The typical M&A due diligence process can often create a false sense of security. Acquirers' legal teams request organizational documents, review material contracts, examine regulatory filings, and scrutinize minutes and resolutions, while their financial auditors validate revenue recognition and balance sheet integrity. Yet these conventional procedures often fail to identify the most consequential risks, such as embedded fraud, hidden regulatory violations, and inadequate anti-corruption controls.

When due diligence is conducted superficially, acquirers can inherit a portfolio of liabilities that may not surface until months or years after the transaction closes. By then, the deal is done, integration is underway, and the acquiring entity is legally accountable for violations committed by the target company before the acquisition was even contemplated.

5 essential M&A due diligence items

Comprehensive due diligence demands a structured approach that addresses multiple risk layers. An effective checklist must be tailored to the specific deal structure and industry, with the acquirere's in-house tax department playing a critical role in identifying hidden risks across each dimension.

1. Organizational documents — These tax experts should start by verifying corporate structure legitimacy, articles of incorporation, bylaws, and shareholder records. The tax department also must verify legal entity structures, subsidiary relationships, and tax residency across jurisdictions. Hidden or dormant entities, misalignments between operational and tax structures, or entities in high-risk jurisdictions warrant particular scrutiny, as these often signal tax evasion or sanctions violations.

2. Material contracts — They should also examine compliance clauses, assignment restrictions, and counterparty relationships. Tax professionals must scrutinize transfer pricing agreements, intercompany financing arrangements, and IP licensing structures because aggressive transfer pricing or unexplained intercompany payments may indicate schemes designed to shift profits to low-tax jurisdictions or conceal fraudulent transactions.

3. Regulatory and compliance considerations — The tax department should assess regulatory changes, investigations, and anti-corruption controls; they also must investigate prior audits, assessments, disputes, and uncertain tax positions. In addition, they need to identify undisclosed tax contingencies, pending disputes with tax authorities, and compliance gaps in transfer pricing documentation, beneficial ownership reporting, and country-by-country reporting requirements across relevant jurisdictions.

4. Minutes and resolutions — In-house tax experts should review any minutes and policy resolutions for discussions of known risks and compliance awareness. Tax professionals should further examine board minutes for tax disputes, regulatory inquiries, and tax strategy discussions. Resolutions that authorize complex or aggressive tax positions warrant particular attention because board-level debates about tax treatment often identify undisclosed risks.

5. Corporate transaction documents — Examine prior any financing and restructuring transactions done prior to the M&A deal for hidden liabilities. Tax professionals must assess how prior transactions were structured, whether tax positions were subsequently challenged, and identify contingent liabilities from existing tax indemnities. Deferred tax assets or liabilities from prior deals, questionable purchase price allocations, and transfer pricing exposures from restructurings can create substantial post-acquisition risks.

Other areas of due diligence importance

There are several other areas that acquirers' in-house tax teams should carefully look over, including:

Expanding on regulatory and compliance considerations

This category represents the highest risk area in most acquisitions, yet it receives insufficient attention from acquirers' in-house teams. Many acquirers conduct only surface-level compliance reviews, treating the area as a checkbox exercise rather than the comprehensive risk assessment it demands.

Corruption as a core due diligence responsibility

Acquirers face direct legal liability for corruption violations committed by the target company before and after closing. This means that conducting corruption due diligence must be mandatory and treated as the highest importance. These procedures should include a formal risk assessment that evaluates the target's exposure to corruption through high-risk jurisdictions, government-relations spending, and vendor relationships. Simultaneously, acquirers' investigative teams must evaluate whether the target's existing anti-corruption program adequately addresses those risks.

And this assessment should extend beyond compliance documentation. Investigators must conduct background checks on key employees and senior management to identify prior regulatory actions, sanctions designations, or problematic relationship networks. These employee interviews should probe for awareness of undisclosed schemes, kickback arrangements, or facilitation payments that could be masquerading as legitimate business expenses.

Data analytics and anomaly detection

Where traditional compliance reviews fail, data analytics succeed. By performing sophisticated data analytics on transactional records, expense reports, vendor payments, and personnel data, teams can reveal patterns invisible to traditional human review. Red flags such as duplicate payments to vendors with minor name variations, unusually high payments to vendors in jurisdictions known for corruption, or expenses immediately reversed and re-recorded can signal hidden schemes.

As financial fraud and AI-powered schemes become increasingly sophisticated, advanced analytics can identify relationships between employees, vendors, and government officials that may suggest undisclosed conflicts of interest. These anomalies form the foundation for deeper forensic investigation and often lead to discovery of systematic violations that compliance teams may have overlooked.

Remediation and implementation

When due diligence uncovers compliance gaps or violations, acquirers must require the target company to remediate identified issues before the close of the transaction. This means demanding that the target company implement proper internal controls, establish monitoring systems, and demonstrate genuine commitment to preventing future violations. Without such remediation, the acquiring entity assumes responsibility for historical failures and ongoing control weaknesses.

Post-acquisition, the combined entity must immediately implement the acquirer's compliance standards across the target company's operations, train the target's personnel on anti-corruption policies, and establish integrated monitoring systems that apply uniform standards across both organizations.

This requires a structured governance approach and the establishment of comprehensive fraud prevention frameworks, including clear accountability, dedicated ownership of compliance functions, and regular monitoring and reporting on compliance metrics.

The cost of overlooked due diligence

The financial and reputational consequences of inadequate due diligence during an M&A transaction are substantial. Companies that acquire targets that harbor embedded regulatory violations frequently face government investigations, enforcement actions, fines, and orders to implement expensive remediation programs. Beyond those direct costs, reputational damage, shareholder scrutiny, and management distraction can create lasting business impact.

More critically, modern regulatory enforcement increasingly holds acquirers liable not just for discovered violations, but for their failures to discover them. Regulators expect sophisticated acquirers to employ rigorous due diligence procedures. That means, when acquisitions result in the discovery of undisclosed violations, authorities often challenge whether the acquirer conducted adequate due diligence during the transaction. And in many cases, authorities may impose penalties based on that assessment.

Moving forward

The M&A landscape has fundamentally changed. Acquirers can no longer rely on traditional financial audits and surface-level legal reviews to validate target company compliance. The cost of inherited liabilities — both financial and reputational — demands a more rigorous approach.

Organizations that are currently conducting or contemplating acquisitions must treat regulatory and compliance due diligence not as a peripheral activity but as a central pillar of deal valuation and risk assessment. This means allocating sufficient resources to corruption due diligence, deploying forensic accountants and data analysts for investigations, conducting meaningful employee interviews, and requiring comprehensive remediation before close.

By implementing structured, multi-layered due diligence procedures that extend beyond conventional compliance checklists, acquirers can identify and address embedded risks before they become post-acquisition liabilities. In doing so, they protect their own financial performance, shield the acquirer's corporate reputation, and ensure that acquisition premiums create genuine value rather than hidden risk.

You can find out more about the compliance and risk challenges faced by corporations here‍