Due Diligence Changes to Expect in 2025

Happy New Year.  As 2024 draws to a close and we begin to look at what M&A in 2025 will bring, we see several strong trends influencing due diligence as part of a transaction. Some of these shifts stem from ongoing high valuation expectations, which demand a deeper upfront understanding from buyers, while others are driven by political, economic, and international influences, changing the way we look at business risk.

The Due Diligence Environment in 2025

The end of 2024 continued the trend of very high valuation expectations on the part of sellers and intense, competitive bidding for attractive assets. This gap in price expectation highlights the need for buyers to continue their intense scrutiny of assets for which they are being forced to pay top dollar.

As a result of these pressures, there is an increase in the overall scope of due diligence, with more time allocated to the process, greater engagement of third-party providers, and a shift in buyers’ approach. Buyers are moving beyond merely checking boxes and instead developing a deeper, more philosophical understanding of the business and its associated risks.

Due diligence is taking longer.  While many sale processes have an intense pressure to complete as soon as possible, sellers have been unable to convince buyers into speeding up what they determine as key areas of diligence. The lower-middle market closings in 2021 were regularly scheduled for 45 days after LOI. Now, they are more likely to be 60- or 90 days. 

Buyers are using more third-party diligence firms, and this can create a queue (especially for smaller transactions), where you may be waiting for those firms to schedule times to complete their work. 2023 saw the rise of Quality of Earnings diligence in the lower-middle market and we are now experiencing the many offshoots of this phenomenon. Consider how due diligence providers in areas like tax, supply chain, working capital, and cybersecurity have become essential parts of your process.

Two other new due diligence changes we are seeing are the rise of sellers performing their own third-party diligence prior to going to market and buyers spending due diligence money on investigating assets prior to an Indication of Interest or Letter of Intent (and exclusivity). Certainly, there were many sellers that were completing sell-side Quality of Earnings analyses prior to going to market, but now we are seeing sellers engage many of those same third-party providers mentioned above as well.  For instance, sellers might engage an HR firm to confirm market salaries before you decide to claim an addback in your pro forma financials. Sellers are regularly providing cyber reviews and other assessments as confirmation that they have their ducks in a row and to avoid any surprises during the marketing process. 

Buyers, on the other hand, have historically been reluctant to spend big money on due diligence on a target prior to an Indication of Interest (IOI) or Letter of Intent (LOI) because they were not guaranteed exclusivity with the target. However, recently we have been seeing buyers who have spent money on market analysis or industry diligence to better understand a target even before they get to exclusivity. Buyers that are willing to engage in this work prior to putting in an offer should be looked at favorably because their insights into an industry can cause fewer changes in their original LOI offers, meaning a more reliable situation for sellers.

New Areas of Due Diligence Focus in 2025

We predict that several new areas will become the focus of increased scrutiny in 2025. Some of this is already occurring, but others will be the result of global changes and current political and presidential administration outlooks.

1. More Focused Review of Supply Chains/Impacts from Tariffs

No one has forgotten about the supply chain difficulties post-COVID. While these seem to be in the rearview mirror for many, there is now an increased focus on a target’s inventory, amount of necessary inventory, and supply chain and vendor risks as components. Be prepared for a much deeper analysis of current suppliers and the risks surrounding their business models in addition to your own. 

There has also been a lot of chatter out of Washington about tariffs, without a clear understanding of exactly what goods they will cover. Companies with exposure to China (and this is a lot of companies) will face increased scrutiny. Companies with exposure to container pricing will also see buyer downside models contemplate an increase in these costs as a potential worst-case scenario. 

2. Cybersecurity to the Forefront

I don’t care what your business does, what type of data you have, or how big it is – you will face questions about your cybersecurity plans, training, and insurance in 2025. Data leaks, malware, and ransomware are on everyone’s list of issues. And to tie two issues together, a trend in 2024 was for cyber attackers to go after supply chains – enabling them to leverage third-party vulnerabilities to cripple multiple organizations at once. Areas of focus will be vulnerability management, monitoring ability, and having a strong attack response plan. 

3. Does the Company Use AI?

Many companies say they are using artificial intelligence as part of their business. It has become a bit of a marketing buzz word. If the business relies on artificial intelligence as a significant input or output, there will be a new set of AI investigations as part of due diligence. At a basic level, buyers will want to understand how the business is using the technology and whether or not it is proprietary or licensed. After this is determined, they will want to know how the model is trained and what inputs are provided. If a company provides its learning technology with sensitive data (health records, or other proprietary or sensitive information), a business must be prepared to explain how it plans to protect this information. Lastly, expect an investigation into the rights of the business to own the output of information that the AI model provides. Many AI outputs cannot be protected from third-party use. 

4. DOGE Risk (not the cryptocurrency) but The Department of Government Efficiency

Businesses providing any service to the Federal Government are now subject to DOGE risk and due diligence. This was new a one for me at the end of 2024 and came completely out of the blue. Honestly, I am not sure how you prepare for this because so much of how this department works is still to come, but I think it’s worth noting.  This agency has pledged to work with Congress to reduce government expenses by over $2 trillion. Even without formal authority, this risk has been deemed legitimate enough to be considered when evaluating business that might have the Federal Government as a customer. 

In today’s M&A environment, staying ahead of due diligence trends is more important than ever. Continued (or improving?) valuations in 2025 will mean increased investigation into targets and longer due diligence periods. The roles of third-party providers have become more important than ever. The lower-middle market is not immune from these trends, although smaller sellers may be less adept at handling the higher levels of due diligence scrutiny and tracking.