M&A due diligence: verifying data you can’t access

Week three of diligence, eleven at night. An associate has the target’s inventory schedule open in one window and a scanned warehouse report in the other. The two do not agree, by roughly four percent. She cannot call the warehouse manager or query the WMS to find out why. What she can do is flag the gap, write the question, and wait six days for a management response that will arrive as a paragraph in a PDF.

Nothing about that is unusual. It is the shape of every deal, and it is worth being plain about why, because a great deal of technology marketing in this category quietly assumes otherwise.

What can a buyer actually verify before close?

Almost nothing directly. No buyer connects to a seller’s systems during diligence. Competition rules limit what a buyer may see about a company it does not yet own, and the seller has neither the obligation nor much incentive to open its systems. What exists is a data room the seller assembled, the answers management chose to give, and whatever can be established independently.

That constraint shapes everything downstream. The valuation is built from it. So is the value creation plan, and so are the commitments an investment committee will be held to for the next three years.

What arrives in the data room arrives in whatever form the seller chooses. Clean exports, yes, sometimes. Also scanned documents, summary schedules, and PDFs of PDFs. Customer-level and pricing detail is frequently withheld or restricted to a clean team, which is precisely the data an overlap analysis wants.

Why can’t seller-provided evidence validate itself?

Because everything in the data room was selected by the seller. That is not an accusation, it is the nature of a sale process. It does mean that checking one seller document against another seller document tests internal consistency and nothing more. Two schedules that agree may both be wrong in the same direction.

The practical consequence is that trust cannot be tested directly before close. It can only be judged from two things: where a figure came from, and whether an independent source agrees with it.

What three jobs does independent third-party data do?

Public and licensed data is not background color in a deal. It is the only independent evidence a buyer holds before close, and it does three separate jobs that a deal team should be able to name.

Corroboration

Where filings, registries, customs records, or procurement awards agree with a data room figure, confidence in that figure rises. Where they disagree, the disagreement is itself the finding rather than a discrepancy to be smoothed over in the quality of earnings report.

Completeness

Independent sources give an outside inventory of what the target actually has. That is what allows a data room to be tested for omission rather than simply read front to back.

Discovery

Counterparties, liens, obligations, and enforcement records the seller never mentioned. A claim visible in a docket and absent from the disclosed litigation schedule is a very specific conversation to have before signing.

Coverage is uneven, and an honest platform says so. For a listed target in a major jurisdiction the independent picture is rich. For a private company that files little, or one that moves no physical goods, it is thin. The confidence score should state which one you are holding.

How do you know what a seller left out?

No system can know what was never disclosed. What a resolved data structure can do is make absence visible against three references, which turns an open worry into a bounded list someone can raise on a call.

The first is the evidence contradicting itself: a contract naming an entity that does not appear on the entity list, a customer in the revenue schedule who is missing from the receivables aging, or two documents whose totals simply do not reconcile.

The second is the buyer’s own estate. A supplier the buyer knows both companies use, sitting in the buyer’s vendor master and nowhere in what the seller provided.

The third is the independent record read alongside the request list, which surfaces a counterparty visible in customs data and absent from the supplier schedule, along with everything that was asked for and quietly never provided.

That is what a completeness measure is actually measuring. Not a general sense that things are missing, but named absences with a source.

What happens to the questions diligence cannot answer?

They get recorded as tests, with the check that will settle each one written down at the moment the finding is made. At close, that queue runs against actual transactions and asks whether the ledger supports the revenue schedule, whether the matched records reconcile, and whether the contracts are as they were represented.

Most deal teams do the opposite. The diligence model gets archived at signing, integration starts from a clean sheet, and by month four nobody can say which pre-close assumptions turned out to be right. In a Dataiku and Harris Poll survey of more than 800 data leaders, 95% said they could not fully trace an AI decision from input data through model output if a regulator asked. The same gap exists in deal work with no AI involved at all, and it costs more, because the number being traced is a purchase price.

The diligence model does not have to be abandoned at signing. It can be settled.

The six phases, from screening to proof

The full six-phase deal flow, from screening through Day One verification to commitment tracking, is in the PolyPhaze white paper Enabling trusted outcomes. Download the full M&A due diligence ebook for the complete six-phase framework.