A mergers and acquisitions (M&A) transaction is one of the highest-impact decisions a company can make, and also one of the most exposed to risk. The price a buyer agrees to pay depends entirely on the quality of the information underpinning the valuation. Due diligence is the structured process of verifying that information: it confirms that the target company is what it claims to be and surfaces the liabilities, contingencies and weaknesses that the seller did not highlight in the information memorandum.
It is worth distinguishing from the outset between the two legal structures most common in Spanish practice. A statutory merger by absorption, governed by Royal Decree-Law 5/2023 on structural modifications of commercial companies, means that the absorbed company transfers its assets and liabilities as a whole to the absorbing company and is extinguished without liquidation, with its shareholders receiving shares in the acquirer. An acquisition through the purchase of shares or assets keeps the target company alive under new ownership. The structure chosen determines the tax treatment, liability for hidden obligations and the scope of the due diligence.
Financial due diligence
The financial review is the quantitative core of the transaction. Its purpose is not to audit the accounts — the statutory auditor has already done that — but to understand the quality of earnings: what proportion of the EBITDA is recurring and sustainable, and what proportion reflects one-off income, accounting adjustments or aggressive revenue recognition policies. The analyst normalises EBITDA by stripping out extraordinary items, owner-specific costs that will not continue under new ownership and timing effects.
The second focus is normalised working capital: how much cash the business needs to operate without disruption. A company that closes the financial year with artificially low working capital — collecting earlier and paying later than usual — is transferring a treasury problem to the buyer. That is why contracts typically include a price adjustment mechanism at closing based on a target working capital figure and on net financial debt. The third focus is the conversion of profit into free cash flow, which determines the actual capacity to service the acquisition debt.
A concept worth mastering is the distinction between enterprise value and equity value. The deal is typically structured around a multiple of normalised EBITDA — "six times EBITDA", for example — which gives the enterprise value. The equity price is derived by deducting net financial debt and adjusting for working capital. The usual mechanisms are the locked box, where the price is fixed at a past audited balance sheet date and the buyer takes on the cash generation from that date onwards, or completion accounts, where debt and working capital are recalculated at the actual closing date. The choice between the two determines who bears the risk during the intervening period and is one of the most heavily negotiated points in the contract.
Legal due diligence
The legal review verifies the ownership and integrity of what is being purchased. It covers the corporate structure (articles of association, shareholders' register, encumbrances over shares), material contracts with customers and suppliers — paying particular attention to change-of-control clauses that entitle the counterparty to terminate the contract when ownership changes — intellectual and industrial property, ongoing litigation and employment contingencies. In a share purchase, the buyer inherits the employment relationships, which makes it essential to quantify seniority entitlements, individual agreements and potential liabilities under collective bargaining agreements.
Operational, tax and technology due diligence
The operational review assesses whether the business can continue running normally after the change of ownership: dependence on key personnel, concentration of customers or suppliers, condition of productive assets and the resilience of the supply chain. The tax review quantifies contingencies from open inspections or years not yet statute-barred. With increasing weight, technology and cybersecurity due diligence examines the technical debt in proprietary software, licensing arrangements, dependence on cloud providers and the degree of compliance with data protection law — a serious GDPR infringement is a quantifiable liability that the data protection authority can sanction.
Customer concentration deserves separate attention, because it is one of the findings that most erodes a valuation. If a single customer accounts for 40% of revenue, the buyer is not acquiring a diversified business: they are acquiring a commercial relationship that could end the day after closing. Due diligence quantifies that dependency, reviews the duration and renewal terms of key contracts and checks whether change-of-control clauses would allow that customer to walk away. The same analysis applies to single-source supplier dependency and to the concentration of knowledge in one or two undocumented individuals — the so-called bus factor risk. These factors rarely appear in the accounts but directly affect the sustainability of the cash flow that justifies the price.
Valuation and translating findings into price
Due diligence is not an isolated exercise: it feeds into the valuation. The standard methods coexist and are cross-checked against each other. Discounted cash flow (DCF) projects future free cash flow and discounts it to present value at a rate reflecting risk; it is the most rigorous method but also the most sensitive to assumptions. The comparable multiples method applies to the target's EBITDA or revenue the average multiple from recent sector transactions, providing a market reference point. Every due diligence finding translates into a concrete adjustment to these models: a probable tax contingency reduces the price by its expected amount; a concentrated customer raises the discount rate to reflect higher risk; a hidden employment liability is deducted euro by euro. The findings report thereby ceases to be a list of abstract risks and becomes figures that feed directly into price negotiation, warranties and retention arrangements.
Steps in an orderly due diligence
- Letter of Intent (LOI) and Non-Disclosure Agreement (NDA). These set the framework, exclusivity and information protection before anything is opened.
- Opening of the data room. A virtual document repository where the seller publishes information and logs every access, leaving a traceable record of what the buyer has seen.
- Review by specialist teams. Financial, legal, tax, employment and technical workstreams proceed in parallel from structured checklists.
- Findings report (red flags). A document that ranks risks by impact and probability, with proposed mitigation measures.
- Transfer to the contract. Findings become price adjustments, representations and warranties (reps & warranties), indemnification clauses and, where appropriate, price retention arrangements (escrow).
Common errors
The most costly mistake is overestimating synergies and being swept along by deal enthusiasm, ignoring the fact that most value-destroying transactions fail in post-merger integration, not at the price agreed. The second error is treating due diligence as a compliance formality rather than a negotiating tool: every well-documented finding is leverage to adjust the price or strengthen warranties. The third is underestimating post-merger integration (PMI), where cultures, information systems and duplicated headcount collide. The fourth — very common — is overlooking merger control: transactions that exceed the thresholds of the competition law require prior notification to the relevant authority (the CNMC in Spain, or the European Commission for cross-border deals).
Comparison: statutory merger versus share purchase
| Criterion | Statutory merger by absorption | Share purchase |
|---|---|---|
| Continuity of target company | Extinguished | Survives under new ownership |
| Asset transfer | Universal succession (en bloc) | Indirect, via change of shareholders |
| Hidden liabilities | Assumed by the absorbing company | Covered by reps & warranties |
| Formal complexity | High (merger plan, expert reports, registration) | Lower in standard practice |
| Use of carried-forward tax losses | Limited by tax regime | Subject to anti-avoidance rules |
Frequently asked questions
How long does a due diligence take? For SME transactions, typically four to eight weeks from the opening of the data room. Duration depends on the size of the business, the number of jurisdictions involved and the quality of the documentation provided by the seller.
What is a representations and warranties agreement? It is the set of statements the seller makes about the state of the company (accurate accounts, no hidden litigation, regulatory compliance). If any prove to be false, they trigger an obligation to indemnify the buyer.
Is due diligence useful if the buyer knows the sector well? Knowing the sector does not substitute for verifying the specific company. Relevant contingencies typically sit in specific contracts, litigation and accounting records, not in general market knowledge.
Who pays for due diligence? As a general rule, the buyer bears the cost of its own review. In competitive sale processes, the seller may commission a vendor due diligence in advance to streamline the process and give bidders confidence in the information.
At Summum Consultoría we understand due diligence as the moment when an M&A transaction stops being based on trust and starts being based on verifiable evidence. The value of a transaction is not determined at signing but in the weeks preceding it, when every figure in the information memorandum is verified against its supporting documentation and every material contract is read in search of the clause that could change the price. Rigorous due diligence rarely kills a good deal; what it does is adjust its price to reality and protect the buyer against what the seller would have preferred not to mention. That is the difference between buying a business and buying a surprise.