Gantt Chart for M&A Due Diligence

Mergers and acquisitions due diligence is among the most complex project management challenges in business: eight to ten simultaneous workstreams, dozens of external advisors, thousands of documents in a data room, and a seller who has contractual rights to limit your time and access. Deals that close on schedule and within price do so because someone managed the diligence process as a project with a visible timeline, explicit task ownership, and escalation paths for blockers. Deals that slip or blow up on price usually had neither.

This guide builds a Gantt-based framework for the full M&A due diligence process — from NDA execution through final bid decision — applicable to private equity acquisitions, strategic M&A, and growth equity investments.

Phase 0: NDA Execution and Data Room Access (Week 1)

Before any substantive diligence begins, legal prerequisites must be satisfied.

Tasks:

• NDA negotiation and execution: Most sellers have a standard NDA. Expect a 2–5 day negotiation on key points: definition of confidential information, carve-outs for prior knowledge, standstill provisions, and non-solicitation of employees.
• Data room access: Seller grants access to a virtual data room (Intralinks, Datasite, Firmex, or ShareFile). Review the data room index before assigning work — the organization of the data room tells you a lot about how organized the target is.
• Initial data room assessment: Identify what is present and, critically, what is missing. Gaps in the data room become formal information requests (IRs) that must be tracked throughout diligence.

Phase 1: Workstream Assignment and Kick-Off (Week 1)

Diligence runs in parallel workstreams, each led by a specialist. The deal team's job is to coordinate these workstreams and synthesize findings into a coherent deal assessment.

Standard workstreams:

Kick-off meeting agenda: distribute data room credentials, assign workstream leads, review diligence timeline and exclusivity window (if applicable), establish information request (IR) process, and set weekly deal team meeting cadence.

Phase 2: Financial Due Diligence (Weeks 2–6)

Financial diligence is typically the critical path of the entire process. It produces the numbers every other workstream references — the revenue base for commercial diligence, the EBITDA for pricing, the debt and liability schedule for legal diligence.

Quality of Earnings (QoE) analysis:

• Revenue normalization: Identify one-time revenue items (non-recurring contracts, asset sales, insurance proceeds) and exclude them from EBITDA. Identify revenue that is lower than normal due to one-time disruptions and add back.
• EBITDA normalization: Add back or remove one-time expenses (restructuring costs, transaction expenses, owner-compensation above market, personal expenses run through the business).
• Revenue recognition policy review: Particularly important for SaaS, long-term contracts, or services businesses. Does the target's revenue recognition policy comply with ASC 606?

Working capital analysis:

• Calculate trailing 12-month average working capital (AR + inventory - AP - accrued liabilities).
• Working capital target in the purchase agreement is based on this normalized average. Significant working capital "peg" negotiations happen after this analysis.

Debt and debt-like items:

• Identify all funded debt (bank loans, notes payable, capital leases).
• Identify debt-like items: deferred revenue (liability to deliver future service), unfunded pension obligations, environmental liabilities, operating lease obligations, customer deposits.
• These items reduce the equity value received by sellers at close.

Off-balance-sheet liabilities:

• Commitments and contingencies in the financial statement footnotes.
• Personal guarantees.
• Seller-financed arrangements.

Tax returns and financial statement reconciliation:

• Reconcile GAAP financials to tax returns. Unexplained gaps are red flags.
• Review state and local tax filings for compliance gaps.

Phase 3: Legal Due Diligence (Weeks 2–6)

Legal diligence assesses legal risk and confirms that the seller owns what they are selling.

Material contracts review:

• Customer contracts: Are they assignable (change of control provision)? Do they auto-renew? Are there minimum purchase commitments?
• Vendor and supplier contracts: Key supplier concentrations? Assignability? Pricing lock-ins?
• Real estate leases: Term, rent escalation, sublease rights, assignability.
• Financing agreements: Existing debt covenants that may require lender consent to the transaction.

Litigation:

• Review active litigation, threatened claims, and settlements from the past 3 years.
• Assess materiality: is any claim large enough to affect deal pricing or structure?

Intellectual property:

• Patent portfolio: owned, licensed, encumbered?
• Trademark registrations: all jurisdictions where the business operates?
• Software licenses: open-source licenses that impose share-alike obligations?
• IP ownership: are key inventions properly assigned from employees and contractors?

Regulatory compliance:

• Industry-specific regulatory licenses and permits.
• Government contracts (require DCSA or ITAR review if applicable).
• Data privacy compliance (GDPR, CCPA) — increasingly material in any data-intensive business.

Phase 4: Commercial Due Diligence (Weeks 2–5)

Commercial diligence answers whether the financial projections are believable — whether the market, customer base, and competitive position support the revenue trajectory the seller is projecting.

Customer analysis:

• Concentration: What percentage of revenue comes from the top 5 customers? Top 10? High concentration (>20% from one customer) is a pricing risk.
• Churn analysis: Net revenue retention (NRR) and gross revenue retention (GRR) for SaaS or subscription businesses. Cohort churn curves for consumer businesses.
• Customer reference calls: Conduct 10–20 customer calls (with seller permission) asking about product satisfaction, renewal likelihood, and competitive alternatives.

Competitive position:

• Who are the direct competitors? What is the target's win rate against each?
• Is the market growing, stable, or shrinking? What is the growth rate?
• Does the target have a defensible moat (proprietary data, network effects, switching costs, regulatory license)?

Market sizing:

• Validate the seller's TAM/SAM assumptions.
• Assess the growth rate assumption: is the projected growth rate above or below market growth? Is outperformance justified?

Phase 5: HR Due Diligence (Weeks 3–5)

People risk is often the diligence area that receives the least time and creates the most post-close problems.

Key employee identification:

• Who are the 10–15 people the business cannot operate without? Are they under employment agreements? Do they have change-of-control provisions (accelerated vesting, double trigger)?
• What is the retention risk at close? Have conversations begun with the M&A advisor about retention packages?

Compensation benchmarking:

• Are key executives above-market, at-market, or below-market? Below-market compensation is a post-close retention risk.
• Are there informal compensation arrangements not reflected in payroll?

Benefits liabilities:

• Defined benefit pension obligations (if any) — these are debt-like items for pricing purposes.
• Retiree health benefit obligations.
• ESOP (Employee Stock Ownership Plan) if applicable.

Culture and workforce assessment:

• Voluntary turnover rate over the past 2 years.
• Employee satisfaction data if available (Glassdoor, engagement surveys).
• Union status and collective bargaining agreements.

Phase 6: IT and Cyber Due Diligence (Weeks 3–6)

Technology diligence has expanded from a secondary concern to a primary diligence area as virtually every business is now a technology business.

Technology stack assessment:

• Document all critical software systems: ERP, CRM, billing, product, infrastructure.
• Assess technical debt: how much of the codebase is legacy or undocumented?
• Evaluate scalability: can the current infrastructure support the buyer's growth projections?

Cybersecurity posture:

• Review results of most recent penetration test and vulnerability assessment.
• Assess identity and access management: MFA enforcement, privileged access controls.
• Review security incident history: prior breaches, regulatory notifications, remediation.
• Evaluate third-party vendor risk: do critical vendors have SOC 2 attestations?

Data assets:

• What data does the business own and how is it stored?
• Are there compliance requirements for data handling (HIPAA, PCI DSS, GDPR)?

Phase 7: Diligence Report Consolidation (Week 7)

Each workstream lead writes a diligence summary: findings, risks (quantified where possible), and mitigation options. The deal team consolidates these into an integrated diligence report.

Report structure:

• Executive summary: deal attractiveness and top 5 risks.
• Financial summary with QoE bridge.
• Legal risk register with materiality assessment.
• Commercial upside and downside scenarios.
• HR and people risk summary.
• IT risk and investment required.
• Deal structure recommendations (reps and warranties, escrow, earnout, indemnification).

Phase 8: Synergy Analysis (Week 7)

For strategic acquirers, synergy modeling happens in parallel with diligence consolidation:

• Revenue synergies: Cross-sell to combined customer base, expanded geographic reach, new product combinations.
• Cost synergies: Headcount overlap, duplicate vendor contracts, consolidated facilities, procurement leverage.
• Synergy timing: When are synergies achievable? Year 1 synergies are very different from Year 3 synergies in a valuation model.

Be conservative. Studies consistently show that acquirers overestimate synergies by 30–50%.

Phase 9: Management Presentation (Week 8)

A management presentation with the target's leadership team allows buyers to evaluate management quality, ask questions not answerable from documents, and assess cultural fit.

Typical agenda:

• Business overview and strategy (management's view)
• Revenue and operational deep-dive
• Technology and product roadmap
• Financial performance and projections
• Q&A

Phase 10: Final Bid and LOI Decision (Week 9)

All diligence findings feed into the final pricing and deal structure decision:

• Price: Adjusted based on QoE findings, working capital analysis, and debt schedule.
• Structure: Cash at close vs. earnout. Earnouts defer risk back to sellers when future projections are uncertain.
• Reps and Warranties Insurance (RWI): Increasingly standard in PE transactions. Transfers seller rep risk to an insurer rather than escrow.
• Escrow: Percentage of purchase price held back to secure indemnification obligations. Typically 10–15% for 12–24 months.

Building Your M&A Diligence Gantt Chart

In gantt-chart.io, set up one swim lane per workstream. Mark the following milestones:

• Data room access confirmed
• IR round 1 submitted and received
• Management presentation scheduled
• All workstream reports delivered
• Diligence report consolidated
• Final bid submitted

Track open information requests as blockers — unresolved IRs on the critical path delay the bid. A deal team that manages diligence with a Gantt chart closes on schedule; one that manages it with email threads and spreadsheets closes late, or not at all.