The Evolving M&A Process

Data Room & Due Diligence

What systems and processes should be in place for due diligence now and in the future?

15.November 2022
Written by Mari Nygaard

In this article:

A group working together.


Dealmakers have certainly felt the impact of the past two years of social, political, and economic turbulence. For many, constant adaptation to ever changing events has become the day job, but with it has come unprecedented opportunities too.

In this article, we set the scene by looking back at a record-breaking year for deals in 2021 and look ahead at what dealmakers can expect in 2022 and beyond. We suggest what systems should be in place for due diligence, what good due diligence involves, and why it is evolving. We also consider how digitisation of the process is driving efficiency and adaptation as one of the few constants in unprecedented times.

Predictions for 2022 and beyond


All time high – global deals reach $5 trillion

2021 saw record breaking deals in terms of volume and value with Reuters reporting global mergers and acquisitions (M&A) up by 63% and European deals increasing by 47%, versus the previous year. 

Given the dip in deals during 2020 and the exponential demand for technology in response to the effects of the global pandemic, PwC cites some of the factors at the heart of this incredible turnaround. Digitalisation, technology, and data assets are becoming essential drivers of global M&A opportunities. In their review, ‘2021 Global M&A Outlook’, JP Morgan’s Dirk Albersmeier highlights that despite the challenges of adapting to remote working, we saw deals could be closed without meeting the other side in person. He underlines that working to scale and adopting technology are key to successfully evolving the M&A process in such unpredictable times.

Looking ahead – what does 2022 hold?

Despite higher interest rates and rising inflation there is still optimism for 2022. While most don’t expect it to be another record breaker, sounding a note of caution that global markets are still adjusting to two years of disruption in a tightening regulatory environment, they still predict a largely positive outlook. 

According to a Deloitte survey, over the next 12 months 70% of dealmakers in corporate organisations expect the number of closed deals to increase, while 75% expect deal size to increase too. Technology and digitisation, typically data room software, advanced data analytics, and now artificial intelligence (AI) too, continue to be 57% of organisations surveyed plan to conduct due diligence in a fully virtual environment, while a further 26% report plans to do so with a hybrid approach of part virtual, part in-person. 

Some of the digital means that are making the greatest impression on M&A include advanced analytics and data science to draw insights from external and proprietary company information during HR and culture diligence, digital platforms that support complex program management for global fast-moving deals, and cloud-based solutions that support both clean room operations and analytics.


With many opportunities and a backdrop of continual change, how should the M&A process evolve for successful outcomes?

The answer is multi-faceted. It centres on the systems and processes used for due diligence and how digitisation can optimise processes for increased efficiency. But it also balances on a much broader range of factors and issues that are creating scrutiny and enquiry on both sides of the deal.


Start the preparation phase as early as possible

It’s never too early to start deal preparation but gathering many different documents and data sets can seem like a never-ending process. We’re often asked, ‘how long does due diligence take?’ The answer is anything from 30 days to 6 months, or more. It’s rarely an easy process but starting as early as possible is key to a smooth process that minimises the chance of missing documents, unexpected questions, or protracted discussions.

However, it’s not just about the sell-side gathering the data and documents the acquirer will need, or as a buyer, deciding on the questions you want answered. It’s also about assembling your team of internal stakeholders, decision makers, and external advisors such as legal and financial experts, and deciding on roles and responsibilities.

For example:

  • Who needs to be on the due diligence team and is everyone aligned with the overall aims of the potential deal? From C-suite executives to M&A leads and subject matter experts, you need a team you can rely on that is briefed, aligned, and ready to go at a moment’s notice.
  • What roles will you assign to each of your deal team and are they clear on what is expected of them both individually and collectively? Clarity on responsibilities, who holds decision making authority and how business-as-usual workloads will be managed alongside deal work is critical.
  • If you are the sell-side, do you have the right external advisors including accountants and legal advisors available to answer the buyer’s questions? What is the chain of communication and command for responding to those questions?
  • Are you clear on the information that will need to be shared with the other side? Do you have tools such as a due diligence checklist to ensure you haven’t forgotten any critical documents or questions.


The due diligence checklist

A due diligence checklist is another essential part of the preparation stage. It’s a tool for the lengthy and, it has to be said, sometimes frustrating, Q&A period. As a potential buyer, it lists the topics and documents you’ll want from the sell-side as a critical part of the due diligence process. As a seller, the due diligence checklist provides a comprehensive record of what information and documents you should be asking for.

You can download our free legal and financial due diligence checklist here.


About preparation portals

Once your deal team is assembled and briefed, and you have started to gather the documents and information detailed on the due diligence checklist, setting up a preparation portal offers a secure data room environment to store and index them.

A preparation portal is a restricted virtual data room where the sell-side can upload documents for preliminary review, before potential buyer groups are invited into the data room for the first time. Getting ready before the main negotiation period is important and you might want to set up your preparation portal several months before you’re ready to open it up to buyer groups.

Whatever timelines you’re working to, selecting the right one for your needs is critical.

Features to look for include:

  • Security protocols such as SOC 2 and ISO 27001:2013 certification
  • Unlimited data volume
  • Unlimited users
  • Easy set up and indexing
  • Training and support from a dedicated client or account manager
  • Easy upgrade to a full data room as soon as you’re ready to invite buyer groups

With your documents uploaded and indexed in the preparation portal, you and your team get a head start on the most time-consuming aspects of document upload, with the confidence that sensitive business information is protected in a secure digital environment.

Further reading:

More about preparation portals.


Emerging factors for the M&A process

Whether your last deal closed or not, weeks and months of compiling or reviewing documentation, posing or answering questions, and discussing strategy, all contribute to insight and knowledge for future deal lifecycles.

Checking on assumptions at the start of each potential deal however, and answering the question, ‘what should company due diligence cover, or more accurately, what should it cover now? is important.

Whilst financial, legal, operations and tax remain the four pillars of the due diligence process, let’s look at what other factors are emerging in importance both as opportunities and risks.

Environmental, social and governance (ESG) factors

From waste management and greener energies to human rights and board composition, ESG factors are in the spotlight with increasing importance to investors, sellers, and shareholders.

With many organisations building their own ESG credentials through acquisition, it is clear this is seen as a multi-layered opportunity:

Considering ESG factors in investment decisions not only benefits the environment and society but, for companies and investors, it can leverage competitive advantages by mitigating financial, reputational, regulatory, and strategic compliance risks.


Researchers at Bayes Business School suggest organisations with greater diversity are more attractive as an acquisition and ultimately offer more potential:

Research shows that companies with greater diversity and inclusion perform better than their competitors. This includes our recent study in collaboration with SS&C Intralinks that showed M&A deals initiated by more gender-diverse boards are perceived more positively by the market and lead to higher share price and operating performance in the long run.


With the opportunities however, there are additional risks for mitigation in the M&A deal process.

Since reporting on ESG factors is still voluntary, despite expected EU and UK regulation, how an organisation translates ESG policy into practice may not match their claims in corporate marketing materials.

This is just one of the 6 risks identified by The US Securities and Exchange Commission (SEC), prompting the release of a Risk Alert in early 2021. In their advisory, they also highlighted a general lack of knowledge amongst staff relating to ESG investment analysis, decision making and compliance requirements.

Girl in yellow jumper and glasses
It is important to consider the risks for mitigation in the M&A deal process.

Additionally, with activist shareholders mounting pressure on boards to do better – often on their commitments to the environment or diversity and inclusion – it is clear ESG factors will take up more time during the due diligence phase.

Until regulation for ESG reporting arrives, and even once it does, acquirers will need to deep dive into ESG claims challenging their robustness and accuracy, whilst sellers should be prepared for more intensive questioning and demands for evidence.

ESG factors increasingly influence what happens in due diligence. Dealmakers must weigh up opportunities while mitigating the risks of unregulated reporting to take advantage of the opportunities ahead.


Digitise to speed up the due diligence process

The M&A deal process is complex and time-consuming, and there is considerable expectation on dealmakers to deliver. Closing a complex deal is never easy but digitisation speeds the whole process up.

What is a virtual data room (VDR) and why should you use one?

Virtual data rooms are a secure due diligence platform for M&As, fundraising and restructuring. Sometimes also known as a deal room, they are a collaboration and process management tool designed to make preparation, discovery, and negotiation more efficient.

A good VDR will help dealmakers stay on top of deliverables, enable secure and efficient collaboration, and automate processes to allow you and your team to focus on the bigger picture. While there are many different VDR solutions available, there are some key features considered essential.


Features, benefits and what to look for in a VDR solution

Folder structure and indexing

Organising your folder structure is the first step in setting up a data room. While you’ll want to customise it to suit your preferences and needs, a good VDR solution supplies best practice templates to get you started.

Look out for:
A solution that initiates basic folder set up, including automated indexing, so you only have to focus on tailoring it to your requirements.

Task management

Storing and sharing all the documentation involved in a deal negotiation can be one of the most time consuming aspects. A good task manager tool simplifies this process. Data room administrators can upload documents to the folder structure, assign reading or other uploading tasks to team members and enable the VDR to notify users as needed. You’ll also have peace of mind that every document is protected by encryption technology reducing the risk of deal-breaking leaks.

Look out for:
Control over user roles that can be set at activity, folder and document level, plus the option to assign ‘task manager’ roles to other users for maximum efficiency.


Manually searching thousands of documents to highlight and block out sensitive information you don’t want the other side to see is a time-consuming process prone to human error. Missing a sentence or section could lead to serious consequences for the deal. A redaction tool automates the process saving you time while giving you confidence nothing has been missed.

Look out for:
A flexible tool that enables you to redact both text and graphics singly or in multiple instances.

Secure messaging

Using insecure channels like email or chat software for team communication puts your deal and confidential information at risk. It also takes up considerable time switching between different software or programmes, reducing productivity and effectiveness. A messaging tool is a secure hybrid between email and chat but crucially keeps all communication inside the safety of the VDR.

Look out for:
An in-app messaging tool with user notifications for team members to communicate and share documents as attachments. Some data room solutions also offer the ability to annotate pages of a document and just share those individually for comment and feedback which helps the recipient to focus on the task with the minimum of distractions. This is also useful when you want to restrict sensitive information that might be contained in other parts of the document.

Q&A management

At the heart of the VDR is a Q&A module. It’s where the buy-side can post questions for the sell-side team based on the folder structure. A formal communication tool that is an essential part of the due diligence process, it should support you and your team in staying on top of questions that arise as part of the discovery process.

Look out for:
A tool that provides a gatekeeper function to enable single or multiple users to review, approve and publish questions or answers. Filtering and search functions, plus once the due diligence process is completed, the ability to export records of Q&A content for future reference.

Encryption and security protection

VDRs use encrypted technology to provide the highest levels of security for a cloud-based platform. You need peace of mind that every document is securely stored and only seen by its assigned users. Consumer cloud-based storage systems such as Google Docs or OneDrive do not offer the same level of security or access control and can put documents and users’ details at greater risk of cyber-attack and data leaks.
Sign in controls also need to be robust with administrators able to access login reporting for full traceability.

Look out for:
SOC 2 and ISO 27001:2013 certifications which together give you confidence that the data room provider offers the highest level of security for confidentiality, data protection and information processing integrity. Evidence of regular auditing and vulnerability checks by the solution provider is important too.
As a minimum, user access should be controlled by two factor login protocols, (2FA), which requires every user to enter their username and email address followed by a code sent to their mobile device via SMS. In countries that issue them, electronic IDs may also be used to verify identity.

These features form the bedrock of any good VDR solution, but there are many others that will support the evolving due diligence process too.

In addition to the above, we suggest you choose a solution that offers comprehensive reporting to allow administrators to track login history, activities and task completion. Controlling user roles is an especially important factor – with sensitive and confidential information stored in the VDR, you’ll need the flexibility to set granular permissions by user, folder, document, and even activity level.

And finally, reliable and knowledgeable 24/7 technical support is essential. Naturally you expect a data room provider to be able to fix or answer any technical issues. But ideally, you want them to partner with you too, helping you to get the best from the data room, and its features, for your specific requirements.

Artificial intelligence (AI) for improved productivity and accuracy

While a secure data room utilises digitisation to transform the M&A process by reducing paper-based working and automating workflows, the need for legal advisors to sift through, often thousands of pages in that data room remains.

This laborious task is one factor in determining how long a due diligence period takes. It takes up the time of highly skilled lawyers in performing repetitive and low-level tasks when their time is better spent on deal analysis and legal or compliance matters.

A group discussing ideas
Using AI technology can help the deal team better allocate their time by allowing the AI tool to focus on unskilled tasks.

Therefore, while selective sampling is often used to check for red flags, it’s inevitable that some slip through the net. This can create a frustrating loop of problems that takes yet more time or perhaps even leads to the deal falling through.

AI technology can help by applying machine learning to the document review process. Using an algorithm to find patterns in a set of data, it automates the process of flagging items or areas of concern in hundreds or thousands of documents in one go. It’s more accurate than human review and of course much quicker.

This means the deal team can rely on the AI tool to focus on the unskilled aspects while they review the results of the search to assess or mitigate serious risks.

AI tools are increasingly offered as a key component of data room software and its impact is seen in saving costs, time and in reducing risk. We predict yet more innovation in this space as data room providers continue to find ways to speed up the due diligence phase of the M&A process.


Post-deal integration as part of due diligence

Post-deal or merger integration is traditionally separate to the main due diligence period. But many believe it should be part of the due diligence process itself involving at least some of the same personnel for consistency of message and strategy implementation.

Once the deal is struck, practical tasks will take centre stage. The complexity of successfully merging and managing multiple teams, locations, product sets, and other internal functions becomes apparent. Some staff may be put at risk of redundancy causing morale or productivity issues.

The importance of early consideration of cultural alignment is clear. Up to 20% of an established firm’s workforce and about a third of an acquired start-up’s workforce resign soon after the merger announcement is made or within the first year of completion. Reasons given are usually related to a mismanaged or under-considered cultural disconnect between the two sides.

While some fall out is likely from any deal, outcomes can be more positive if the integration process starts during the due diligence phase. Working early on culture, proactively and honestly communicating with existing staff on both sides of the deal, is crucial to success. It should also help evaluate synergies between the organisations:

Post-merger integration should not start after closing the deal, but already in the due diligence stage. During this stage, synergies between the buyer and target company are defined and the integration director can further assess and validate (timing of) these synergies.


Whether two companies have merged, one has acquired another, or a parent organisation has divested, there will be implications for staff morale, retention, and organisational culture. The earlier open and honest conversations are between the involved parties, and strategies for managing implications communicated, the greater the potential for a successful outcome. As EY argues, not only is this better for employees, it’s also what the financial markets are looking for.

In Summary

Dealmaking has seen enormous change and challenges in recent times. For M&A professionals, the implications have been equally challenging, and perhaps none more so than in the ways they must adapt to a changing regulatory environment and the increasing scrutiny of emerging factors such as environmental commitments, diversity and inclusion.

While technology, healthcare and energy transition sector opportunities are currently in the spotlight, so are the processes and systems used to fulfil the due diligence requirements of these opportunities. M&A teams that embrace technology, process automation, and continually review their approach to due diligence, will be best placed to drive growth through mergers, acquisitions, and divestitures.

Here at Admincontrol, our mission is to provide dealmakers with a secure data room solution to support an efficient due diligence process and ultimately increase the chance of deal success.

Our secure and intuitive data room is available on demand direct from our webshop.