The CFO's Due Diligence Checklist: Questions Every Finance Chief Must Answer

The Moment of Maximum Scrutiny

Due diligence is the moment when every financial assumption your business has ever made is tested against evidence. Revenue schedules are cross-referenced against contracts. Cost classifications are queried against actual invoices. Working capital movements are reconstructed month by month. For the CFO, this is both the greatest test of the finance function's rigour and the highest-stakes communication exercise of a transaction.

The questions in this framework are not hypothetical. They are drawn from actual financial due diligence workstreams conducted by the major advisory firms. An acquirer's financial due diligence team will work through all six of these areas systematically, and a sophisticated institutional investor conducting pre-investment diligence will cover the majority of them. The difference between a smooth process and a deal re-price often comes down to whether the target CFO has anticipated these questions and prepared credible, consistent answers in advance.

This checklist is structured as a self-assessment tool. Work through each section before your next transaction or fundraise and note any question where the honest answer is "I am not sure" or "we do not track that." Those gaps are precisely where a diligence team will press hardest, and they are also the areas where a fractional CFO engagement in the months before a process can materially improve your outcome.

Workstream 1: Revenue Quality

Revenue quality is the first and most heavily scrutinised workstream in any financial due diligence exercise. The central question is not simply how much revenue the business generates, but how reliable, repeatable and defensible that revenue is. Reported revenue can look identical from the outside while representing very different levels of underlying business quality.

1. Revenue recognition policy: On what basis does the company recognise revenue? Is the accounting policy compliant with IFRS 15 (or FRS 102 for smaller entities)? Is revenue recognised at a point in time or over time, and is that treatment defensible for each product or service line?
2. Customer concentration: What percentage of revenue comes from the top 5 and top 10 customers? Is any single customer above 20% of revenue? What is the contractual status of each concentrated relationship?
3. Recurring vs. one-off split: Of reported revenue, what proportion is genuinely recurring (subscription, retainer, licence) versus one-off or project-based? Has the recurring/one-off split changed materially over the last three years?
4. Average contract length: For recurring revenue, what is the weighted average remaining contract term across the portfolio? What proportion of contracts are rolling monthly versus annual versus multi-year?
5. Churn rate: What is the gross revenue churn rate (value of contracts lost or not renewed as a percentage of opening ARR) and the net revenue retention rate (including expansion)? Are these calculated correctly and consistently?
6. Revenue cohort analysis: Can the business present cohort revenue data showing how much revenue each annual intake of customers generates over subsequent periods? Does retention improve or deteriorate with cohort maturity?
7. Multi-element arrangement treatment: Where a contract includes multiple deliverables (software plus implementation plus support), how is the total contract value allocated between elements? Is the allocation based on standalone selling prices?
8. Variable consideration: Does any revenue include variable elements (performance bonuses, volume rebates, usage-based pricing)? How is variable consideration estimated and when is the constraint lifted?
9. Material contract risks: Are there any material contracts with termination for convenience clauses, change-of-control provisions, price resets, or step-down provisions that would be triggered by the proposed transaction?
10. Seasonality: Is revenue seasonal? If so, can the business provide a monthly revenue bridge for the last three years demonstrating the seasonal pattern and explaining any deviations from it?

Workstream 2: Cost Structure

Cost due diligence is primarily about distinguishing the true ongoing cost base from one-off, non-recurring, or management-adjusted items. The question is not just what the business has spent, but what it will need to spend as a stand-alone entity going forward.

1. Fully loaded headcount costs: Does the P&L capture all employment costs including employer's NIC, pension contributions, benefits in kind, and bonus accruals? Are any employees paid through alternative structures that reduce apparent payroll?
2. Capitalised vs. expensed development costs: What is the capitalisation policy for R&D expenditure? What proportion of total development cost is capitalised versus expensed? Is the policy consistently applied and defensible under IAS 38?
3. Non-recurring items in the P&L: Which items in selling, general and administrative expenses are genuinely non-recurring? Has management provided an addback schedule, and is each addback supported by evidence that the cost will not recur?
4. COGS composition and gross margin trend: What is the composition of cost of revenue? Has gross margin improved, deteriorated or remained stable over the last three years, and what drives the trend?
5. Shared service cost allocations: Are any costs allocated from a parent entity or shared services arrangement? What is the basis of allocation? Would these costs need to be replaced if the entity stood alone?
6. Lease obligations: What operating lease commitments does the business have? Under IFRS 16, right-of-use assets and lease liabilities should be on the balance sheet. Are any leases off-balance-sheet and, if so, is that treatment justified?
7. One-off items in the current year: Are there any material one-off costs in the current or prior financial year that have been excluded from normalised EBITDA? Is the exclusion commercially supportable?
8. Opex as a percentage of revenue trend: How have each of the major operating cost categories (sales and marketing, R&D, G&A) trended as a percentage of revenue over the last three years? Is the business demonstrating operating leverage?
9. Management incentive plan costs: Are there management bonus plans, long-term incentive plans, or share option schemes? Are they fully expensed in the P&L (IFRS 2 for equity-settled schemes)?
10. Pension obligations: Does the business have any defined benefit pension obligations? If so, what is the current funded status, and has an actuarial valuation been conducted within the last three years?

Workstream 3: Working Capital

Working capital normalisation is one of the most technically complex and frequently disputed areas in a transaction. The acquirer will want to agree a normalised working capital peg against which the closing balance sheet is measured, and any shortfall at close results in a pound-for-pound price adjustment. Understanding your working capital dynamics in advance is essential to avoiding a post-close dispute.

1. Normalised working capital level: What is the average monthly working capital requirement over the last twelve months? Has this been calculated consistently, excluding any exceptional items or unusual timing?
2. Seasonal patterns: Does working capital fluctuate materially across the year? If so, the normalised peg should be based on an average, not a spot measurement at a convenient low point.
3. DSO trend: What is the days sales outstanding trend over the last twelve months? Is it improving or deteriorating, and what drives the change?
4. DPO trend: What is the days payable outstanding trend? Are supplier payment terms being stretched, and if so, is that structural or a temporary working capital management decision that will unwind post-close?
5. Deferred revenue movements: How has deferred revenue moved over the period? Deferred revenue represents cash received but not yet recognised. A decline in deferred revenue can mask slowing sales momentum.
6. Unbilled revenue: Does the business carry unbilled receivables (accrued income)? What is the basis for estimating these, and how quickly do they convert to billed receivables and then to cash?
7. Provisions adequacy: Are provisions for bad debts, contract losses, and warranty claims adequate and consistently calculated? Has the provision methodology changed recently?
8. Intercompany eliminations: In a group context, have all intercompany balances been correctly eliminated in the consolidated accounts? Are there any material intercompany loans that will need to be settled or restructured?
9. Restricted cash: Is any cash on the balance sheet restricted (ring-fenced for regulatory purposes, pledged as security, or subject to a restricted account arrangement)? Restricted cash should not be included in the freely available cash balance.
10. Off-balance-sheet commitments: Are there any purchase commitments, take-or-pay arrangements, or other executory contracts not reflected in the balance sheet that represent future cash obligations?

Workstream 4: Balance Sheet Completeness

Balance sheet due diligence is concerned with identifying liabilities and commitments that are missing from, or understated in, the reported balance sheet. Acquirers are particularly focused on contingent liabilities and off-balance-sheet arrangements that might crystallise post-close.

1. Completeness of liabilities: Has management provided a representation that all known liabilities are reflected in the balance sheet? Are there any outstanding invoices not yet accrued, legal claims not yet quantified, or commitments not yet recognised?
2. Contingent liabilities: What contingent liabilities exist (litigation, warranty claims, guarantee obligations, indemnities given to third parties)? What is the estimated probability and quantum of each?
3. Regulatory capital requirements: If the business operates in a regulated sector, does it hold the required regulatory capital? Has it been in breach of any regulatory capital thresholds at any point in the last three years?
4. Deferred tax: What are the components of the deferred tax asset and liability? Has the recoverability of any deferred tax asset been considered against the probability of sufficient future taxable profit?
5. Goodwill impairment testing: If the balance sheet includes goodwill, has an impairment test been conducted in accordance with IAS 36? What are the key assumptions, and how sensitive is the valuation to changes in those assumptions?
6. Related party balances: Are there any balances with related parties (directors, shareholders, or associated entities) on the balance sheet? Are the terms commercial, and will these balances be settled before close?
7. Off-balance-sheet arrangements: Are there any special purpose vehicles, joint ventures, or arrangements structured to keep liabilities off the consolidated balance sheet? Do they qualify for deconsolidation under IFRS 10?
8. Lease liabilities under IFRS 16: Have all leases been correctly identified and capitalised? Are there any leases treated as short-term or low-value exemptions that do not qualify for those exemptions?
9. Earn-out liabilities: If the company has made prior acquisitions with earn-out provisions, are the earn-out liabilities correctly valued on the balance sheet in accordance with IFRS 3?
10. Legal provisions: Are legal provisions (for litigation, regulatory fines, employment claims) adequate? Has external legal counsel provided an assessment of material outstanding matters?

Workstream 5: Tax

Tax due diligence covers both the adequacy of historical tax provisions and the existence of open risks that might crystallise after a transaction. A common structure in UK M&A is the use of a tax deed (or tax covenant) to allocate pre-close tax liabilities to the seller, but only where those liabilities have been adequately identified in the diligence process.

1. Current year provision vs. return: Is the current year tax provision consistent with the tax return for that period? Are there any significant differences between the provision and the return, and if so, what explains them?
2. Open HMRC enquiries: Are there any open HMRC enquiries, investigations or disputes? At what stage is each enquiry, and what is the estimated quantum at risk?
3. R&D claim status: Has the business claimed R&D tax credits or relief under the SME or RDEC scheme? Have all claims been submitted, and is there any risk of challenge from HMRC following the heightened compliance activity in the R&D relief area?
4. Transfer pricing documentation: If the business operates across multiple jurisdictions, is there transfer pricing documentation in place covering all intercompany transactions? Is the documentation contemporaneous or reconstructed?
5. VAT compliance: Is the business compliant with its VAT obligations, including Making Tax Digital? Are there any partially exempt businesses where the partial exemption calculation has not been reviewed recently?
6. Loss availability: What is the quantum and nature of carried-forward tax losses? Are they subject to any restriction on use (change of ownership provisions, loss limitation rules)? Would a transaction trigger the restrictions?
7. Deferred tax asset recoverability: If the balance sheet includes a deferred tax asset, is there sufficient evidence of future taxable profit to support its recognition?
8. Overseas tax risk: Does the business have any overseas operations, employees or customers that might give rise to permanent establishment risk or overseas tax obligations not currently recognised?
9. PAYE and NIC compliance: Has the business correctly operated PAYE and NIC on all employee remuneration, including benefits in kind? Are there any IR35 off-payroll working arrangements that have not been correctly assessed?
10. Crypto asset tax positions: If the business holds or transacts in cryptoassets, has HMRC's guidance on cryptoasset taxation been followed? Are token receipts correctly characterised as income or capital?

Workstream 6: Regulatory

For regulated businesses in financial services, the regulatory workstream can be as significant as the financial workstream. A regulatory problem identified post-close can invalidate the entire rationale for the deal, and in the worst cases, trigger an FCA requirement for prior consent that was not obtained.

1. FCA authorisation status and scope: Is the business authorised by the FCA, and does its current Part 4A Permission cover all regulated activities it is actually carrying on? Are there any activities being conducted that are not within the permission?
2. Regulatory capital headroom: What is the business's current own funds position relative to its regulatory capital requirement? What is the headroom, and has the business been in breach at any point in the last three years?
3. Pending regulatory action: Is there any ongoing supervisory engagement, enforcement action, or voluntary requirement imposed by the FCA? Has the FCA made any requests for information or attestations in the last twelve months?
4. Consumer Duty compliance status: Has the business completed its Consumer Duty implementation, including the fair value assessments and consumer outcomes monitoring? Is there evidence of an annual board review of Consumer Duty compliance?
5. AML programme effectiveness: Has the business conducted a recent independent review of its anti-money laundering and know your customer programme? Are there any Suspicious Activity Reports (SARs) filed in the last year that relate to systemic issues rather than individual cases?
6. Audit findings outstanding: Are there any material findings from the most recent internal or external audit that remain unresolved? Has management provided a formal response and remediation plan?
7. Regulatory reporting compliance: Is the business compliant with all regulatory reporting obligations (FCA returns, CMAR, PSD returns, etc.)? Are there any instances of late filing or material restatement?
8. Upcoming licence renewals: Are there any licences, permissions or registrations due for renewal in the next twelve months, including FCA permissions, data protection registrations, or sector-specific licences?
9. Personal liability exposure: Are any senior managers or approved persons subject to personal FCA or regulatory investigation? Would any such investigation constitute a material adverse change under the transaction documents?
10. Compliance cost as a percentage of revenue: What is the total cost of compliance (compliance function headcount, regulatory reporting, audit and monitoring) as a percentage of revenue? Is this consistent with peer benchmarks, and is it trending up or down?

How to Use This Framework

This checklist works best when used as a gap analysis in the three to six months before a transaction or fundraise. For each of the 60 questions, you should be able to provide a clear, documented answer supported by either a schedule from the management accounts or a note in the statutory accounts. Questions where you cannot immediately provide a supported answer represent preparation priorities.

The most common gaps we encounter when working with businesses preparing for a first institutional fundraise or acquisition process are: (i) the absence of a customer-level revenue schedule that breaks out recurring and one-off revenue by cohort; (ii) no normalised working capital analysis, meaning the business has never calculated its average monthly working capital requirement; (iii) IFRS 16 not implemented despite the business having material operating leases; and (iv) R&D tax credit claims that have been submitted without adequate technical documentation, creating retrospective enquiry risk.

A virtual data room that has been pre-populated with well-organised, clearly labelled documents across all six workstreams significantly accelerates the due diligence process and reduces the number of clarification questions from the buyer's advisers. Each clarification round adds time and cost to the process and creates additional opportunities for adverse findings to emerge. Preparation is not just about passing due diligence — it is about controlling the pace and narrative of the process.

Key Takeaways

• Due diligence covers six workstreams: revenue quality, cost structure, working capital, balance sheet completeness, tax, and regulatory. Each carries distinct risks and requires distinct preparation.
• Revenue quality questions probe not just the quantum of revenue but its durability, concentration risk, and accounting treatment. Customer cohort data and churn metrics are consistently requested and consistently absent.
• Working capital normalisation is the most common source of post-close price disputes. CFOs must understand their average monthly working capital requirement before entering a process.
• Balance sheet completeness work focuses on contingent liabilities and off-balance-sheet commitments that could materially change the deal economics. Representations and warranties insurance does not substitute for proper disclosure.
• Tax due diligence in 2024 gives heightened attention to R&D claims following HMRC's compliance campaign, IR35 compliance, and cryptoasset tax treatment for fintech businesses.
• For regulated businesses, the regulatory workstream can be transaction-critical. FCA permission scope mismatches and Consumer Duty implementation gaps are areas of current focus.
• Use this checklist as a self-assessment three to six months before a transaction, commission a vendor due diligence report for high-value exits, and invest in the finance function capacity to produce well-organised, documented answers to each question.