Operational Due Diligence: M&A Checklist, Process, and Template

A UK owner-managed business can report healthy profits and still struggle the day after completion. The accounts show what the company earned last year. They don’t show that the founder approves every price, that the main production line is 22 years old, or that one overseas supplier provides most of the key materials.

Operational due diligence (ODD) tests those points before the buyer commits. It looks at whether the business can keep delivering once ownership changes.

This guide sets out the process, a ten-area checklist, the documents to request, the questions to put to management and the UK-specific issues to check. A downloadable Excel template is included.

Why it matters: an acquisition can look attractive on paper and still need heavy investment in people, systems or equipment before the buyer’s business plan is achievable.

What is operational due diligence in M&A?

Operational due diligence is a buyer’s review of whether a target business has the people, processes, infrastructure, systems and capacity to maintain performance and deliver the acquisition business plan after completion.

Unlike financial due diligence, operational due diligence looks forward. It asks what the business needs in order to perform as forecast, and what that will cost.

The findings feed directly into the deal. They can change the price, the structure of the offer, the warranties requested, the retention terms for key staff or the buyer’s first-year plan.

Operational due diligence is usually buyer-led. Vendors sometimes commission their own review before going to market, so that weaknesses are known and priced in before buyers find them.

The approach applies across UK private-company transactions:

• Management buyouts (MBOs) and management buy-ins (MBIs): the key question is whether the incoming or continuing team can run the business without the outgoing owner.
• Trade acquisitions: the focus is on integration, shared systems and overlapping suppliers or sites.
• Private equity buyouts: investors test whether the operations can support the investment thesis and a profitable exit.

How does it differ from financial and commercial due diligence?

The workstreams overlap, but each answers a different question. None replaces the others.

Due diligence workstreams compared

What should an operational due diligence checklist cover?

Use the checklist below as a starting framework, then adjust it to the target. A food manufacturer needs a deeper look at plant and supply chain than a software reseller does. A professional services firm needs more attention on people and client relationships.

Judge each area on three things: how the target’s business model works, how good the evidence is, and how much the issue could affect the deal.

Operational due diligence checklist for UK acquisitions

Ten rows are easier to manage when grouped into three practical questions: who runs the business, what it runs on, and what could interrupt it.

Test management strength and owner dependence

In many UK SMEs, the owner is the business. Customers call them directly, they set prices on instinct, and they hold the technical knowledge nobody else has written down.

Look for evidence of where decisions actually sit. Organisation charts show formal reporting lines, but approval records, pricing histories and email trails show who really decides.

Ask which customer and supplier relationships are held personally by the owner. Then check what retention or handover terms are realistic. A twelve-month transition agreement helps little if the key manager has no financial reason to stay once the sale proceeds are paid.

Verify capacity, supplier resilience and operating costs

Forecasts assume the business can produce more. Check whether it can.

Compare actual output with theoretical capacity, using production or delivery data rather than management estimates. Review maintenance spending over several years. A sudden fall in maintenance cost often means work has been deferred to flatter profit before a sale.

For suppliers, identify the contracts that would cause real disruption if lost. Check their length, termination rights and whether prices are fixed. Then test the assumptions behind any projected savings, such as procurement synergies that depend on suppliers agreeing to terms they haven’t yet seen.

Review systems, compliance and business continuity

Establish which core systems are supported, who maintains them and what happens if they fail. An accounting package nobody can upgrade, or a bespoke ordering system written by a contractor who has left, will cost money to replace.

Ask for recovery plans and evidence that they have been tested. A plan that exists only on paper tells you little.

For cyber risk, the UK government’s annual Cyber Security Breaches Survey gives useful benchmarks on how UK businesses of different sizes experience and manage incidents. The NCSC publishes practical guidance for assessing a company’s security basics.

On compliance, review inspection reports, permits and incident logs. Check the HSE enforcement record where the target operates sites, plant or hazardous processes.

Share purchase or asset purchase? The operational consequences differ. TUPE (the Transfer of Undertakings (Protection of Employment) Regulations) may apply to a qualifying business transfer, but it does not normally arise just because a company’s shares change hands. See the GOV.UK guidance on transfers and takeovers. Have the structure and its employment consequences confirmed by your solicitors.

Which documents are needed for operational due diligence?

A checklist tells you what to assess. A document request list tells you what evidence you need to see. Keep them separate, because a risk area can be covered by a checklist item and still have no supporting documents behind it.

Prioritise. Ask first for the documents that bear on the largest exposures, such as asset registers and key supplier contracts, and leave lower-value items for later rounds.

Operational due diligence document request list

Control document access in a virtual data room

A virtual data room (VDR) keeps requested documents in one indexed, permission-controlled place. For operational review, the useful features are:

• Folder-level permissions, so each adviser sees only their own area
• Version control and document indexing, so the team reviews the current file
• A Q&A function that links each question to the document it relates to
• Audit logs showing who opened what and when

A VDR does not make disclosure lawful by itself. Employee records, customer data and commercially sensitive supplier terms may be restricted by UK GDPR, confidentiality clauses or competition law. The ICO addresses this directly in its guidance on due diligence and data sharing, including cases where an acquisition changes or adds a data controller.

In practice, anonymise or aggregate employee data in early rounds, and release detail only to those who need it. For a wider view of running the review itself, see our guide on how to manage the M&A due diligence process.

How to conduct operational due diligence: 6 steps

ODD works best as a risk-based exercise. It starts before full document disclosure, focuses on the areas that carry the most value, and carries on into completion planning.

Our pre-merger strategy checklist covers how this fits into the wider transaction timeline.

Process stages and outputs

The aim: the review should leave the buyer able to decide whether to proceed, renegotiate, investigate further or change the post-acquisition plan.

What questions should buyers ask during operational due diligence?

Reports can’t answer everything. The best insights often come from direct questions to the people who run the business, asked separately from the document review.

These questions are specific to operations. For a broader set covering the whole transaction, see our due diligence questionnaire guide.

Questions for target management

Record every material answer against a piece of evidence. Where none exists, log it as an assumption to be verified.

What are the main operational due diligence red flags?

A red flag is a finding that could change what the buyer pays, how it structures the deal or what it does after completion. Not every flag is a reason to walk away.

Operational red flags and deal implications

An identified risk does not automatically justify a price reduction. Severity, financial impact and available remedies decide the response. A supplier risk with a ready alternative may need a contingency plan and nothing more. A failing production line may need a revised price.

Illustrative example: an owner-managed UK manufacturer reports stable profits. The production line is near the end of its working life, and one overseas supplier provides most of a key component.

ODD should establish what replacing the line would cost, how long production would stop and whether either exposure appears in the buyer’s acquisition model. If neither does, the model overstates future cash flow.

What UK-specific issues should buyers check?

Several UK rules affect how operational information is shared and what a buyer must do around completion. This is not a full legal review. The table flags where operational findings meet regulation, with a source for each.

UK-specific considerations

Three points are often misunderstood:

• CMA: not every UK acquisition needs a CMA filing. The regime is generally voluntary, though the CMA has powers to investigate mergers that meet the statutory tests.
• NSI Act: mandatory notification applies only where a qualifying acquisition happens in a specified sensitive sector. Asset acquisitions are not subject to mandatory notification but can still attract scrutiny.
• Modern Slavery Act: the section 54 transparency statement applies above a £36 million turnover threshold. Supply-chain risk checks are still sensible for smaller targets.

Competition law also limits what competitors can share before completion. Where the buyer and target compete, route sensitive pricing and customer data through a clean team or external advisers.

How to use the operational due diligence template

The Excel template turns the checklist into a working tracker. Use it from the first day of the review, not as a summary at the end.

Prioritise risks and track outstanding evidence

1. Assign a reviewer and a target date to every check.
2. Record the document reference and note any information gaps.
3. Classify each risk as low, medium or high using the criteria on the instructions tab.
4. Enter the possible cost, the recommended action and the current status.
5. Escalate material issues to your transaction advisers promptly.

Sample operational due diligence template

The full workbook also includes columns for business area, question, evidence requested, VDR reference, reviewer, due date, findings, potential financial impact and recommended action. It comes with worked example entries and a separate instructions tab.

Frequently asked questions

What is included in an operational due diligence checklist?

A checklist covers management and succession, workforce, business processes, suppliers, customers, assets and facilities, IT and cyber, compliance, financial operations and integration readiness. Each item is paired with the evidence that supports it.

Who conducts operational due diligence in an M&A deal?

The buyer’s management or deal lead usually coordinates it. Corporate finance advisers, operational specialists and external experts, such as engineers, IT consultants or health and safety assessors, cover their own areas.

How long does operational due diligence take?

There is no universal answer. Duration depends on the size and complexity of the target, how ready its documents are, the number of sites and how many material findings need follow-up. A single-site SME takes far less time than a multi-site group.

Is operational due diligence required when buying a UK business?

No statute requires it. It is a commercial, buyer-driven investigation. Some legal or regulatory checks may be necessary depending on the deal, such as TUPE, NSI Act or competition-law considerations. Take advice from your solicitors on these.

What is the difference between operational and financial due diligence?

Financial due diligence tests whether reported earnings, cash flow and working capital are reliable. Operational due diligence tests whether the business can keep producing those results and what it will cost to do so.

Does operational due diligence differ for private equity acquisitions?

Usually the emphasis shifts. Private equity investors give more weight to management capability, delivery of the investment thesis, operational improvement potential and what the business will be worth at exit.

Related Resources

Dataroom.org.uk guides

• How to Streamline M&A Due Diligence: UK Playbook
• Due Diligence Questionnaire (DDQ): Complete Guide
• Pre-Merger Strategy Checklist

UK government and regulator guidance

• GOV.UK: Transfers and takeovers (TUPE)
• ICO: Due diligence and data sharing
• GOV.UK: National Security and Investment Act, guidance on acquisitions
• CMA and GOV.UK: Mergers, when they will be investigated
• Home Office: Transparency in supply chains, a practical guide
• HSE: Health and Safety Executive

Cyber security and risk data

• GOV.UK: Cyber Security Breaches Survey
• NCSC: National Cyber Security Centre