gap that can trigger fines up to 4% of global annual revenue under GDPR Article 83.
• SLA (Service Level Agreement) penalty clauses: uptime guarantees with financial penalties are a hidden liability if the product has reliability issues.

Compliance gaps that kill deals (or cut price)

Buyers, especially private equity and strategic acquirers, run compliance checks alongside financial ones because gaps translate directly into post-close costs or liabilities.

• SOC 2 (System and Organization Controls 2): a US audit standard (AICPA, American Institute of Certified Public Accountants) verifying security controls. Enterprise SaaS buyers often walk if the target lacks a current SOC 2 Type II report, since it signals unmanaged security risk.
• Sales tax nexus: in the US, since the 2018 Supreme Court case *South Dakota v. Wayfair*, states can require sales tax collection based on economic presence, not physical presence. Many SaaS companies under-collect sales tax across states; back-tax exposure is a common diligence finding.
• VAT (Value Added Tax) compliance in the EU: digital services sold to EU consumers require VAT registration and collection under the EU's OSS (One Stop Shop) scheme. Missed VAT filings are a frequent, quantifiable liability buyers deduct from purchase price.
• Data residency and cross-border transfer: post-Schrems II ruling, transferring EU personal data to US servers requires Standard Contractual Clauses (SCCs) or equivalent safeguards. Missing SCCs is a legal exposure a buyer will flag to counsel.

For a practical framework on SaaS metrics buyers examine, the SaaS Capital benchmarking reports are a solid free reference.

Building the due diligence checklist

A working FDD checklist for a SaaS target should be organized into four buckets, each with named owners (finance, legal, security):

1. Revenue quality: ARRARRAnnual Recurring Revenue (ARR) is the normalized, predictable revenue a subscription business expects to earn from active contracts over a single year.View full definition → bridge, NRRNRRNet Revenue Retention measures the percentage of recurring revenue retained and grown from existing customers over a period, including upsell and expansion, net of downgrades and churn.View full definition →/GRR, cohort retention, customer concentration, bookings-to-revenue reconciliation.

2. Balance sheet: deferred revenue schedule, deferred revenue fair value adjustment estimate, accounts receivable aging, capitalized software costs (ASC 350-40 in the US).

3. Contracts: sample review of top 20-30% of ARRARRAnnual Recurring Revenue (ARR) is the normalized, predictable revenue a subscription business expects to earn from active contracts over a single year.View full definition →, auto-renewal terms, MFN clauses, termination rights, DPAs.

4. Compliance: SOC 2 status, sales tax nexus study, VAT registration status, GDPR/SCC documentation, any pending litigation or regulatory inquiries.

Each item should produce a dollar-quantified adjustment, either to valuation (a purchase price reduction) or to a post-close reserve (an escrow holdback), not just a narrative comment.

🎬 [VIDEO: "How Private Equity Firms Analyze SaaS Companies" - youtube.com - a walkthrough of the ARRARRAnnual Recurring Revenue (ARR) is the normalized, predictable revenue a subscription business expects to earn from active contracts over a single year.View full definition →, churn, and retention metrics buyers model before making an offer]

Key Takeaways

• SaaS revenue is not GAAP-standardized in its "ARRARRAnnual Recurring Revenue (ARR) is the normalized, predictable revenue a subscription business expects to earn from active contracts over a single year.View full definition →/MRRMRRMonthly Recurring Revenue: the predictable, normalized monthly revenue from active subscriptions, the baseline metric for SaaS and subscription businesses.View full definition →" form; always rebuild the ARRARRAnnual Recurring Revenue (ARR) is the normalized, predictable revenue a subscription business expects to earn from active contracts over a single year.View full definition → bridge yourself rather than trusting the seller's dashboard.