M&A Due Diligence in 2026: Earnings Quality, Working Capital, Cyber Risk, and Deal Terms

Due diligence is the buyer's check on what the seller says it is selling. It runs between the letter of intent and the signed purchase agreement, with the buyer's accountants, lawyers, and specialists working through a virtual data room, a request list, and rounds of written questions. What they find ends up in the price and the purchase agreement, and now and then it ends the deal.

This guide is for owners and corporate buyers of private companies. It covers what each workstream looks for, a worked quality of earnings and working capital example, the contract, tax, people, and cyber checks that most often turn into disputes after closing, the 2026 antitrust filing rules, and how findings become deal terms. Our guide to AI in due diligence covers the review tools, and M&A integration picks up after closing.

What each workstream checks

Scope should follow the value. A software company's diligence is mostly about revenue quality, code ownership, and security; a distributor's is about inventory, working capital, and supplier terms. Experienced sellers sometimes commission their own quality of earnings report before going to market so the buyer's accountants start from a tested number.

Quality of earnings: a worked example

Buyers of private companies usually pay a multiple of adjusted EBITDA, so every dollar of recurring earnings the seller adds back is worth the multiple. A one-time $300,000 legal bill added back at 8 times EBITDA adds $2.4 million to the price. That is fair if the bill really was one-time and an overpayment if it recurs.

An illustration, with simplified numbers:

A $2.0 million disagreement about earnings becomes a $16.0 million disagreement about price. The adjustments in the example are the common ones:

• Planned savings are the easiest add-back to reject. If the buyer believes in them, an earnout or a price for part of them is more common than paying the full multiple upfront.
• Owner compensation cuts both ways. Owners who pay themselves little inflate EBITDA; owners who run personal expenses through the business depress it.
• Pulled-forward revenue shows up when monthly sales spike at year end and credit notes, returns, or a weak first quarter follow.
• Reserves for bad debts, inventory, and warranties are judgment calls, and sellers preparing for a sale have reasons to be optimistic about them.

A QoE team also runs a proof of cash, tying reported revenue to bank deposits, and lists debt-like items. In a cash-free, debt-free deal those items reduce the equity price just as debt does: unpaid bonuses and commissions earned before closing, customer deposits, deferred maintenance on equipment, unpaid taxes, and underfunded pensions.

This is where the money goes after closing, too. In Aon's 2026 claims study, breaches of the financial statements representation were 38% of paid losses on North American R&W policies placed since 2019, and 68% of the amount paid in 2025 was calculated on a multiple, meaning buyers showed that overstated earnings had cost them the multiple on each dollar. Our guide to business valuation methods covers how the multiple itself is set.

The working capital peg

Most private company deals are priced as if the business is delivered with no cash, no debt, and a normal amount of net working capital: receivables and inventory minus payables and accrued expenses. That normal amount is the peg. At closing, actual working capital is compared with it, and the price moves dollar for dollar by the difference, usually with a true-up a few months after closing and an independent accountant to settle disputes.

An illustration for a seasonal business:

• Average month-end working capital over the last 12 months is $10.0 million, which the buyer proposes as the peg.
• The seller proposes $9.0 million, the December level, when inventory and receivables are seasonally low.
• The deal closes with working capital of $8.5 million.

With the buyer's peg the price falls by $1.5 million; with the seller's, by $0.5 million. One definition moved $1.0 million.

The mechanism cancels out most things a seller could do before closing. Collecting receivables early or paying suppliers late changes cash, which the seller keeps, and lowers working capital by the same amount, which reduces the price. So the arguments are about the peg level and the accounting: whether the closing balance sheet uses the same reserve policies as the months that set the peg, and whether items such as deferred revenue count as working capital or as debt. Our guide to working capital management explains the underlying cycle.

Contracts, people, and tax

Deal structure decides which contract clauses matter. An asset purchase transfers contracts one by one, so every clause that bars assignment without consent comes into play. A stock purchase or a reverse triangular merger usually leaves contracts with the same legal entity, but change-of-control clauses still apply, and they let a customer, supplier, landlord, or software licensor terminate or reprice when ownership changes. Map the contracts by revenue and by dependence (a single-source supplier can matter as much as a large customer), and make the consents that matter a condition of closing or a factor in the price.

Other contract terms to read closely:

• Exclusivity and non-compete clauses that bind the target and its "affiliates," which after closing may include the buyer's whole group.
• Most-favored-customer pricing, minimum purchase commitments, and termination for convenience.
• IP ownership: signed invention assignments from founders, employees, and contractors, and, for software, an inventory of open-source components and their licenses. Under federal case law, nonexclusive patent and copyright licenses generally cannot be transferred without the licensor's consent even if the contract is silent.

On people, the checks that most often change terms are retention of the few employees the business depends on, workers classified as contractors who look like employees, and change-of-control payments. Under the golden parachute rules in Sections 280G and 4999, payments to executives contingent on a change of control that reach three times their average pay over the prior five years trigger a 20% excise tax on the excess over one times that average and cost the company its deduction. Private companies can avoid this with approval by more than 75% of disinterested shareholders, which has to be planned before closing. If the buyer plans layoffs, the federal WARN Act requires 60 days' notice for plant closings and mass layoffs at employers with 100 or more employees, and some states, including New York, require more.

In a stock purchase the buyer inherits the target's tax history. A frequent finding is uncollected sales tax: since the Supreme Court's 2018 Wayfair decision, states can require out-of-state sellers above economic thresholds to collect, and a company that never registered may owe years of tax, interest, and penalties. Asset purchases give the buyer a stepped-up tax basis and leave most historical liabilities behind, which is why structure is negotiated alongside price.

Cybersecurity: a risk that arrives with the company

A buyer acquires any intruder already inside the target's systems. Marriott bought Starwood in 2016; attackers had been in Starwood's reservation database since 2014, and the breach was detected in September 2018. The UK Information Commissioner's Office fined Marriott £18.4 million in October 2020, and in October 2024 Marriott settled with the FTC and 49 states plus the District of Columbia over breaches affecting about 344 million customers from 2014 to 2020, including $52 million paid to the states.

The Yahoo sale shows what happens when a problem surfaces between signing and closing. Verizon agreed to buy Yahoo's operating business in July 2016; Yahoo then disclosed breaches affecting more than a billion accounts. In the February 2017 amendment, the price fell by $350 million to about $4.48 billion, Yahoo kept half of certain post-closing breach liabilities, and the breaches were excluded from the material adverse effect definition so they could not be used to walk away.

For a target whose value depends on data or software, a security questionnaire is not enough. Ask for the incident log, recent penetration tests and how findings were fixed, access controls for administrators and vendors, and the cyber insurance policy. For larger deals, a compromise assessment, in which a specialist looks for signs of an active intruder, before closing can be worth its cost. Check privacy notices too: if the buyer plans to use customer data in new ways, the consents the target collected may not allow it. Our guides to cyber insurance and data privacy compliance go deeper.

Antitrust filing and gun jumping

Under the Hart-Scott-Rodino Act, deals closing on or after February 17, 2026 are reportable if they are valued above $133.9 million and the parties meet the size-of-person test (generally one with at least $26.8 million and the other with at least $267.8 million in sales or assets), or above $535.5 million regardless of size, unless an exemption applies. Filing fees start at $35,000 for deals under $189.6 million and reach $2.46 million for deals of $5.869 billion or more. The parties then wait, usually 30 days, before closing.

The expanded filing form the FTC introduced in February 2025 was vacated by a federal court in Texas on February 12, 2026. The Fifth Circuit declined in March to keep it in place during the appeal, so filers returned to the older form, and in May the court paused the appeal through December 31, 2026 while the FTC and DOJ consider a revised form. The agencies aim to propose new rules by the end of 2026, so check the current form before filing.

Until the waiting period ends, the buyer cannot take control of the target, and competitors cannot swap competitively sensitive information. In January 2025, oil producers XCL Resources, Verdun Oil, and EP Energy agreed to pay a record $5.6 million civil penalty after the purchase agreement gave the buyers approval rights over EP's ordinary-course spending and development work and the parties exchanged sensitive information before clearance. Keep interim operating covenants limited to protecting the value of the business, and route pricing, customer, and salary data through a clean team of outside advisers who report only aggregated findings.

Turning findings into deal terms

Each type of finding has a usual home in the purchase agreement:

• Recurring earnings problems lower the price, because the buyer will pay the multiple on them every year it owns the business.
• Uncertain upside, such as planned savings or a contract under negotiation, can move into an earnout. SRS Acquiom data summarized by DealLawyers found earnouts in 24% of 2025 deals, up from 22% in 2024. An earnout shifts the argument to after closing, so define the metric, the accounting, and what the buyer must do to run the business in good faith.
• Known, quantifiable exposures, such as the uncollected sales tax above, call for a special indemnity, often backed by its own escrow. Insurance will not pay for problems the buyer found.
• Unknown breaches of the seller's representations are covered by a general escrow, a representations and warranties insurance (RWI) policy, or both.

The same SRS data shows how RWI has changed escrows. In 2025, 88% of private-target deals had some escrow or holdback. Without RWI, escrows averaged 12.1% of transaction value (median 10.0%); with RWI they averaged 5.1% (median 2.8%). On an $88.8 million deal, the median escrow would drop from about $8.9 million to about $2.5 million. In 57% of RWI deals the seller's general representations did not survive closing at all, which leaves the policy as the buyer's only recovery for those breaches, apart from fraud.

Aon reported record North American R&W recoveries of more than $440 million in 2025, with a record median payment above $8.2 million. About 18% of policies bound from 2019 to 2023 have had at least one claim notification, and 51% of claims were notified more than 12 months after closing, often after the seller's escrow had expired. After financial statements, the largest shares of paid loss were material contracts (21%), compliance with laws (15.1%), and intellectual property (11%). Policies exclude what the buyer knew, purchase price adjustments, and covenant breaches. Underwriters also read the diligence reports and exclude areas the buyer did not investigate, so thin diligence leads to a policy with more holes in it.

Two other clauses deserve attention:

• Closing conditions and material adverse effect. If the business deteriorates between signing and closing, the buyer's exit usually depends on an MAE clause, and Delaware courts set a high bar. Akorn v. Fresenius (Del. Ch. October 2018, affirmed that December) was the first time the Court of Chancery let a buyer terminate on MAE grounds, after Akorn's earnings collapsed and whistleblower letters led to findings of serious FDA data integrity failures. Commentators, including this Harvard Law forum analysis, noted how extreme the facts were.
• Sandbagging, meaning whether a buyer can claim for a breach it knew about before closing. State law differs, and Delaware's position is not fully settled, so address it expressly in the agreement.

A starting request list

• Three years of financial statements, monthly income statements and balance sheets, and the latest trial balance
• Revenue by customer and product, with credit notes and returns after each year end
• Bank statements for a proof of cash
• Month-end working capital for at least 12 months, or 24 for seasonal businesses
• All debt, leases, guarantees, earned but unpaid bonuses and commissions, and customer deposits
• Tax returns, state sales tax registrations, and correspondence with tax authorities
• The largest customer and supplier contracts, with change-of-control, assignment, exclusivity, and pricing terms flagged
• Invention assignments from founders, employees, and contractors, and an open-source inventory for software
• Employment agreements, bonus and severance plans, and the contractor list
• The security incident log, penetration tests, cyber insurance policy, and privacy notices
• Litigation, regulatory correspondence, permits, and licenses

Findings should feed straight into the integration plan: a consent that was hard to get, a system that needs replacing, or a manager who is a flight risk is a day-one task for the integration team. Sellers can use the same list to prepare, which our guide to business succession covers. For deal strategy and financing, see our guides to strategic M&A, leveraged buyouts, and private equity due diligence, which covers evaluating funds and managers.

This guide is for informational purposes only and does not constitute legal, tax, accounting, or investment advice. Deal terms, filing thresholds, and case law change, and the QoE, working capital, and escrow figures above are illustrations with simplified assumptions. Thresholds and market data are as of September 2026. Work with qualified M&A counsel, accountants, and tax advisers on any transaction.