Running financial due diligence on a SaaS acquisition target

A private equity associate opens a target's books and finds $40 million in "annual recurring revenueannual recurring revenueAnnual Recurring Revenue (ARR) is the normalized, predictable revenue a subscription business expects to earn from active contracts over a single year.View full definition →." Three weeks later, after checking cohort retention and contract terms, the real number is closer to $28 million. The gap wasn't fraud. It was optimistic accounting, churned logos still counted, and a founder who confused bookings with revenue. This happens constantly in SaaS deals, and it's exactly why financial due diligence (FDD) exists.

Financial due diligence is the investigative process buyers, investors, and lenders run before closing a deal to verify a target's financial claims and uncover hidden liabilities. For SaaS (Software as a Service, software delivered by subscription rather than sold as a one-time license) companies, FDD has specific traps that don't exist in traditional manufacturing or retail deals.

Why SaaS due diligence is different

SaaS businesses sell a promise of future service, not a physical good delivered today. That creates three structural issues buyers must probe:

• Revenue recognition timing: money collected today may not be "earned" yet.
• Contract complexity: pricing, discounts, and renewal terms live in hundreds of individual agreements, not one price list.
• Metric manipulation risk: ARR (Annual Recurring Revenue) and MRRMRRMonthly Recurring Revenue: the predictable, normalized monthly revenue from active subscriptions, the baseline metric for SaaS and subscription businesses.View full definition → (Monthly Recurring Revenue) are not standardized GAAPGAAPThe standard set of accounting rules companies follow to prepare consistent, comparable financial statements, dominant in US reporting.View full definition → (Generally Accepted Accounting Principles, the US accounting rulebook) terms. Companies define them however flatters them most.

In the US, revenue recognition follows ASC 606 (Accounting Standards Codification Topic 606), issued by the FASB (Financial Accounting Standards Board). In Europe, the equivalent is IFRS 15 (International Financial Reporting Standard 15), issued by the IASB (International Accounting StandardsInternational Accounting StandardsThe global accounting rulebook that governs how companies report financial results, used across the EU and 140+ jurisdictions.View full definition → Board). Both require revenue to be recognized as performance obligations are satisfied, not when cash arrives. This single rule explains most of the confusion buyers encounter.

Revenue quality: the first checklist

Before touching valuation, a buyer needs to know if reported revenue is real, recurring, and likely to persist.

Checks to run:

1. ARR bridge analysis: reconcile starting ARR to ending ARR through new business, expansion, contraction, and churn. If the target can't produce this bridge cleanly, that's a red flag.
2. Cohort retention: pull net revenue retentionnet revenue retentionNet Revenue Retention measures the percentage of recurring revenue retained and grown from existing customers over a period, including upsell and expansion, net of downgrades and churn.View full definition → (NRR) by customer cohort over 12 to 24 months. Healthy US SaaS benchmarks for NRR are roughly 100-120% as of recent industry surveys (estimate, source: OpenView SaaS Benchmarks); anything meaningfully below 100% signals a leaky bucket.
3. Logo churn vs. revenue churn: a company can lose many small customers (logo churnlogo churnChurn rate is the percentage of customers or revenue lost over a period. It measures how fast a business loses its existing customer base.View full definition →) while keeping revenue flat if larger accounts expand. Buyers must see both metrics separately.
4. Customer concentration: if the top 5 customers represent more than 20-25% of ARR, renewal risk on close of deal becomes a material valuation issue.
5. Bookings vs. billings vs. revenue: bookings are signed contracts, billings are invoiced amounts, revenue is what's recognized under ASC 606/IFRS 15. Sellers sometimes present bookings growth to disguise stalling revenue.

Worked example: a target reports $10 million ARR with 15% gross churn and 25% expansion within existing accounts.

• Net Revenue Retention = (100% - 15% + 25%) = 110%
• That means the existing customer base alone would grow to $11 million next year with zero new sales.

This single calculation often matters more to valuation than the topline growth number the seller leads with.

Deferred revenueDeferred revenueCash a company has collected for goods or services it has not yet delivered. It sits on the balance sheet as a liability until earned.View full definition →: the balance sheet trap

Deferred revenue (also called unearned revenue) is cash collected for a service not yet delivered. If a customer pays $120,000 upfront for a 12-month subscription, the SaaS company recognizes $10,000 in revenue per month and carries $110,000 as a liability on day one.

Why this matters in M&A:

• Deferred revenue is a liability, not an asset. A buyer inherits the obligation to deliver 11 more months of service for cash the seller already spent.
• Under ASC 606 fair value rules, acquirers often must revalue deferred revenue at closing, sometimes writing it down to reflect only the cost of fulfilling remaining obligations, plus a margin. This can shrink reported post-close revenue in year one, a phenomenon buyers must model, not get surprised by.
• Large deferred revenue balances relative to cash on hand can mean the company has been "living off" prepayments rather than sustainable unit economics.

Check to run: compare deferred revenue growth to new bookings growth. If deferred revenue is growing faster than new sales, the company may be pulling forward annual prepayments to mask a slowdown, common in down markets when reps push customers toward multi-year prepay discounts.

Contract terms: where the landmines hide

Individual customer contracts are the real source of SaaS revenue risk, and buyers should sample at least 20-30% of ARR by contract value.

Key terms to review:

• Auto-renewal vs. opt-in renewal: auto-renew clauses inflate the appearance of "sticky" revenue.
• Termination for convenience: can a customer walk away with 30 days' notice? That changes effective contract life dramatically.
• Most-favored-nation (MFN) clauses: promises of the lowest price to a customer can conflict with future price increases across the book.
• Data processing agreements (DPAs): required under GDPRGDPREU regulation governing how organizations collect, store and use personal data, with fines tied to global revenue for breaches.View full definition → (General Data Protection Regulation, EU law governing personal data) if the target processes EU personal data. Missing DPAs across a customer base is a compliance gap that can trigger fines up to 4% of global annual revenue under GDPR Article 83.
• SLA (Service Level Agreement) penalty clauses: uptime guarantees with financial penalties are a hidden liability if the product has reliability issues.

Compliance gaps that kill deals (or cut price)

Buyers, especially private equity and strategic acquirers, run compliance checks alongside financial ones because gaps translate directly into post-close costs or liabilities.

• SOC 2 (System and Organization Controls 2): a US audit standard (AICPA, American Institute of Certified Public Accountants) verifying security controls. Enterprise SaaS buyers often walk if the target lacks a current SOC 2 Type II report, since it signals unmanaged security risk.
• Sales tax nexus: in the US, since the 2018 Supreme Court case *South Dakota v. Wayfair*, states can require sales tax collection based on economic presence, not physical presence. Many SaaS companies under-collect sales tax across states; back-tax exposure is a common diligence finding.
• VAT (Value Added Tax) compliance in the EU: digital services sold to EU consumers require VAT registration and collection under the EU's OSS (One Stop Shop) scheme. Missed VAT filings are a frequent, quantifiable liability buyers deduct from purchase price.
• Data residency and cross-border transfer: post-Schrems II ruling, transferring EU personal data to US servers requires Standard Contractual Clauses (SCCs) or equivalent safeguards. Missing SCCs is a legal exposure a buyer will flag to counsel.

For a practical framework on SaaS metrics buyers examine, the SaaS Capital benchmarking reports are a solid free reference.

Building the due diligence checklist

A working FDD checklist for a SaaS target should be organized into four buckets, each with named owners (finance, legal, security):

1. Revenue quality: ARR bridge, NRR/GRR, cohort retention, customer concentration, bookings-to-revenue reconciliation.
2. Balance sheet: deferred revenue schedule, deferred revenue fair value adjustment estimate, accounts receivable aging, capitalized software costs (ASC 350-40 in the US).
3. Contracts: sample review of top 20-30% of ARR, auto-renewal terms, MFN clauses, termination rights, DPAs.
4. Compliance: SOC 2 status, sales tax nexus study, VAT registration status, GDPR/SCC documentation, any pending litigation or regulatory inquiries.

Each item should produce a dollar-quantified adjustment, either to valuation (a purchase price reduction) or to a post-close reserve (an escrow holdback), not just a narrative comment.

🎬 [VIDEO: "How Private Equity Firms Analyze SaaS Companies" - youtube.com - a walkthrough of the ARR, churn, and retention metrics buyers model before making an offer]

Key Takeaways

• SaaS revenue is not GAAP-standardized in its "ARR/MRR" form; always rebuild the ARR bridge yourself rather than trusting the seller's dashboard.
• Deferred revenue is a liability the buyer inherits; under ASC 606/IFRS 15 it often gets revalued at close, shrinking apparent year-one revenue.
• Contract-level review (auto-renewal, termination clauses, MFN, DPAs) catches risks that aggregate financial statements hide.
• Compliance gaps, US sales tax nexus, EU VAT/OSS registration, GDPR data transfer mechanisms, SOC 2 status, are quantifiable and typically become price adjustments or escrow terms, not just red flags.
• Treat every diligence finding as a number: a valuation deduction, an escrow holdback, or a post-close remediation cost, not merely a comment in a report.