Key points
- A deal runs through about eleven stages, from the first idea to an integrated or separated business. Several of them overlap, and a buyer is usually working on three at once.
- The stages that decide value after closing (Day 1, the first 100 days and integration) are planned during diligence, not after it.
- Regulatory clocks set the minimum time between signing and closing: 30 days for a standard US HSR filing, 25 working days for an EU Phase I review, up to 30 working days for a UK National Security and Investment Act review.
- Technology risk is not a diligence-only topic. It shapes the target list, the price, the contract, the first morning after closing and the integration budget.
- Origination & sourcing
- Screening & thesis
- Approach, IOI & LOI
- Due diligence
- Valuation & structure
- SPA & risk allocation
- Signing to closing
- Day 1
- First 100 days
- Integration or separation
- Value creation & exit
Dark stages have a full guide; the rest are summarised below and get their own guide next.
The stages at a glance
The sequence below is written from the buyer's side of a private acquisition, which is where most of the work sits. A sell-side process runs the same stages in mirror image: preparing the business and the data room before buyers arrive, then managing bids, diligence and negotiation.
| Stage | What happens | Key documents | Technology risk to watch |
|---|---|---|---|
| Origination & sourcing | Building a pipeline of targets that fit a thesis, through intermediaries, networks and direct approaches to owners. | Target list, CRM records, teasers | Targets whose value depends on software or data the buyer cannot yet see. |
| Screening & thesis | Testing fit against the buy box and writing down why this business, at this price, creates value. | Screening memo, outside-in analysis | Public signals: breach disclosures, end-of-life platforms in job ads, dependence on one vendor. |
| Approach, IOI & LOI | Indicative offer, then a letter of intent that sets price, structure and an exclusivity period. | NDA, indication of interest, letter of intent | The exclusivity period fixes how long diligence has; technology work is often squeezed first. |
| Due diligence | Financial, commercial, legal, tax, people, technology and cyber workstreams test the thesis against the data room and management. | Data room index, information request list, diligence reports | Technical debt, security posture, licensing, key-person dependence, data rights. |
| Valuation & structure | Price, earn-outs, rollover equity and financing, adjusted for what diligence found. | Model, financing papers, Investment Committee memo | Remediation costs and one-off integration spend that belong in the model, not after it. |
| SPA & risk allocation | The purchase agreement allocates known and unknown risk through price, warranties, indemnities, escrow and insurance. | SPA, disclosure letter, W&I / RWI policy | Cyber, data protection and IP warranties; specific indemnities for known issues. |
| Signing to closing | Regulatory filings, third-party consents, financing and Day 1 planning run in parallel. | Merger filings, consent letters, Day 1 plan | Change-of-control clauses in software licences and customer contracts. |
| Day 1 | Ownership transfers; the business must keep running and paying people. | Day 1 checklist, communications pack | Access, email, payments and security handover. |
| First 100 days | The value-creation plan becomes owned, funded workstreams. | 100-day plan, KPI pack | Remediation of diligence findings with a budget and an owner. |
| Integration or separation | Combining with the buyer, or standing the business up on its own after a carve-out. | Integration plan, TSAs, synergy tracker | ERP, identity and data migration; exiting transition services on time. |
| Value creation & exit | Delivering the plan and preparing the next sale, often with vendor due diligence. | Board packs, vendor diligence reports | The next buyer's diligence of the same systems. |
1. Origination and sourcing
Origination is where a buyer decides which businesses it wants to see, and how it will reach them before competitors do. Financial sponsors work from sector theses and a buy box (revenue or EBITDA band, geography, ownership type); corporate acquirers work from strategy and capability gaps. Deal flow comes from investment banks and M&A boutiques, from networks and marketplaces, and from direct conversations with owners. For sponsors, add-on acquisitions for existing portfolio companies are a large share of the work: Preqin reports that add-ons accounted for more than half of global private equity deal count in the first half of 2026.1
Read the guide to origination and sourcing → · Deal origination tools and platforms →
2. Screening and the investment thesis
Screening turns a long list into a few names worth a meeting. The useful output is not a score but a written thesis: why this business, why now, what has to be true for the price to work, and which of those assumptions diligence must test first. Outside-in checks are cheap at this stage. Public breach disclosures, job advertisements asking for skills on platforms near end of life, and a single cloud or software vendor carrying the product all show up before any data room opens.
3. Approach, indication of interest and letter of intent
In a banked sale the buyer submits an indication of interest, then a more detailed offer after management presentations. In a direct approach the conversation moves from a non-disclosure agreement to a letter of intent. Either way, the letter of intent usually sets an exclusivity period, and that period decides how much diligence can be done. Technology and cyber work is often scheduled last and squeezed hardest, which is why it pays to agree the information request list for those workstreams before exclusivity starts.
4. Due diligence
Diligence tests the thesis. Financial (quality of earnings), commercial, legal, tax, people, operational, technology and cyber workstreams each read the data room, question management and report what they found and what they could not verify. The best diligence reports lead with the decision: the issues that change price, structure or the decision to proceed, each tied to the document that shows it. Our articles on what an Investment Committee needs from technology diligence and the technical debt patterns that change deal models go deeper on the technology side.
5. Valuation and structure
Findings become numbers: a price adjustment, an escrow, an earn-out, a remediation line in the model, or a decision to walk away. The common mistake is to treat technology findings as post-close problems. A platform that must be rebuilt, licences that must be repurchased or a security programme that must be built from scratch are costs of buying the business, and the model should carry them as such.
6. The purchase agreement and risk allocation
The share or asset purchase agreement decides who carries which risk. Known issues are priced, carved out or covered by specific indemnities; unknown issues are covered by warranties, and increasingly by warranty and indemnity (W&I) or representations and warranties (RWI) insurance. Insurers exclude what diligence has already found, so a known cyber weakness rarely transfers to the policy. It has to be dealt with in price or in a specific indemnity.
7. Signing to closing
Between signing and closing, the parties obtain regulatory clearances, third-party consents and financing. The regulatory clocks set the floor:
- United States (HSR): for most filings the waiting period is 30 days, or 15 days for cash tender offers and bankruptcy sales. A Second Request stops the clock until the parties substantially comply.2
- European Union: the Commission has 25 working days for a Phase I review and 90 working days for a Phase II investigation, which can be extended.3
- United Kingdom (NSIA): acquisitions in 17 sensitive areas must be notified; the review can last up to 30 working days once the notification is accepted, and a notifiable acquisition completed without approval is void.4
- United States (CFIUS): a 45-day review, followed if needed by a 45-day investigation and a 15-day presidential review.5
Antitrust rules also limit how far a buyer can direct the target before closing, so Day 1 planning that needs competitively sensitive information usually runs through clean teams under counsel's guidance.
8. Day 1
On the day ownership transfers, the business has to keep running: people paid, customers served, systems accessible, and nothing exposed by a careless handover of credentials or bank details. Day 1 is a short list of things that must work, rehearsed in advance.
9. The first 100 days
The 100-day plan turns the investment thesis into owned, funded workstreams with a weekly rhythm. It is also where diligence findings are either fixed or forgotten.
10. Integration or separation
A strategic buyer integrates the target into its own business, to the degree the deal thesis requires. A buyer of a carved-out business does the opposite: it stands the business up on its own, usually relying on the seller's systems and people under transition services agreements while it does.
Read the guide to post-merger integration → · Carve-outs and separation →
11. Value creation and exit
The holding period is where the plan is delivered, and the exit is where it is judged. Sellers increasingly commission vendor due diligence so that buyers start from a credible baseline. The systems, security and data practices fixed (or not) in the first 100 days are the ones the next buyer will diligence.
How long does a deal take?
There is no honest single number. The time from first contact to closing depends on whether the process is banked or bilateral, on financing, and above all on regulatory review: a deal that needs only a standard HSR filing can close weeks after signing, while one that triggers an EU Phase II investigation or a national security review can take many months. What a buyer controls is the work before signing, and the cheapest time to learn something is before exclusivity starts.
Where Vedekon fits
Vedekon covers the technology part of stage 4: it reads the data room, lists what is missing, and produces a report for the Investment Committee with every finding linked to its source and signed off by a named reviewer. The findings feed stages 5 to 9: the price, the purchase agreement, Day 1 and the 100-day plan. See the platform →