How diligence works
The outside-in audit needs no logins, integrations or management time.
Access-gated checks (HIPAA, SaaS spend, internal systems, penetration testing) run only on request, with authorization.
Outside-in diligence reviews a target through public evidence before or alongside access to its systems. Meo Advisors agrees the deal question, gathers passive evidence and records findings with their limits. Checks inside the target run only on request with authorization. Missing evidence becomes an open question with a requested record, never an automatic failure.
In short
- Agree the deal question, collect public evidence, test, rank and deliver.
- Access-gated checks run only on request, with authorization.
- Missing evidence is never scored as a failure.
Who conducts due diligence?
The sponsor owns the deal decision and agrees the scope. Meo Advisors conducts the outside-in review. Internal tests run only under written authorization, and legal questions go to counsel.
- ScopeDeal question, markets and peers
- CollectPublic evidence: sites, search, ads, reviews
- TestMystery shops and an external exposure review
- RankEvery finding scored on impact, effort, confidence and scope
- Deliver100-day plan, risk register, scorecard
Collect, test and rank Marketing and CX: partial readout within hours, initial audit in 24–72 hours.
The work can start before LOI, during exclusivity or after close.
Each step closes with a sponsor sign-off. We agree the timetable for the other areas at scoping. Missing evidence is never scored as a failure.
Penetration testing runs only on request, with authorization.
The method applies across private equity due diligence. Each finding records the evidence behind it, its limits and the action it supports; the sponsor signs off as the work progresses.
Compare operating scope and delivery responsibility in the guide to choosing a due diligence firm.
Does outside-in diligence need access to the target?
The outside-in audit needs no logins, integrations or management time. It reads public evidence and uses sponsor-agreed customer-side tests; it cannot establish what happens inside systems the target has not authorized us to review.
Access-gated checks run only on request, with authorization.
| Visible from outside | Needs authorized access |
|---|---|
| Front end and templates | App internals |
| Tags and measurement | Data integrations |
| Customer-facing apps | Code and technical debt |
| Domains and hosting | Vendor contracts and SaaS spend |
The free instant audit is the automated starting point for marketing, search and CX. Its result is a starting question for diligence, not a substitute for the records needed to resolve it.
Which checks need authorization?
HIPAA work, SaaS spend, internal systems and penetration testing need an agreed scope and authorized access. Penetration testing requires written authorization before any active testing begins.
Before authorization we use passive public sources only: DNS, certificate transparency, third-party internet-scan datasets, and the target’s public pages at normal browsing rates. No port scans, vulnerability scans or login attempts without written authorization.
- A HIPAA risk assessment needs the systems, records and engagement terms agreed with the target.
- A SaaS spend audit needs contracts, invoices and usage evidence.
- Authorized penetration testing needs written permission covering the systems and permitted tests.
Insured for cyber, general and professional liability. BAAs in place as needed. HIPAA audits available.
What can't be seen from the outside?
The outside view cannot establish internal conversion, revenue attribution or the answer rate across all calls. Each unresolved item stays an open question, paired with the record or authorized test that would settle it.
What we can’t see from outside
- Conversion rate and acquisition cost
- Revenue by channel
- Answer rate across all calls
Each is listed with the record that would answer it. Missing evidence is never scored as a failure.
Use the private equity due diligence checklist to separate visible evidence from requests that need access.
The diligence resources collect checklists and sample outputs for scoping. Dated diligence analysis and method notes explain how new public evidence can change a check or an open question.
When can the work start?
The work can start before LOI, during exclusivity or after close. Scoping sets the deal question, markets, peers, permissions and the timetable for each area; access-gated work waits for authorization.
What does the method deliver?
Each area in scope ends in a plan, a prioritized risk register and a scorecard. Evidence, ownership and the measure of completion travel with the finding into implementation.
What we deliver
Our Diligence Deliverable: The 100-Day Actionable Value Creation Plan, Hardening Process, & Prioritized Risk Register
Review the sample diligence deliverables and how findings become a 100-day value creation and hardening plan.
Run a free instant audit on a target.
A free, automated snapshot from public information: marketing, search and CX. Deep dives from $15K.
Meo Advisors Editorial writes and maintains this page. Its numbers are Meo Advisors’ own statements or cited external benchmarks, and every mock is labelled Illustrative. See the editorial policy and corrections process.