The Week-by-Week Buyer Due Diligence Timeline: What Gets Asked, When (2026)

By Christoph Totter, Managing Partner, CT Acquisitions. Last reviewed: July 2026.

Executive summary

• What buyers look for in due diligence follows a predictable weekly cadence: financial trust-but-verify in weeks 1 to 2, operational and commercial diligence in week 3, legal and closing mechanics in weeks 4 to 6, per patterns documented by Deloitte M&A Insights and PwC US Deals.
• Week 3 is where roughly 40 percent of deals encounter their first material re-trade, according to SRS Acquiom deal studies, because operational and commercial findings surface risks that financials alone did not reveal.
• Confirmatory quality of earnings would land in final draft form at the end of week 3 in most middle-market processes, per AICPA valuation practice guidance and standard middle-market practice.
• Buyer-led customer calls with the top 10 accounts, sometimes conducted under a consultant persona, would represent the single highest-risk workstream of week 3, according to conflict-management practice discussed by KPMG Deal Advisory.
• Key-employee interviews under NDA, insurance loss-run analysis, cybersecurity penetration testing, and real-estate title work would all be scheduled inside the same seven-day window, compressing risk into one intense week per Mercer M&A HR practice.

Key findings

1. Median middle-market diligence would run 60 to 90 days from letter of intent to close, per SRS Acquiom Deal Terms Study.
2. Confirmatory QoE for a lower-middle-market deal would cost between $50,000 and $150,000 and typically land in final draft form at the end of week 3, per rate cards discussed by AICPA-CIMA.
3. Customer concentration exceeding 20 percent of revenue in any single account would trigger direct customer diligence in week 3 in more than 80 percent of institutional buyer processes, per GF Data reporting on middle-market transactions.
4. Escrow and holdback provisions on middle-market deals would average 8 to 10 percent of purchase price with 12 to 18 month tails, per SRS Acquiom Deal Terms Study 2024.
5. Representations and warranties insurance would be bound by approximately 64 percent of private-equity deals above $50 million in 2024, per market data reported by Marsh Transactional Risk.
6. Approximately 30 percent of middle-market transactions would experience a purchase-price re-trade between LOI and close, with commercial diligence findings being the leading trigger per Bain & Company Global M&A Report.
7. Change-of-control provisions would appear in roughly 45 percent of top-tier customer contracts in service-heavy businesses, per ABA Business Law Section M&A guidance.
8. Cybersecurity findings would delay approximately 10 percent of deals by 30 days or more when a material undisclosed breach or unpatched critical vulnerability is discovered mid-diligence, per IBM Cost of a Data Breach Report.
9. Insurance policy limits below industry benchmarks would trigger a request for tail coverage or purchase-price adjustment in approximately 35 percent of professional-services deals, per OPTIS Partners industry data.
10. Median time from LOI to close would compress by 10 to 15 percent when the seller runs a professional dataroom with a pre-signed QoE, per PitchBook US PE Breakdown.

The diligence calendar at a glance: weeks 1 through 6

Buyer diligence in a middle-market transaction would follow a compressed 6 to 12 week calendar between LOI signing and close. Each week has a distinct focus, distinct workstreams, and distinct sources of failure. Sellers who understand the cadence get fewer surprises and preserve more leverage on price and terms.

Diligence workstreams by week

Week	Primary focus	Workstream lead	Deliverable	Re-trade risk
Week 1	Financial trust-but-verify	QoE firm, buyer CFO	Draft QoE, working capital walk	Low to moderate
Week 2	Legal foundation, corporate records	Buyer counsel	Legal issues list, cap table verification	Low
Week 3	Commercial + operational + IT + insurance	Buyer operating partner, third-party consultants	Customer calls done, QoE final, IT penetration test complete	High
Week 4	Contracts, HR, benefits	Buyer counsel, HR advisor	Change-of-control schedule, benefits liability review	Moderate
Week 5	Definitive agreement drafting	Both counsels	Purchase agreement, disclosure schedules	Moderate
Week 6	Closing conditions, financing, signing	Both counsels, lender, R&W broker	Signed purchase agreement, funding certainty	Low

Week 3 carries the highest re-trade risk because operational and commercial findings would surface risks that financials alone did not reveal. This is where the pressure gets real.

Weeks 1 to 2: financial trust-but-verify and legal foundation

The first two weeks of buyer diligence would center on confirmatory quality of earnings, working capital normalization, and corporate legal foundation. A buyer running an institutional process would engage a Big Four or middle-market QoE firm within 48 hours of LOI signing, per patterns documented by KPMG Deal Advisory.

Week 1: quality of earnings kickoff

Week 1 would open with a QoE kickoff call. The buyer’s transaction services team, often a Big Four firm like PwC Deals, Deloitte Transaction Services, EY Strategy and Transactions, or KPMG Deal Advisory, would request three to five years of monthly financials, general ledger detail, and trial balance data. Middle-market deals below $50 million EBITDA are more commonly served by specialty QoE firms like RSM Transaction Advisory, Baker Tilly Transaction Advisory, or Grant Thornton.

Week 2: legal and corporate records

Week 2 would shift emphasis to legal foundation. Buyer counsel would review the corporate minute book, cap table, stock ledger, and all outstanding equity awards. Key focus items would include verified good standing in all states of qualification, cleanliness of the cap table, and absence of unresolved pre-LOI litigation, following guidance discussed by the American Bar Association Business Law Section.

Both of these weeks are relatively predictable. The seller who prepared a clean dataroom and pre-signed QoE would face limited surprise. That changes in week 3.

Week 3: commercial and operational diligence, the pressure cooker

Week 3 is where what buyers look for in due diligence expands from trust-but-verify to full operational and commercial validation. This is the week when the deal either firms up on price or the buyer sends its first re-trade signal, per patterns discussed by Bain & Company Global M&A Report.

Focus area 1: customer diligence, the top 10 calls

Buyers who invest institutional capital would insist on direct customer contact by week 3. The top 10 revenue accounts would be identified from customer master data pulled in week 1, and buyer operating partners or third-party consultants would begin reference calls under NDA. Interviewer identity would frequently be disguised as an industry consultant to preserve confidentiality if the transaction remains undisclosed, per practice discussed by KPMG Deal Advisory.

What buyers listen for on these calls: satisfaction levels, renewal intent, dependency on specific personnel or founders, competitive alternatives, price sensitivity, and any recent quality complaints. A single top-10 customer indicating imminent departure would compress the multiple by 0.5x to 1.5x turns of EBITDA in most cases, per commentary observed in GF Data quarterly reports on middle-market transactions.

Focus area 2: customer concentration and change-of-control

Concentration risk gets quantified in week 3. Buyers would compute revenue and gross-profit concentration for top 5, top 10, and top 25 customers, with any single account above 20 percent triggering deeper diligence. In parallel, buyer counsel would run change-of-control language checks against the top 20 customer contracts, since change-of-control clauses would appear in roughly 45 percent of top-tier customer contracts in service-heavy businesses, per ABA Business Law Section M&A guidance.

A change-of-control clause that requires customer consent post-close would either need explicit consent as a closing condition or would be flagged in the disclosure schedule and priced into the R&W insurance policy.

Focus area 3: key-employee interviews under NDA

Buyers would schedule key-employee interviews with three to seven of the company’s most critical individual contributors during week 3. Under standard NDA and often with the seller’s counsel or M&A advisor observing, buyer operating partners would probe: retention risk, comp expectations post-close, competitive alternatives, and knowledge transfer if the founder or CEO exits, per practice guidance from Mercer M&A HR.

Key-employee attrition risk would materially affect deal structure. Buyers who identify high flight risk would push for expanded retention pools, extended earn-outs, or seller notes as insurance against attrition.

Focus area 4: IT infrastructure and cybersecurity

Cybersecurity diligence in 2026 would be materially more intensive than five years ago. Buyers would commission third-party penetration testing by firms like Mandiant (Google Cloud), CrowdStrike Services, or specialty transaction-focused security firms like Corvus Insurance partners.

The core cybersecurity workstream would include external attack surface scans, review of any disclosed breaches, review of SOC 2 or ISO 27001 attestations if held, verification of MFA coverage across the workforce, and email security controls. According to the IBM Cost of a Data Breach Report, the global average total cost of a data breach reached $4.88 million in 2024, and cybersecurity findings would delay approximately 10 percent of deals by 30 days or more when a material undisclosed breach or unpatched critical vulnerability is discovered mid-diligence.

Focus area 5: insurance policy review and loss runs

Insurance diligence in week 3 would cover general liability, professional liability or E&O, cyber, D&O, workers compensation, and any specialty coverage. Buyer’s insurance advisor, typically Marsh, Aon, or WTW, would review each policy’s limits, exclusions, and loss runs for the trailing five years.

Loss run patterns matter as much as absolute limits. A pattern of small workers-comp claims might be baseline for a labor-heavy vertical, but a spike in the trailing 24 months would signal a safety-culture problem worth pricing in. Policy limits below industry benchmarks would trigger a request for tail coverage or purchase-price adjustment in approximately 35 percent of professional-services deals, per market data reported by OPTIS Partners.

Focus area 6: real estate and title work

If the target owns real property or holds long-term leases, week 3 would include title commitment orders, environmental Phase I reports where warranted, and lease abstracting. A material environmental exposure discovered late in diligence would trigger environmental holdback or seller indemnity in nearly all cases, per practice noted by the ABA Business Law Section.

Focus area 7: final QoE draft

The confirmatory QoE final draft would land at the end of week 3 in most middle-market processes. This draft would include a final view on adjusted EBITDA, working capital target, and any pro-forma or one-time items the buyer would allow or disallow. If the QoE lands with material adverse findings, the re-trade conversation would happen the following week.

What moves the multiple: 12 ranked drivers surfaced in week 3

Week 3 findings would either affirm the LOI multiple or generate a re-trade. The following drivers, ranked by impact, would be the ones buyers would use to justify a purchase-price adjustment:

1. Customer concentration above 25 percent in a single account , would compress the multiple by 0.5x to 2.0x turns per GF Data.
2. Undisclosed cybersecurity breach in trailing 24 months , would trigger price reduction or specific escrow per IBM Cost of a Data Breach Report.
3. Key-employee flight risk (CEO, CFO, top salesperson) , would trigger retention pool creation, extended earn-out, or expanded seller note.
4. Customer reference call revealing imminent departure , would trigger re-trade of 0.5x to 1.5x EBITDA turns per Bain M&A Report patterns.
5. Insurance policy limits below industry standard , would trigger tail-coverage requirement, per Marsh Transactional Risk.
6. Change-of-control provisions in top customer contracts , would either add closing condition (customer consent) or push disclosure schedule expansion.
7. QoE finding of material one-time revenue or non-recurring gross profit , would compress trailing EBITDA base per AICPA valuation practice.
8. Environmental exposure on owned real estate , would trigger environmental escrow of 5 to 15 percent of purchase price.
9. Loss run pattern indicating safety-culture problem , would trigger insurance premium adjustment or purchase-price reduction.
10. SOC 2 or ISO 27001 gap where customer contracts require certification , would push post-close remediation timeline and cost.
11. Working capital target below seller expectation , would come from the QoE working capital walk and would settle in the final agreement.
12. Founder-dependency risk surfaced in customer calls , would push seller-note deferrals or extended transition-services agreements.

Named buyers and their week-3 playbooks

Different buyer archetypes would run week 3 differently. The following patterns reflect observed practice across institutional buyers, per commentary in PitchBook and Bain M&A Reports.

Large-cap PE (KKR, Blackstone, Apollo)

Large-cap private-equity buyers like KKR, Blackstone, and Apollo Global Management would run week 3 with a full operating-partner deployment. Their playbook would include a dedicated commercial diligence workstream from a specialty firm like Bain & Company, BCG, or McKinsey Private Equity Practice. Customer calls would be extensive, typically 20 to 30 accounts. This would compress week 3 into a very intense workload for the seller’s team.

Middle-market PE (Sun Capital, Charlesbank, HGGC)

Middle-market private-equity buyers like Sun Capital Partners, Charlesbank Capital Partners, and HGGC would run a more focused week 3, typically hitting 10 to 15 customer calls and one internal operating-partner interview cycle. Their commercial diligence would often be led in-house rather than delegated to top-tier consultants.

Search funds and independent sponsors

Search-fund buyers and independent sponsors would run a materially lighter week 3. Customer calls might be 5 to 8 accounts. Key-employee interviews would be shorter, often conducted by the searcher themselves rather than a third party. Sellers considering these buyers should read our comparison of search-fund buyers versus PE buyers for the trade-offs.

Strategic buyers

Strategic buyers (competitors, adjacencies, up-market consolidators) would emphasize customer overlap, contract portability, and integration risk in week 3. Their playbook is uniquely dangerous in one respect: they may have competitive interest in the customer list independent of the transaction, which raises confidentiality risk. For the fuller trade-off analysis, see our strategic buyer versus financial buyer comparison.

Family offices

Family-office buyers would run week 3 with the smallest external footprint, often deferring commercial diligence to the seller’s advisor. Timelines can be more forgiving and the tone less adversarial. See the family office versus PE buyer comparison for structural differences.

Boutique M&A advisors who specialize in sell-side diligence readiness

Sellers who want a boutique specialist to run the seller side of week 3 would typically consider one of the following firms alongside CT Acquisitions. Each named firm is identified with its official website. Every seller should interview multiple advisors, and this list is not exhaustive.

Houlihan Lokey Corporate Finance

Houlihan Lokey would be the reference option for larger middle-market deals ($100M+ EV). They maintain deep sell-side expertise across most industry verticals. Their sell-side process runs the full institutional playbook and their team knows how to prepare a seller for high-intensity commercial and operational diligence.

Harris Williams

Harris Williams would be another option for middle-market sell-side, particularly in industrials, technology, and healthcare. Their process discipline is well-regarded and their commercial-diligence preparation is thorough.

Piper Sandler Middle Market

Piper Sandler would be a viable option for lower-middle-market and middle-market sell-side across financial services, healthcare, and technology. Their diligence coaching for sellers on customer calls and key-employee interviews is considered practical.

CT Acquisitions positioning

CT Acquisitions is another lower-middle-market option, specializing in $1M to $50M enterprise-value transactions with owner-aligned fees. Our sell-side M&A advisory team specifically prepares clients for the week-3 pressure cooker: dataroom construction, pre-signed QoE, customer-call preparation, key-employee interview coaching, and disclosure schedule drafting. Sellers who want a smaller boutique with LMM specialization and owner-aligned fees should consider us alongside the firms listed above. See our sell-side advisory service page for the full engagement outline.

How the sell-side process works: sell-side timing and buyer diligence sequencing

What buyers look for in due diligence during the middle six weeks maps directly against the sell-side process timeline that runs from advisor engagement to close. The typical sell-side process would follow this pattern, per practice discussed in our investment banking process guide:

Month 1: preparation

The sell-side advisor would prepare the confidential information memorandum, dataroom, financial model, and management presentation. Sellers who want to shorten week 3 would pre-order a QoE from a reputable firm before going to market.

Month 2: outreach and LOI

Advisor would send teaser to targeted buyer list, execute NDAs, distribute CIM, take management meetings, and receive LOIs. Best LOI would be selected and exclusivity signed.

Months 3 to 4: buyer diligence weeks 1 to 6

The six-week diligence calendar covered above. Week 3 sits in the middle of this window.

Month 5: definitive agreement and close

Definitive agreement drafted, closing conditions satisfied, financing certain, signing and closing.

Sellers who understand this timing gain leverage. Sellers who go into diligence unprepared lose it week by week.

Regulatory and structural mechanics for 2026

Several regulatory changes affect what buyers look for in due diligence in 2026:

HSR filing thresholds and antitrust review

The 2026 HSR filing threshold sits at $126.4 million in transaction size per the FTC premerger notification program. Deals above threshold require HSR filing and would carry a 30-day waiting period. Buyers would build this into the week 4 to 6 timeline, though pre-clearance conversations can start in week 3 for larger deals.

Representations and warranties insurance

R&W insurance would be bound by approximately 64 percent of private-equity deals above $50 million in 2024, per market data reported by Marsh. The R&W underwriter would run its own diligence in parallel with the buyer, adding a workstream to week 3 that many first-time sellers underestimate.

Non-compete restrictions and FTC 2024 rule status

The FTC non-compete rule was vacated by the U.S. District Court for the Northern District of Texas in Ryan LLC v. FTC, and subsequent appeals mean employer non-competes remain state-law governed in 2026. Buyers running key-employee interviews in week 3 would confirm state-by-state enforceability of any executive non-competes as part of retention risk assessment. For state-by-state guidance, see our quality of earnings deep dive.

QSBS and estate planning implications

The One Big Beautiful Bill Act (OBBBA) made the $15 million estate and gift tax exclusion permanent starting 2026, and expanded QSBS thresholds to $75 million per taxpayer. Sellers should have their QSBS and estate planning locked in before week 3, since retro-tightening becomes difficult once buyer counsel is drafting the definitive agreement.

How to choose an M&A advisor: 10-point checklist

1. LMM specialty , Confirm the advisor’s median deal size aligns with your enterprise value. A $500M sell-side desk will not focus energy on a $10M deal.
2. Buyer list depth , Ask for the actual number of vetted institutional buyers in the advisor’s network. For LMM deals, 100+ vetted buyers is a reasonable floor.
3. Fee structure alignment , Owner-aligned fees, meaning a modest engagement fee and a success fee weighted toward outcome, would align advisor and seller. See our M&A advisor fees 2026 guide for the current market.
4. QoE readiness , Advisor should have a preferred QoE firm relationship and should recommend pre-signing before market.
5. Dataroom sophistication , Advisor should build a dataroom that answers every predictable question before it is asked.
6. Diligence coaching , Advisor should prepare you for customer calls and key-employee interviews, not just deliver a CIM.
7. Named references , Advisor should provide three closed-deal references you can call.
8. Confidentiality discipline , Advisor should have clear protocols for buyer identity disguise if you want confidentiality preserved through diligence.
9. Legal counsel coordination , Advisor should recommend and coordinate with M&A counsel from day one.
10. Post-LOI availability , Advisor should have a lead partner available through the compressed weeks 3 to 6 window.

For a fuller side-by-side, see M&A advisor versus business broker and our M&A advisor retainer guide.

Frequently asked questions

What do buyers look for in due diligence?

Buyers look for financial accuracy verified through quality of earnings, legal cleanliness, customer relationships that survive the transition, key-employee retention, IT and cybersecurity posture, insurance adequacy, and absence of undisclosed risks. Week 3 focuses on operational and commercial diligence, which is where most re-trades originate.

What happens in week 3 of due diligence?

Week 3 would include buyer-led customer calls with top 10 accounts, key-employee interviews under NDA, IT penetration testing, insurance policy review and loss-run analysis, and the final draft of the confirmatory QoE. This is the highest re-trade risk week in a typical middle-market process.

How long does buyer due diligence take?

Median middle-market diligence would run 60 to 90 days from LOI to close, per SRS Acquiom Deal Terms Study. Well-prepared sellers with a pre-signed QoE would compress that timeline by 10 to 15 percent.

What causes a purchase-price re-trade?

The most common re-trade triggers would include customer concentration risk surfaced in week 3, key-employee flight risk, undisclosed cybersecurity findings, insurance policy limits below industry benchmark, and QoE adjustments to trailing EBITDA. Approximately 30 percent of middle-market deals experience some form of re-trade between LOI and close per Bain M&A commentary.

Can I refuse a buyer’s request to speak with my customers?

You can, but it materially raises red-flag risk. Sophisticated buyers would treat refusal as a signal that the customer relationships are fragile. The better approach is to prepare your top 10 customers in advance, coach them on the coming call, and disguise the buyer identity as an industry consultant to preserve confidentiality.

What is a quality of earnings report and why does it matter for week 3?

A quality of earnings report is an accountant’s normalized view of EBITDA, working capital, and one-time items. The confirmatory QoE final draft would typically land at the end of week 3 and would set the final purchase-price adjustment. Sellers who pre-sign their own QoE before market give buyers less room to re-trade. See our QoE seller deep dive for practical guidance.

How do I prepare my key employees for buyer interviews?

Prepare key employees for a candid conversation about their intent to stay post-close, their views on the business, and knowledge transfer if you exit. Do not coach them to script answers. Buyers detect scripting immediately. Instead, level-set expectations, share the buyer’s identity in confidence where possible, and reassure them about their post-close role.

What if the buyer discovers a cybersecurity issue mid-diligence?

The buyer would typically pause the deal for 15 to 30 days while a remediation plan is put in place. In some cases the deal would proceed with a specific indemnity or escrow for the cyber issue. In others the deal terminates. Sellers who ran a proactive penetration test six months before going to market rarely encounter this scenario.

Methodology and data sources

This guide draws on published M&A practitioner literature, deal-terms data, and industry surveys from the following sources: Deloitte M&A Insights, PwC US Deals, KPMG Deal Advisory, EY Strategy and Transactions, SRS Acquiom Deal Terms Study, GF Data, PitchBook, Bain & Company M&A Report, IBM Cost of a Data Breach Report, Marsh Transactional Risk, AICPA-CIMA Forensic and Valuation Services, OPTIS Partners, American Bar Association Business Law Section, FTC Premerger Notification Program, Mercer M&A HR, and Congressional record for OBBBA statutory citations.

Named private-equity firms, investment banks, and advisory firms are drawn from public sources and each firm’s own website. Deal-timing patterns are drawn from advisor practice, buyer practice as discussed in the sources above, and CT Acquisitions’ own middle-market transaction experience.

All dollar figures, percentages, and multiples that concern private-company outcomes are stated in the conditional tense (“would,” “would range from”) because private-company data is inherently subject to variance and the specific facts of each transaction.

Disclaimer: This report is not an appraisal, not investment advice, not legal advice, not tax advice, not financial advice, and not a prediction of specific outcomes for any specific business or transaction. Owners considering a transaction should consult qualified M&A counsel, tax counsel, and their own financial advisors.