This private equity due diligence checklist helps deal partners review marketing, competition, customer experience, cybersecurity, technology and compliance before committing to a target. Every item names its area and whether it is visible from outside or needs access. Use the evidence to frame questions, assign owners and plan the work after close.
In short
- Each checklist item names an area and whether it is visible from outside or needs access.
- Keep evidence, unresolved questions and confirmed findings distinct.
- Copy or print the checklist, assign owners and carry supported findings into the plan after close.
What should be included in a due diligence checklist?
Include the question to answer, the evidence to collect and the access required. The checklist below covers Meo’s six areas: marketing, competition, customer experience, cybersecurity, technology and compliance.
Record whether customers can find the target in search, maps and AI answers for the agreed markets and queries.
Compare public listings, reviews, ads and landing pages; keep the source, observation date and customer journey for each gap.
Request paid-account and conversion records to establish actual spend, acquisition cost and revenue by channel.
Compare named peers on the same searches, locations and observation window; record public pricing and messaging differences.
Label third-party ad-spend estimates as estimates and preserve their source and period.
Request realized pricing, customer retention and sales records to test the commercial interpretation of public comparisons.
With an agreed mystery-shop scope, follow the public call, text and form journey; record routing, response and follow-up.
Record booking obstacles and inconsistent information across the target’s public contact channels.
Request complete call and funnel records before reporting answer rate across all calls or a conversion rate.
Use passive public sources to map domains, certificates and internet-facing endpoints; record evidence dates and ownership uncertainty.
Flag public signs of exposure for investigation and distinguish an observation from a confirmed vulnerability.
Request incident history and internal control evidence; agree written authorization and scope before any penetration testing.
Map front ends, shared templates, visible tags, customer-facing apps, domains and hosting clues.
Record page-performance and measurement defects, including whether a shared template repeats the issue.
Request app internals, integration maps, code, vendor contracts and SaaS spend to assess technical debt and dependencies.
Preserve public consent wording, privacy notices, accessibility observations and review practices as evidence for counsel.
Trace public forms and tracking tags to the pages and customer journeys where a potential compliance question arises.
Request consent and opt-out records, policies and control evidence; refer legal conclusions to counsel.
Source: Meo Advisors checklist. As of October 2026.
These areas complement the deal team’s financial, legal and other specialist work. Compliance observations are a legal reference, not legal advice.
What is a due diligence checklist?
A due diligence checklist is a structured set of questions and evidence requests used to assess a target before a transaction. It helps the deal team track what is known, what remains unresolved and who owns the next step.
This checklist follows the six areas of private equity due diligence below.
- 01Marketing & Digital VisibilityCan customers find the target in search, maps and AI answers?
- 02CompetitionWhich peers win the target’s customers, and how?
- 03CX & Call CentersWhat happens when a customer calls, texts or fills in a form?
- 04CybersecurityWhat can an attacker see from the internet?
- 05Technology & InfrastructureWhat does it run on, and where is the technical debt?
- 06Compliance & RiskWhere do consent, privacy or accessibility rules create exposure?
How should a deal team use this checklist?
Start with the deal question and the areas in scope. Work through public evidence first, then turn unresolved questions into precise access requests.
- Name an owner for each item and record the evidence source, observation date and limits.
- Mark each item as supported, unresolved or outside scope. An empty evidence field is an open question.
- For an access request, name the record, system or authorized test that would answer the question.
- Rank supported findings on impact, effort, confidence and scope, then assign the work after close.
What can be checked from public evidence alone?
Public pages can show search visibility, listings, ads, reviews, contact journeys, consent wording and front-end technology. Passive public sources can show parts of the external cyber footprint. Those observations help frame questions; they do not establish internal performance or control effectiveness.
Before authorization we use passive public sources only: DNS, certificate transparency, third-party internet-scan datasets, and the target’s public pages at normal browsing rates. No port scans, vulnerability scans or login attempts without written authorization.
Which checklist items need authorized access?
Internal performance, code, contracts, policies and system controls need records or authorized access. The access tags above identify those requests before the team treats an outside observation as a conclusion.
Access-gated checks run only on request, with authorization.
What we can’t see from outside
- Conversion rate, acquisition cost and revenue by channel
- Answer rate across all calls and complete customer-funnel records
- App internals, data integrations, code and technical debt
- Vendor contracts, SaaS spend, consent records and internal control evidence
Each is listed with the record that would answer it. Missing evidence is never scored as a failure.
What are red flags in due diligence?
Red flags are supported findings that could change the deal decision or the work needed after close. Their significance depends on evidence, scope and the target’s business.
- Customer journeys that repeatedly fail at contact, routing or booking.
- Public exposure that needs an owner and authorized investigation.
- A defect repeated across shared site templates or measurement tags.
- Consent, privacy or accessibility observations that require counsel’s review.
- Public estimates presented as actual spend, revenue or conversion performance.
Missing evidence is never scored as a failure. Record the uncertainty and the request that could resolve it.
Copy or print the checklist
Select and copy the visible checklist into your deal workspace, or use your browser’s Print command to save the page. Keep the area and access tags beside each item, then add your owner, status and evidence fields.
For deeper technical work, use the IT due diligence checklist and IT due diligence guide. Follow the cybersecurity due diligence checklist for cyber evidence and the TCPA compliance checklist for consent and opt-out records.
Run a free instant audit on a target.
A free, automated snapshot from public information: marketing, search and CX.
Meo Advisors Editorial writes and maintains this page. Its numbers are Meo Advisors’ own statements or cited external benchmarks, and every mock is labelled Illustrative. See the editorial policy and corrections process.