M&A due diligence in 2026: why CFOs are the last line of defense

In 2019, a major European industrial conglomerate completed a $4.2 billion acquisition that, by every investment banker's metric, looked pristine. Clean EBITDAEBITDAEBITDA (Earnings Before Interest, Taxes, Depreciation, and Amortization) measures a company's operating profitability before financing and accounting decisions, used to compare core performance across firms.View full definition →, a defensible market position, synergy estimates that had been stress-tested three times over. Eighteen months post-close, the CFO was standing before the board explaining a $900 million goodwill impairment. The culprit? A customer concentration risk buried in footnotes, a legacy ERP system incompatible with the acquirer's infrastructure, and a management team that had been quietly polishing its LinkedIn profiles since the letter of intent was signed. The deal had been approved. The due diligence had been completed. And yet the value had never really been there.

This scenario plays out with uncomfortable regularity. According to Harvard Business Review research, between 70% and 90% of acquisitions fail to deliver their projected value. That figure has remained stubbornly persistent across decades and market cycles. What changes, and what is changing significantly in 2026, is the nature of the risks that go undetected, and the tools available to catch them.

The M&A landscape has shifted structurally

Several forces have converged to make modern deal-making substantially more complex than it was even five years ago.

First, the pace of deal execution has accelerated. Competitive auction processes now routinely compress due diligence windows to four to six weeks for transactions that would previously have commanded three to four months of scrutiny. Private equity sponsors and strategic acquirers alike are operating under pressure from principals, markets, and deal fatigue. The result is a systematic bias toward speed over depth.

Second, the composition of enterprise value has shifted dramatically toward intangible assets. In 1975, tangible assets represented roughly 83% of S&P 500 market value. By the mid-2020s, that ratio has inverted, with intangibles, brand equitybrand equityThe commercial value your brand adds beyond functional product attributes: the price premium, preference and loyalty it generates.View full definition →, customer relationships, proprietary data, software, talent, accounting for the lion's share. Yet most due diligence frameworks were designed in an era when you could kick the tyres on a factory floor. Valuing a SaaS company's net revenue retentionnet revenue retentionNet Revenue Retention measures the percentage of recurring revenue retained and grown from existing customers over a period, including upsell and expansion, net of downgrades and churn.View full definition →, or assessing the durability of a fintech's regulatory moatmoatA lasting edge over competitors: a resource, capability or position they cannot easily replicate, letting a firm earn above-average returns over time.View full definition →, requires a fundamentally different analytical toolkit.

Third, geopolitical fragmentation has introduced a new category of deal risk. Cross-border transactions in 2026 must navigate a landscape of tightened foreign investment screening, technology export controls, and supply chain sovereignty concerns that did not exist at the same scale even three years ago. The Committee on Foreign Investment in the United States (CFIUS) and equivalent bodies in the EU and UK have expanded their mandates considerably. Deals that passed regulatory scrutiny in 2021 would face serious headwinds today.

Finally, ESG obligations have moved from voluntary disclosure to material risk. Acquirers who fail to conduct rigorous environmental liability and governance due diligence are inheriting regulatory exposure, reputational liability, and, increasingly, stranded asset risk. The EU's Corporate Sustainability Due Diligence Directive (CSDDD) has made this a legal obligation, not a best practice, for large transactions involving European entities.

What this means for the CFO

The CFO's role in M&A has evolved well beyond signing off on financial models. In high-performing organizations, the CFO functions as the strategic skeptic, the person in the room who is explicitly empowered to challenge the deal thesis, not just validate its arithmetic.

Rebuild the due diligence framework from first principles. Most organizations are still running due diligence checklists that were designed for asset-heavy businesses in stable regulatory environments. If your framework does not explicitly include data asset quality assessment, software infrastructure compatibility, talent retention probability modelling, and ESG liability quantification, it is not fit for purpose in 2026.

Treat synergy projections as a negotiating position, not a forecast. Investment banks and deal sponsors are structurally incentivized to present optimistic synergy estimates. McKinsey research has consistently shown that revenue synergies are achieved at roughly half the projected rate, while cost synergies, easier to model and control, are more reliably captured. Build your integration budget around cost synergies. Treat revenue synergies as upside optionality, not base case assumptions.

Build a dedicated integration office before the deal closes. The single most common structural failure in post-merger integration is the absence of a dedicated, empowered integration management office (IMO) with clear accountability. This is not a task for the existing finance team to absorb on top of business as usual. Organizations like Cisco, which has completed over 200 acquisitions, operate with a dedicated M&A integration function that engages from term sheet stage, not from day one post-close.

The management team is the asset. In services, technology, and knowledge-intensive businesses, you are often acquiring the capability and judgment of a leadership team that has no contractual obligation to remain beyond their earnout period. Deep behavioural due diligence, understanding motivations, cultural fit, and post-acquisition expectations, is not a soft complement to financial analysis. It is financial analysis. The cost of executive attrition in the first eighteen months frequently exceeds the entire synergy capture of the deal.

Key takeaways

• Compress your risk exposure, not your timeline. Competitive auction pressure will always push for speed. The CFO must establish non-negotiable due diligence floors, particularly for cyber, ESG, and regulatory risk, that cannot be traded away for deal velocity.
• Model the downside before you model the upside. Before any board presentation, run a structured pre-mortem: what would have to be true for this deal to destroy value? Stress-test for customer churncustomer churnChurn rate is the percentage of customers or revenue lost over a period. It measures how fast a business loses its existing customer base.View full definition →, management departure, integration overruns, and regulatory intervention simultaneously.
• Own the integration budget. Post-close integration routinely costs 2-3% of deal value in direct costs. Contingency planning is not pessimism, it is professional discipline. CFOs who underestimate integration costs are setting their organizations up to impair goodwill on a predictable schedule.
• Challenge the strategic rationale, not just the numbers. The most dangerous acquisitions are those with defensible financial models built on a flawed strategic premise. Your job is to ask whether the deal makes strategic sense under adversarial conditions, not just when everything goes according to plan.

The difference between CFOs who create value through M&A and those who preside over expensive disappointments rarely comes down to analytical horsepower. It comes down to the willingness to be the most informed skeptic in the room. The next acquisition your organization considers will have advocates who believe in it deeply. The question is whether it also has someone who is genuinely prepared to kill it, and who has the standing to do so.