Commercial, Financial, Technical and ESG Due Diligence

Introduction and Context

Due diligence is the disciplined investigation undertaken before an investment, acquisition, strategic partnership, lending decision, or major financing commitment. In venture capital, it is not merely an audit of historical information. It is an evidence-based assessment of whether a venture can create, protect, and realise value under conditions of uncertainty.

A venture may have an attractive market but weak intellectual-property ownership; impressive revenue but poor cash conversion; sophisticated technology but inadequate cybersecurity; or strong growth but unacceptable labour and environmental risks. Effective due diligence therefore integrates commercial, financial, technical, legal, tax, people, and environmental, social and governance (ESG) perspectives.

The central question is not whether a venture has risks. Every early-stage venture has risks. The questions are whether the material risks have been identified, whether evidence supports management’s claims, whether risks are priced appropriately, and whether credible mitigation actions exist.

Learning Objectives

By the end of this chapter, the learner should be able to:

1. Explain the purpose, scope, sequencing, and governance of multidisciplinary due diligence.
2. Assess customers, markets, competitors, products, technologies, intellectual property, and cybersecurity.
3. Evaluate financial quality, tax exposure, legal compliance, team capability, and references.
4. Integrate ESG risks into investment analysis rather than treating ESG as a separate checklist.
5. Operate a secure data room and distinguish evidence, assumptions, issues, and red flags.
6. Convert findings into conditions precedent, valuation adjustments, covenants, and risk-mitigation plans.

1. The Logic and Architecture of Due Diligence

1.1 Due diligence as a decision process

Due diligence reduces information asymmetry between founders and investors. It also tests the reliability of the venture’s business model and management narrative. The process should answer five linked questions:

• Identity: What exactly is the business, product, legal entity, and ownership structure?
• Attractiveness: Is there a sufficiently large and accessible opportunity?
• Validity: Are claims supported by independent, reliable evidence?
• Vulnerability: What could materially impair value or create liability?
• Actionability: Can identified risks be mitigated, transferred, priced, or accepted?

Due diligence is distinct from an audit. An audit generally expresses an opinion on historical financial statements under defined standards. Venture due diligence is broader, forward-looking, and decision-oriented. It may use audited accounts, but it also evaluates market assumptions, product feasibility, regulatory change, scalability, and execution capacity.

1.2 Materiality and risk-based scope

A risk is material when its occurrence or magnitude could reasonably influence the investment decision, valuation, financing terms, or post-investment plan. Materiality is contextual. A minor data-privacy gap may be tolerable for a small local software firm but unacceptable for a health-data platform.

A useful risk-prioritisation model considers:

• likelihood of occurrence;
• severity of financial, operational, legal, or reputational impact;
• speed at which the impact could arise;
• detectability before investment; and
• cost and feasibility of mitigation.

A simple qualitative matrix can classify issues as low, moderate, high, or critical. It should not create false precision. The investment committee must still exercise judgement, particularly where risks are correlated. For example, a product delay may simultaneously reduce revenue, increase cash burn, breach a customer contract, and trigger a financing shortfall.

1.3 Workstreams and governance

A typical process has a partner or investment professional as deal lead, supported by specialists in finance, legal, tax, technology, cybersecurity, commercial research, and ESG. Each workstream should have:

• a defined scope and question set;
• an evidence request list;
• an accountable reviewer;
• a timetable and dependencies;
• an issue log;
• a red-flag escalation protocol; and
• a final conclusion stating evidence, uncertainty, and recommended action.

Independence matters. A person who prepared a financial model should not be the sole reviewer of its assumptions. External specialists may be necessary for patent freedom-to-operate, regulatory approvals, penetration testing, environmental compliance, or complex tax structures.

2. Evidence Management: The Data Room and the Audit Trail

2.1 Data-room design

A secure virtual data room should contain logically indexed folders, controlled permissions, version history, download restrictions where appropriate, and an access log. Typical folders include:

Documents should be labelled by date, owner, status, and confidentiality. Sensitive personal data should be minimised and shared only where necessary and lawful. A data room is not a substitute for verification: uploaded documents may be incomplete, outdated, or deliberately selective.

2.2 Evidence hierarchy

Evidence is stronger when it is contemporaneous, independent, complete, internally consistent, and directly linked to the claim being tested. For example, a signed customer contract is stronger evidence of contracted revenue than a sales presentation; a bank statement is stronger evidence of cash than a management spreadsheet; and an independent security report is stronger evidence than an untested assertion that systems are secure.

Reviewers should maintain an evidence register with four fields: claim, supporting evidence, unresolved uncertainty, and conclusion. Contradictions should be recorded rather than silently reconciled.

2.3 Red flags and escalation

A red flag is an issue that may materially alter the investment decision or require a specific remedy. Examples include:

• undisclosed related-party transactions;
• revenue recognised before contractual performance;
• a key patent owned by a founder personally;
• a major customer able to terminate without notice;
• unexplained differences between customer, bank, and accounting data;
• a critical security vulnerability;
• threatened litigation or regulatory investigation;
• founder or employee claims over intellectual property;
• dependence on one supplier, customer, person, or cloud provider; and
• misleading sustainability claims.

Red flags should be classified as deal-breaking, deal-contingent, price-relevant, or post-closing manageable. This classification must be supported by facts, not by the reviewer’s personal risk preference.

3. Commercial Due Diligence

3.1 Customer validation

Commercial diligence tests whether customers experience a real problem, value the proposed solution, pay at an economically rational price, and are likely to remain customers. It should examine customer concentration, acquisition channels, contract duration, renewal, usage, payment behaviour, implementation time, support burden, and reasons for loss.

Customer calls are valuable but require safeguards. Management should not select only enthusiastic customers or remain present for every interview. The investor should obtain permission, protect confidential information, and distinguish a reference from an independent validation exercise.

Useful customer questions include:

• What problem existed before adopting the product?
• What alternatives were considered?
• What measurable benefit has been obtained?
• Who made and approved the purchase?
• What would cause replacement or non-renewal?
• How difficult was implementation?

For subscription businesses, a commonly used gross revenue retention measure is:

Opening recurring revenue refers to recurring revenue at the beginning of the period. Churned revenue is revenue lost from customers that leave, and contraction revenue is lost from customers that downgrade. GRR excludes expansion revenue; therefore it cannot exceed 100% under the usual definition. The metric is meaningful only when the revenue base and period are consistently defined.

3.2 Market and competition

Market sizing should separate total addressable market, serviceable available market, and serviceable obtainable market. A top-down estimate based on an industry report can provide context, but an investment decision usually requires a bottom-up assessment based on identifiable customers, realistic pricing, adoption rates, sales capacity, and geographic or regulatory constraints.

Competitive analysis should include direct competitors, substitutes, internal customer solutions, and the option of doing nothing. Important dimensions include price, switching costs, distribution, product performance, compliance, network effects, data advantages, intellectual property, and speed of imitation.

A large market does not guarantee venture success. The relevant question is whether the venture can obtain a defensible share at an acceptable cost while maintaining adequate margins and service quality.

3.3 Product and business model

Product diligence connects customer value to economic value. It examines product-market fit, roadmap credibility, reliability, usability, implementation requirements, pricing logic, gross-margin potential, and scalability. Particular attention should be given to features that are promised but not yet built, services disguised as software, manual workarounds, and customer-specific customisation.

The reviewer should reconcile the product roadmap with engineering capacity, sales commitments, regulatory requirements, and cash runway. A product that requires a twelve-month implementation may not support the rapid growth assumed in the financial model.

4. Technical, Intellectual-Property and Cybersecurity Diligence

4.1 Technical architecture and scalability

Technical diligence asks whether the system can deliver the promised functionality reliably, securely, and economically. Review areas include architecture, code quality, testing, deployment practices, observability, reliability, data models, third-party dependencies, technical debt, disaster recovery, and the ability to recruit technical talent.

Scalability is multidimensional. A system may handle additional users but fail because of database contention, cloud costs, support workload, data-transfer limits, or regulatory restrictions. Claims such as “enterprise-ready” should be translated into testable requirements: availability targets, recovery objectives, performance thresholds, capacity assumptions, and documented controls.

A technical reviewer should seek evidence such as architecture diagrams, repository history, test coverage reports, incident post-mortems, service-level agreements, dependency inventories, and independent demonstrations. A demonstration alone is weak evidence because it may use prepared data and omit failure conditions.

4.2 Intellectual property

The analysis should identify what creates defensibility and who owns it. Relevant assets include patents, patent applications, trademarks, copyright, trade secrets, domain names, databases, designs, software, know-how, and contractual rights.

Core questions include:

• Were inventions and code created by employees, contractors, founders, or third parties?
• Do written agreements assign relevant rights to the company?
• Has open-source software been used in accordance with its licence obligations?
• Are patents valid, maintained, geographically relevant, and enforceable?
• Could the product infringe third-party rights?
• Are confidentiality procedures adequate to preserve trade-secret protection?

Freedom-to-operate analysis is different from proving ownership. A company may own its code and still infringe another party’s patent. Legal specialists should assess this distinction where the risk is material.

4.3 Cybersecurity and privacy

Cybersecurity diligence evaluates governance, identity and access management, encryption, secure development, vulnerability management, logging, backup, incident response, vendor risk, and employee awareness. Privacy diligence assesses the legal basis for collecting and using personal data, notice and consent practices, retention, data-subject rights, cross-border transfers, and processor arrangements.

The investigation should identify the data that would be compromised, the systems exposed, the probable business interruption, notification obligations, and available insurance. A small venture need not replicate the controls of a global bank, but it must implement controls proportionate to the sensitivity and volume of data it handles.

5. Financial Quality, Tax and Legal Due Diligence

5.1 Quality of financial information

Financial diligence tests whether reported performance represents sustainable economic activity. It reconciles management accounts to the general ledger, bank statements, invoices, contracts, payroll, tax filings, and customer records. It examines revenue recognition, deferred revenue, refunds, credits, capitalised development costs, inventory, receivables ageing, payables, stock-based compensation, debt, leases, and related-party transactions.

A quality-of-earnings review often distinguishes reported EBITDA from adjusted EBITDA. Adjustments should be specific, non-recurring, and supported by evidence. Removing ordinary founder compensation, recurring customer-acquisition costs, or normal maintenance expenditure can create a misleading picture.

Cash runway is commonly estimated as:

Available cash should exclude restricted or inaccessible funds. Average monthly net cash burn is cash operating outflows minus cash operating inflows over a representative period. The measure is only an approximation: seasonal revenue, milestone payments, planned hiring, debt repayments, and one-off expenditures may make historical averages unreliable.

For example, if available cash is $1.2 million and average monthly net burn is $150,000, estimated runway is eight months. If a planned $300,000 equipment purchase is due next month, decision-makers should adjust available cash or model the payment separately; otherwise the estimate overstates runway.

Unit economics require careful cohort definitions. A commonly used customer-acquisition-cost estimate is:

The numerator and denominator must refer to the same period, channel, and customer population. Comparing fully loaded quarterly cost with a narrow monthly customer count can produce a distorted result. Similarly, a lifetime-value estimate is highly sensitive to retention, margin, pricing, and cohort maturity; it should be presented as a range rather than a guaranteed forecast.

5.2 Tax diligence

Tax diligence covers corporate income tax, indirect taxes, payroll taxes, withholding, transfer pricing, permanent-establishment exposure, research incentives, tax losses, equity compensation, and transaction-specific taxes. It should identify filed returns, unpaid assessments, audits, disputes, uncertain positions, and obligations created by operating in multiple jurisdictions.

Tax attributes are not automatically transferable or fully usable after an investment. Changes in ownership, business activity, jurisdiction, or group structure may restrict losses or incentives. Specialists should distinguish historical liabilities, current compliance gaps, and future structuring opportunities.

5.3 Legal and regulatory diligence

Legal diligence examines corporate authority, capitalisation, shareholder rights, financing instruments, material contracts, employment, licences, insurance, litigation, intellectual property, privacy, consumer protection, competition law, and sector-specific regulation.

The capitalisation table must reconcile issued shares, options, warrants, convertible instruments, promised equity, vesting, and liquidation preferences. A nominal ownership percentage may be misleading if future conversion rights or preference claims are ignored.

Material contracts should be reviewed for change-of-control clauses, exclusivity, minimum commitments, service levels, indemnities, liability caps, termination rights, assignment restrictions, governing law, and data obligations. Regulatory diligence should assess not only whether a licence exists, but whether it covers the actual product, geography, customer type, and planned expansion.

6. Team, Governance and ESG Diligence

6.1 Team and references

Early-stage value is strongly dependent on people. The investigation should assess founder capability, role clarity, decision-making, succession, hiring plans, retention, culture, incentives, and the relationship among founders. References should include former supervisors, colleagues, customers, investors, and relevant partners, selected independently where possible.

Reference conversations must be lawful, respectful, and relevant. They should not become informal discrimination, invasion of privacy, or an attempt to obtain confidential information belonging to another employer. Inconsistencies in dates, responsibilities, qualifications, or prior outcomes should be verified rather than assumed to be misconduct.

6.2 ESG as enterprise risk

ESG diligence identifies risks and opportunities affecting long-term enterprise value, stakeholders, and the venture’s licence to operate. It is not limited to producing a sustainability report.

Environmental review may include permits, hazardous materials, supply-chain impacts, energy intensity, climate resilience, and environmental claims. Social review may cover labour standards, modern slavery, health and safety, inclusion, product safety, community effects, and responsible use of data or artificial intelligence. Governance review includes anti-bribery, sanctions, conflicts of interest, whistleblowing, board oversight, and accurate disclosure.

A venture should not make unsupported “green,” “ethical,” or “impact” claims. Claims should have defined boundaries, measurable indicators, reliable methods, and evidence. ESG risks can affect valuation through remediation cost, lost contracts, regulatory penalties, insurance premiums, financing access, and reputation.

7. Integrating Findings into Investment Decisions

Due diligence conclusions should be integrated into an investment memorandum rather than placed in disconnected specialist reports. A useful issue register is structured as follows:

Responses may include:

• avoidance: do not proceed or remove the activity;
• remediation: correct the weakness before or after closing;
• transfer: use insurance, indemnity, outsourcing, or contractual allocation;
• pricing: adjust valuation, investment amount, or staged funding;
• protection: use escrow, representations, warranties, covenants, or conditions precedent; and
• acceptance: consciously accept a residual risk within approved limits.

Representations and warranties allocate information risk but do not replace investigation. Covenants convert agreed improvements into continuing obligations. Milestone-based or tranche financing can preserve capital discipline when technical, commercial, or regulatory uncertainty is substantial.

8. Applied Case: NimbusCare Technologies (Illustrative)

Background

NimbusCare is an illustrative digital-health venture seeking $4 million in a Series A financing. It provides remote monitoring software to clinics and claims 180 active customers, 92% annual retention, proprietary analytics, and a twelve-month cash runway.

Problem

The initial presentation suggests strong product-market fit, but investors must determine whether the reported growth is durable and whether the platform can handle expansion into two additional jurisdictions.

Analysis

Commercial reviewers sample customer contracts and discover that 35% of reported annual recurring revenue comes from one clinic network with a termination right on 30 days’ notice. Customer interviews also show that several “active” customers use the system only during a pilot. Recalculated retention based on paying, non-pilot customers is materially lower than the headline figure.

Financial reviewers reconcile invoices to the ledger and identify revenue recorded at contract signing even though implementation obligations remain outstanding. Cash runway is therefore shorter than management reported. Technical reviewers find that patient data is processed by a subcontractor in a jurisdiction not covered by existing contractual documentation. A penetration test identifies weak administrator authentication. IP review reveals that a contractor who wrote a central analytics module has not assigned copyright to NimbusCare.

ESG and regulatory reviewers identify a risk that the product’s algorithm performs less accurately for a demographic group insufficiently represented in the training data. This creates patient-safety, discrimination, reputational, and regulatory concerns.

Approach and solution

The investor does not automatically reject the transaction. Instead, it requires a remediation plan:

1. Restate recurring revenue and provide a cohort-based retention schedule.
2. Treat the clinic network concentration as a valuation and financing risk.
3. Complete the contractor IP assignment before closing.
4. Implement multi-factor authentication and commission an independent follow-up security test.
5. Regularise data-processing and cross-border privacy arrangements.
6. Conduct bias and clinical-performance validation before jurisdictional expansion.
7. Release part of the investment in tranches linked to security, regulatory, and customer-diversification milestones.

Outcome

The investment committee approves a smaller initial investment with a lower valuation and explicit closing conditions. The company receives additional technical and regulatory support. After nine months, it has diversified its customer base, corrected revenue reporting, completed the IP assignment, and improved access controls. The case illustrates that due diligence is most valuable when it changes the transaction structure and management priorities rather than simply producing a pass-or-fail label.

Learning points

• Headline metrics must be reconstructed from source data.
• Commercial, technical, legal, financial, and ESG risks can reinforce one another.
• A manageable risk should have a named owner, deadline, evidence of completion, and consequence for non-performance.
• Staged financing can align capital deployment with risk reduction.

9. Challenges, Ethics and Contemporary Practice

Due diligence is limited by time, budget, incomplete records, management bias, and the uncertainty inherent in new markets. Excessive requests can burden a small company and damage trust; insufficient investigation can expose investors and stakeholders to preventable harm. Reviewers should apply proportionality, protect confidential information, avoid conflicts of interest, and respect privacy and data-protection requirements.

Artificial intelligence can assist in document classification, contract comparison, anomaly detection, customer-cohort analysis, and issue tracking. However, AI outputs require human validation. Automated tools may misread clauses, reproduce bias, omit context, or expose confidential data to an unauthorised provider. The reviewer remains accountable for conclusions.

Contemporary practice increasingly includes climate-transition exposure, supply-chain resilience, responsible AI, cyber resilience, digital-asset controls where relevant, and stakeholder impact. Investors should also monitor post-investment compliance through regular reporting, board oversight, incident notification, and re-testing of critical controls. Due diligence is therefore both a pre-investment investigation and the foundation of an ongoing governance relationship.

Chapter Summary

Due diligence is a multidisciplinary, evidence-based process for identifying and managing uncertainty before capital is committed. Commercial diligence tests customers, market structure, competition, product value, and business-model scalability. Financial diligence tests the quality of revenue, costs, cash, unit economics, tax positions, and capitalisation. Technical diligence examines architecture, scalability, intellectual property, cybersecurity, privacy, and operational resilience. Legal, team, and ESG diligence identifies liabilities, capability constraints, stakeholder risks, and governance weaknesses.

A secure data room, evidence register, risk-based scope, independent verification, and red-flag process provide the operating infrastructure. Findings should be translated into decisions: proceed, renegotiate, impose conditions, stage funding, require remediation, or decline. The strongest professional practice connects each material risk to evidence, impact, owner, deadline, and contractual or governance response.

Key Terms

Materiality: The significance of an issue to an investment, valuation, financing term, or stakeholder outcome.

Due diligence: Systematic investigation performed to support an informed transaction or investment decision.

Data room: A controlled repository for confidential transaction documents and evidence.

Red flag: A potentially material issue requiring escalation or a defined response.

Commercial diligence: Assessment of customers, markets, competition, products, and business-model economics.

Customer concentration: Dependence of revenue on a small number of customers.

Gross revenue retention: Recurring revenue retained from an opening customer cohort, excluding expansion revenue.

Technical debt: Future cost or risk created by expedient technical choices.

Intellectual property: Legally protected or protectable creations, identifiers, software, data, and know-how.

Freedom to operate: Assessment of whether a product can be used or commercialised without infringing third-party rights.

Cybersecurity: Protection of systems, networks, and information from unauthorised access or disruption.

Quality of earnings: Assessment of the sustainability and reliability of reported financial performance.

Cash runway: Estimated period for which available cash can fund net cash burn.

Capitalisation table: Record of ownership, options, warrants, and convertible securities.

Condition precedent: Requirement that must be satisfied before closing or funding.

Covenant: Continuing contractual obligation imposed on a transaction party.

ESG: Environmental, social, and governance factors affecting enterprise value and stakeholder outcomes.

Risk mitigation: Action that reduces the likelihood or impact of an identified risk.

Review Questions

Short Answer Questions

1. Why is venture-capital due diligence broader than a conventional financial audit?
2. What distinguishes a red flag from an ordinary business risk?
3. Why should gross revenue retention exclude expansion revenue?
4. Identify three areas that should be reviewed in cybersecurity diligence.
5. What is the purpose of a condition precedent?

Long Answer Questions

1. Explain how commercial, financial, technical, legal, and ESG workstreams should be coordinated in a venture-capital transaction.
2. Discuss the design features of an effective virtual data room and evidence register.
3. Explain how intellectual-property ownership and freedom-to-operate analysis differ.
4. Analyse the benefits and limitations of using cash runway and customer-acquisition cost in investment decisions.
5. Discuss how ESG risks can affect valuation, financing terms, and post-investment governance.

Analytical / Application Questions

1. A venture reports $900,000 of cash and average monthly net burn of $100,000, but a $200,000 equipment payment is due immediately. Estimate the basic runway and explain why the investment committee should adjust it.
2. A software company’s largest customer contributes 45% of recurring revenue and may terminate on 30 days’ notice. Design a due-diligence response and propose transaction protections.
3. During diligence, an investor discovers that core code was written by a contractor without an IP assignment and that administrator accounts lack multi-factor authentication. Classify the risks and prepare a practical pre-closing and post-closing remediation plan.

Multiple Choice Questions with Answers

Question 1

Which type of evidence is generally strongest for verifying contracted revenue?

A. A founder’s verbal statement

B. A sales presentation

C. A signed customer contract reconciled to invoices

D. An estimated pipeline report

Correct Answer: C. A signed customer contract reconciled to invoices

Question 2

Gross revenue retention normally excludes which item?

A. Churned revenue

B. Contraction revenue

C. Opening recurring revenue

D. Expansion revenue

Correct Answer: D. Expansion revenue

Question 3

If available cash is $1.2 million and average monthly net cash burn is $150,000, the basic estimated runway is:

A. 6 months

B. 8 months

C. 10 months

D. 12 months

Correct Answer: B. 8 months

Question 4

Which issue most directly concerns freedom to operate?

A. Whether the company owns its bank account

B. Whether a product may infringe a third party’s patent

C. Whether employees receive annual leave

D. Whether customer invoices are paid promptly

Correct Answer: B. Whether a product may infringe a third party’s patent

Question 5

What is the principal purpose of a secure virtual data room?

A. To replace all specialist advisers

B. To advertise the company publicly

C. To control and document access to confidential evidence

D. To guarantee that uploaded information is accurate

Correct Answer: C. To control and document access to confidential evidence

Question 6

Which is an example of a deal-contingent response to a red flag?

A. Ignoring the issue because all ventures have risks

B. Requiring missing IP assignments before closing

C. Deleting the issue from the investment memorandum

D. Counting the issue as automatic revenue growth

Correct Answer: B. Requiring missing IP assignments before closing

Question 7

Which financial measure estimates the period available cash can fund net cash burn?

A. Gross margin

B. Cash runway

C. Customer concentration

D. Accounts payable turnover

Correct Answer: B. Cash runway

Question 8

Why should ESG diligence include governance?

A. Governance is unrelated to enterprise value

B. Governance concerns can affect accountability, compliance, and stakeholder trust

C. Governance only measures carbon emissions

D. Governance replaces financial diligence

Correct Answer: B. Governance concerns can affect accountability, compliance, and stakeholder trust

Question 9

Which statement best describes a condition precedent?

A. A requirement that must be satisfied before closing or funding

B. A forecast of future customer demand

C. A historical accounting adjustment

D. A voluntary marketing slogan

Correct Answer: A. A requirement that must be satisfied before closing or funding

Question 10

What is a key limitation of using AI in due diligence?

A. AI cannot classify any documents

B. AI outputs may omit context or reproduce errors and require human validation

C. AI eliminates the need for confidentiality controls

D. AI automatically establishes legal ownership

Correct Answer: B. AI outputs may omit context or reproduce errors and require human validation