A Short 100-Question Diligence Checklist

Then consider it a score out of 100

For example "Has a co-founder stepped down?". A single yes or no answer doesn't tell you much. But an answer like "Yes, we had two technical co-founders who fundamentally disagreed on technical strategy" should be explored. Why did the disagree? What was the ongoing impact?

This list is also full of useless questions that tell more about the potential investor than the actual company. For instance:

>>If the company succeeds, does everyone—employees, managers, founders, investors, suppliers, customers—get about what they deserve?

"What they deserve"??? Really? That says nothing about the company. That only tells you whether or not the company's reward scheme comports with your personal notion of fairness. It is more about politics than investment potential. But maybe that's what people want these days.

That list would be the section headings. The individual questions in each section are just drilling down on the details.

It's real enough, I've been involved in a few M&A and I'd say that there is always a reason why we've done it and that reason varies but focuses on a section of questions at a time.

Not all of these are always important. Sometimes you're acquiring the IP, or the customers, or the skilled people, or the exec team. Know what you're trying to acquire and why, as which questions matter to you will vary.

And then of course the answer itself is kind of irrelevant as long as you get the feeling that it gives you information, it's honest, it's not trying to cover up something, etc.

The most important part(s) of doing due diligence is that it has to be done and diligently by someone you trust. Outsourcing it to the subject of the whole process, and reducing it to checklists makes it 10/10 easy to game. It has to be done to the depth, detail, understanding necessary to have confidence.

That said checklists are very important to establish the possible areas for drilling down. But since time is always a premium it doesn't make sense to do everything just because it's on the list. (Hence your question of getting a shorter list.) But that list has to be tailored to the situation - as other comments noted.

And, obviously, this is why many people try to invest in things they know, and/or focus on areas they know. (And then fail if they ignore the tough questions that stresses them out, or forgot to diversify, or forgot to do reference class estimation and then class appropriate risk weighting. In other words the planning fallacy.)

The ten question subset would consist of things like: are business fundamentals sound, and is there a growth plan? is the existing leadership of quality to effect a step change over the next few years leading to exit, or will we need to bring in professional management? is the tech sound, secure and scalable (this is often least important)? is there regulatory exposure, and if so, how has that been addressed?

In the context of M&A or strategic investment, and considering the range of topics, 100 seems like a good starting point.

In this case, those two questions tell someone a bunch of things: whether bad employees might stick around for a long time, whether good employees might want to leave for somewhere with better career prospects, whether there is good process in place to manage and accelerate employee career growth, whether management is doing their jobs right, whether there are wrong incentives or motivators (for example promotions tied to performance alone which incentivizes accomplishing empty goals that promote politically-savvy employees and leave the company hollow).

Famously toxic companies have processes designed to use fear and politics to keep employees so worried about their jobs that they can barely do them, much less contribute to the improvement of the company. Those companies can still survive and give good returns, but they have to trade on market power, and on a personal note they're often unethical.

I've been on the receiving end of a very intrusive one, and it was essentially an arduous multi-week long audit. (IIRC four weeks of evidence collection, followed by ~8 days of intensive interviews.) With the main difference to audits being that on the requesting side, there was someone who actually understood how security, human processes and business all intersect.

7 audits in one year was a bit much.