The 5 risks every due diligence misses, and how to spot and handle them systematically

In brief.
A well-run due diligence does not guarantee zero risk: it guarantees that the risks identified have actually been identified. Five blind spots come up most often, from change-of-control clauses scattered across the appendices to expired certifications. Spotting them is a matter of system, not of attention.

A well-run due diligence does not guarantee zero risk. It guarantees that the risks identified have been assessed, priced in or dealt with contractually before closing.

The problem: some risks are never identified. Not because the team lacks competence, but because they hide in the structural blind spots of any due diligence carried out under pressure of time and volume.

Here are the five risks M&A teams miss most often, and the method for spotting and handling them before the buyer or the court finds them for you.

Risk 1: Change-of-control clauses scattered across ancillary contracts

Why they slip through. Change-of-control clauses are usually looked for in the main contracts with strategic customers and suppliers. But they also appear in software licence agreements, commercial leases, secondary distribution agreements, partnership agreements and amendments. These documents arrive late in the data room, are lengthy and are often filed in sub-folders that nobody has time to open.

What it costs. An unidentified change-of-control clause can trigger a termination, a renegotiation or a penalty as soon as closing takes place. In cases documented by M&A practitioners, the post-closing impact of a missed clause can amount to several million euros of terminated revenue or imposed commercial discounts.

How to spot them systematically.

• [ ] Run a full-text search for “change in control”, “change of control”, “assignment” and “transfer” across all the documents in the data room: including appendices and amendments
• [ ] Check the trigger threshold (often a 30, 50 or 51% change in shareholding)
• [ ] Identify the party that benefits from the clause (customer, supplier, landlord, partner)
• [ ] Map the consequences: termination, renegotiation, penalty, pre-emption right
• [ ] Cross-check against revenue concentration: if the customer concerned accounts for more than 10% of revenue, the clause is critical

Risk 2: Expired or soon-to-expire certifications

Why they slip through. Certifications are usually listed in the target’s presentation documents: business plan, teaser, management presentation. Their expiry date, however, is found in the certificates themselves, often in a dedicated sub-folder of the data room. The link between the declared list and documentary verification is rarely made systematically.

What it costs. An expired ISO 27001 certification at a tech target can invalidate customer contracts that require this certification as a condition for continuing the business relationship. An expired quality certification at an industrial site can trigger post-closing regulatory inspections or contractual penalties from suppliers.

How to spot them systematically.

• [ ] Extract every validity date from the certificates in the data room
• [ ] Compare the list of certifications declared in the business plan with the certificates actually present
• [ ] Identify certifications that are declared but missing from the data room (a sign of non-renewal)
• [ ] Flag any certification expiring within 12 months after closing: renewing it falls to the buyer
• [ ] Check whether any customer contracts make their continuation conditional on a specific certification

Risk 3: Inconsistencies between documents from the same period

Why they slip through. Each strand of the due diligence is often assigned to a different analyst: finance, legal, tax, operations. Each reads their documents within their own area. Nobody has the overall view needed to cross-check information between strands and detect inconsistencies across documents.

What it costs. Revenue declared in the business plan that does not match the audited financial statements. A headcount stated in the management presentation that differs from the employment contracts in the data room. An operating margin reconstructed in the memo that cannot be reconciled with the tax returns. These inconsistencies are not always fraudulent: they often reveal accounting practices, unexplained restatements or off-balance-sheet commitments.

How to spot them systematically.

• [ ] Cross-check key figures (revenue, EBITDA, headcount, customer receivables) across at least three different sources for each financial year
• [ ] Identify any discrepancy greater than 5% between documents covering the same period
• [ ] Check that management’s statements in interviews are consistent with the figures in the documents
• [ ] Compare the stated accounting policy with the practices observable in the tax returns
• [ ] Systematically add a Q&A question on any discrepancy above the defined materiality threshold

Risk 4: Off-balance-sheet commitments not disclosed in the financial statements

Why they slip through. The most visible off-balance-sheet commitments (bank guarantees, guarantees given to third parties, buy-back commitments) appear in the notes to the accounts. But some less visible commitments are hidden in letters, memoranda of understanding, term sheets that never came to fruition, and partially performed promises to sell. These documents are not always in the data room: sometimes because they were forgotten, sometimes because the seller did not consider them significant.

What it costs. A guarantee given to a business partner, a commitment to buy back shares from a minority shareholder, a promise to maintain jobs set out in a letter: these can represent significant liabilities that appear nowhere in the financial statements presented.

How to spot them systematically.

• [ ] Request in the Q&A a comprehensive statement of off-balance-sheet commitments, including informal ones
• [ ] Search the emails and correspondence in the data room for the terms “guarantee”, “commitment”, “promise” and “letter of intent”
• [ ] Check the notes to the last three audited financial years line by line
• [ ] Ask management whether any verbal promises or informal agreements exist
• [ ] Include a specific indemnity on this point in the closing documentation

Risk 5: Underestimated customer and supplier concentration

Why it slips through. Concentration is usually analysed on aggregate figures: the top 10 customers account for X% of revenue. What the aggregate analysis hides is the real operational dependency. A customer accounting for 15% of revenue can account for 40% of the margin if its commercial terms are more favourable. A supplier accounting for 12% of purchases may be the only qualified supplier for a critical component, and its failure stops production.

What it costs. An acquisition made on the basis of an optimistic business plan, in which the real concentration was never challenged, can lead to an abrupt revision of the business case if a major customer terminates or a critical supplier defaults within 18 months after closing.

How to spot them systematically.

• [ ] Reconstruct the margin by customer and by segment: not just revenue
• [ ] Identify single-source suppliers for critical components or services
• [ ] Check the remaining term of contracts with the top 5 customers (renewal clause, exit terms)
• [ ] Analyse how concentration has changed over 3 financial years: rising concentration is a warning sign
• [ ] Ask management about ongoing negotiations with the concentrated customers

The method: from checklist to system

These five risks have one thing in common: they can be identified before closing if document coverage is systematic. Not partial. Not prioritised by intuition. Systematic.

Optivalue.ai analyses every document in a data room (including sub-folders, appendices and amendments) and produces a map of critical clauses, inconsistencies across documents and expired certifications, with the exact source for each item identified. What used to take two days of manual analysis is available in 45 minutes. Coverage rises from 70% to 100%.

Your analysts spend less time searching. They spend more time analysing what has been found, and building the investment thesis on exhaustive foundations.

Optivalue.ai systematically covers the 5 most common blind spots in due diligence. A dedicated private instance per mandate, hosting in France. Request a personalised demo →