Due diligence: what actually gets checked

I price private companies for a living. More than a thousand of them, on deals up to roughly $26 billion, and for a large share of those I was the person opening the boxes. Founders treat due diligence like an exam: study hard, answer the questions, get a passing grade, collect the money. That framing is wrong in a way that costs real dollars. Diligence is not a test with a pass mark. It is a structured search for reasons to pay less. The term sheet already set the number, so nothing found afterwards can push it up. Everything the investor learns between signature and close is either neutral or an argument for a discount. Understand that asymmetry and the entire exercise becomes legible, including the parts that feel like bureaucratic theater.

Here is the thing almost nobody tells founders: the request list is not arbitrary and it is not a hazing ritual. It is the mirror image of a document you are about to sign. When the round closes, the company will make dozens of representations and warranties in the stock purchase agreement, the same shape you find in the National Venture Capital Association model documents that most US venture rounds are built from. That the cap table attached as an exhibit is accurate and complete. That the company owns its intellectual property free of third-party claims. That every employee and contractor has assigned their work. That the financials fairly present the business. That there is no undisclosed litigation. Diligence is simply the investor confirming, in advance, the things you are about to swear to. Read the reps first and the request list stops looking random.

The effort is smaller than you think, and that is exactly the problem

Founders imagine a team of analysts taking their business apart. The measured reality is thinner. In the survey work by Gompers, Gornall, Kaplan and Strebulaev, covering 885 venture capitalists at 681 firms, VCs pre-pandemic spent an average of 118 hours on due diligence per deal, took 83 days to close, and called about ten references. One hundred and eighteen hours is roughly three working weeks for one person, spread across lawyers, an associate, and a partner, set against a check often worth millions.

That budget cannot re-audit a company. It buys sampling. Which means the investor is not trying to understand your business, and it is a mistake to run diligence as though they were. They are trying to falsify the story you already told them, and they will spend their limited hours on the specific places where founder stories are known to fall apart. Those places are not secret. After enough deals you learn that essentially every finding lands in one of four files, and that the same handful of errors recur across companies that otherwise have nothing in common.

File one: does the company actually own itself?

This is the file founders assume is fine and it is the file that most often is not. The question underneath it is narrow and brutal: for every single line on your cap table, is there an executed agreement and a board approval that authorized it? Under Delaware corporate law, Sections 152 and 157 of the General Corporation Law govern the board's authority to issue stock and to grant rights and options. A grant that was promised in an offer letter, typed into cap table software, and never approved by the board is not a clean grant. It is a claim.

This is common enough that Delaware wrote a cure into the statute. Sections 204 and 205, effective April 2014, exist specifically to let companies and the Court of Chancery ratify defective corporate acts, including stock issued without proper authorization. A legislature does not build a repair procedure for a rare problem. When your counsel discovers three years of unapproved grants two weeks before close, ratification is available, and it is also weeks of legal time and a very awkward disclosure.

The other reliable corporate finding is the 83(b) election. A founder holding restricted stock subject to vesting has 30 days from the transfer to file, under Treasury Regulation 1.83-2(c), and there is essentially no relief for missing it. Thirty calendar days, not business days, no extension. A missed filing does not usually kill a financing, but it converts a founder's future vesting into an ordinary income event, and an investor reading it learns something about how the company handles deadlines. The test I apply is simple: ask for the signed document behind any three cap table lines, chosen at random, and see how long it takes. A company that can produce them in an hour has a clean corporate file. A company that needs a week does not, and now knows it before anyone else asks.

File two: does the company own what it sells?

Intellectual property diligence sounds like patent work. At early stage it is almost entirely a paperwork question, and the paperwork turns on verb tense. In Stanford v. Roche, decided by the US Supreme Court in 2011, a researcher had signed one agreement promising he would agree to assign inventions and a later agreement saying he does hereby assign them. The courts treated the second as an immediate transfer of title and the first as a mere promise, and Stanford lost its ownership claim on that distinction. Present-tense assignment language is not lawyer fussiness. It is the difference between owning your technology and having a contractual right to ask for it.

From there the checks are mechanical and the gaps are predictable. Did all founders sign assignments, including the one who left in year one and still holds stock? Did contractors sign, including the offshore development shop that wrote the first version of the product, and does that agreement work under the law of the country the developer lives in? Did anyone build the prototype while employed somewhere else, on a laptop belonging to that employer, in a state where the employer's invention agreement may reach it? Is the domain registered to the company or to a founder's personal account? Is there a copyleft open-source library sitting in the part of the codebase that ships to customers? Each of these is cheap to fix in year one and expensive to fix in week six of a financing.

File three: is the revenue real, and does it stay?

This is my file, the one I run personally, and it is where the price actually moves. A revenue number in a pitch deck is a claim. Diligence turns it into a bridge, and the bridge almost always steps down. The first cut removes anything that is not signed: pilots that are verbally committed, letters of intent, opportunities that a founder counted because the champion is enthusiastic. The second removes anything that is not recurring: implementation fees, custom development, one-time services revenue booked inside an annual recurring revenue figure because it arrived in the same invoice. The third removes revenue that is contracted but already gone, customers inside a notice period or on a contract that will not renew. What survives is the number an investor underwrites.

Three further tests run alongside that bridge. Reconciliation: the recurring revenue figure has to tie to signed contracts on one side and to cash that arrived in the bank on the other, because contracted revenue, recognized revenue, and collected cash are three different numbers and founders routinely quote whichever is largest. Concentration: if one customer is a large enough share of revenue, that customer's renewal decision is not a commercial risk, it is an existential one, and it gets priced as such. Churn definition: ask five founders how they calculate churn and you will get five methods, at least two of which quietly exclude the customers who left. I ask for the raw cohort table and compute it myself, which is a reasonable thing for you to do first.

None of this is hostile. It is the same normalization work that sits behind any credible valuation, the private-market cousin of the quality of earnings analysis a buyer runs in M&A. But the founder who has never done it arrives at diligence with a number they believe and leaves with a smaller number they have to defend, and the gap between those two numbers is dilution they did not budget for.

File four: are the people locked in, and lawfully engaged?

Investors in the Gompers survey called about ten references per deal, and founders reliably misunderstand which ten matter. The names you supply are the ones you have already primed, so they carry almost no information. The calls that move a decision are the off-list ones: the investor from your last round, the customer who churned and did not tell you why, the engineer who left after eight months. Assume every one of those conversations happens, because in a functioning market it does.

The paperwork side of the people file is narrower. Founder vesting is checked first, and not to protect the company from you so much as to confirm you have something to lose, which is exactly why unvested founder stock reads as a positive rather than an imposition. Then employment classification, because a company running twenty full-time contractors to stay lean has a payroll tax exposure and, frequently, the IP gap from file two. Then the equity that exists only in email: the advisor promised half a point, the early employee told they would get options at the next board meeting, three board meetings ago. Those promises are liabilities that do not appear on any cap table until someone asks.

What a finding actually costs

Not every problem is priced the same way, and the difference is almost entirely about who found it and when. A finding escalates along a ladder with four rungs. If you found it yourself and fixed it before the term sheet, it costs nothing and never enters the conversation. If the investor finds it and it is cleanly fixable, it costs delay, which in a financing means legal fees and momentum, and momentum has a way of converting into price. If it is found and not cleanly fixable, it moves into the deal documents as a special representation, an indemnity, or a holdback, all of which are ways of making you carry the risk. And if it is material and you did not disclose it, the conversation stops being about the finding.

That last rung deserves its own sentence, because it is the one founders get wrong. Deals do not die of problems. They die of surprises. Any experienced investor expects a five-year-old company to have a missing consent, an unassigned contractor, and a customer contract with an ugly clause in it. Those are work items, and work items get worked. What cannot be priced is a founder who either did not know or knew and chose not to say, because that finding is not about the document. It is about whether the other forty things you said can be relied on. Repricing handles a bad contract. Nothing handles a credibility problem, which is why the walk usually follows disclosure failures rather than the underlying facts.

How to run your side of it

The whole strategy follows from the ladder: move every finding to the top rung, where it is free. That means running diligence on yourself while nothing is at stake, ideally a full quarter before you start pitching. Pull three random cap table lines and find the executed agreement and the board consent behind each. List every human who has touched production code, including contractors and the cofounder who left, and confirm a present-tense assignment exists for all of them. Build the revenue bridge yourself and use the number at the bottom of it in your own deck, because a founder quoting the conservative figure is more credible than one who gets talked down to it.

Then build the data room before you need it, organized the way the standard lists are organized, which is the same four files. Y Combinator publishes a Series A diligence checklist and Cooley GO publishes a sample venture due diligence request list, both free, both close enough to what you will actually receive that preparing against them removes most of the scramble. And write the disclosure schedule honestly. Founders treat it as a confession; it is closer to a shield. A problem you list yourself is a disclosed condition of the deal. The same problem found later is a breach of a representation you made. The document that feels like an admission is the one that limits your liability.

The takeaway from someone who does the checking

Due diligence is a pricing exercise wearing a compliance costume. Every document requested exists to test a claim you have already made, every hour spent is rationed toward the places where claims usually break, and every finding is an option the investor holds to pay less than the term sheet says. You cannot make the process friendlier and you should not try. What you can do is arrive with the four files already opened, already checked, and already cleaned by you, so that the 118 hours find exactly what you told them they would find. The founders who come through diligence at the price they were quoted are almost never the ones with no problems. They are the ones who found their problems first.

Common questions

What do investors actually check during startup due diligence?

Four files, in roughly this order. The corporate file asks whether the company legally owns itself: board approvals for every share and option, signed stock purchase and option agreements, 83(b) elections, and a cap table that reconciles to the executed paperwork. The intellectual property file asks whether the company owns what it sells: present-tense assignment agreements from every founder, employee, and contractor, plus open-source and prior-employer exposure. The revenue file asks whether the revenue is real and durable: contracted versus recognized versus collected, customer concentration, churn, and what is counted as recurring that is not. The people file asks whether the team is locked in and lawfully engaged: vesting, employment classification, and reference calls. Everything on a standard request list, such as the Cooley GO sample or Y Combinator's Series A diligence checklist, maps to one of those four.

How long does due diligence take, and how much work is it for the investor?

Less than founders imagine. In the survey work by Gompers, Gornall, Kaplan and Strebulaev, covering 885 venture capitalists at 681 firms, VCs pre-pandemic spent an average of 118 hours on due diligence per deal, took 83 days to close, and called about ten references. One hundred and eighteen hours is roughly three working weeks for one person, against a check that is often worth millions. That budget cannot re-audit a business. It buys sampling, which means the investor is not trying to understand everything. They are testing the handful of places where deals are known to break.

What are the most common red flags found in startup due diligence?

The recurring ones are unglamorous. Shares or options recorded in cap table software with no board consent authorizing them. A missing or late 83(b) election, where Treasury Regulation 1.83-2(c) gives a hard 30-day window with essentially no relief. Contractors, especially offshore developers, who wrote production code without a signed assignment. Assignment agreements using the words agree to assign rather than hereby assign, a distinction the Supreme Court treated as decisive in Stanford v. Roche. Annual recurring revenue that includes unsigned pilots, letters of intent, or one-time services work. And revenue concentrated in one or two customers whose renewal decision is effectively the company's survival.

Can due diligence change the valuation after a term sheet is signed?

Yes, and it only moves one direction. A term sheet prices the company the investor believes exists. Diligence tests whether that company exists, so a finding can only subtract. In practice a finding escalates along a ladder: something you disclosed and fixed before the term sheet costs nothing, something found and fixable costs weeks of delay and legal fees, something found and not cleanly fixable becomes a holdback, an indemnity, or a special representation, and something material and undisclosed becomes a price cut or a walk. The cheapest place to find any problem is on your own side of the table, months before anyone else looks.

How should a founder prepare for due diligence before receiving a term sheet?

Run diligence on yourself first, while nothing is at stake. Take each line of the cap table and find the executed agreement and the board approval that authorized it. Confirm every founder, employee, and contractor who touched the product signed a present-tense invention assignment. Reconcile the recurring revenue figure in your deck to signed contracts and to cash that actually arrived. Then build the data room before you need it, and write an honest disclosure schedule listing what is imperfect. A problem you surface yourself is a work item. The identical problem discovered by the investor is a character finding, and character findings do not get repriced, they get walked.

Related reading

• How to read a cap table before it reads you.
• The five term sheet clauses that move money.
• How VCs actually decide whether to fund you.
• Why most founder equity splits quietly destroy value.

Go deeper

If you are heading into a raise and you want the four files checked before an investor checks them, let's run your own diligence together while the findings are still free to fix, or read more of how I think about it.

Tomasz Felpel is an investor, founder, and advisor in private markets and healthcare, based in New York. He is a three-time founder of Value Alpha, an AI-powered private-markets valuation platform, Sonnerie VC, an early-stage healthcare venture firm, and Pond. Previously he led corporate development and M&A at Fortune 500 scale, pricing more than 1,000 private companies. Columbia Business School EMBA. Read the full story. This essay is educational and is not legal, tax, or investment advice; work with qualified counsel on any document you sign.