Due diligence is a test of whether the company described in the pitch exists in signed, current, internally consistent records. Build the room by claim: legal existence, ownership, revenue, intellectual property, employment, compliance, and liabilities. For each claim, name the evidence, its date, its owner, and any exception that must be disclosed.
Index the room by investor claim
Use seven practical workstreams: corporate authority; capitalization and financing; financial and tax; customers and suppliers; product, data, and security; intellectual property; and people, disputes, and compliance. The categories are an operating example, not a legal completeness opinion. Add regulated files required by the business and jurisdiction.
Give every row a document title, signed or final status, effective date, parties, owner, access level, last review date, and the claim it supports. Mark missing signatures, side letters, expired terms, conflicting totals, and oral promises as exceptions instead of burying them in folders.
Reconcile the high-risk chains
Trace corporate authority from charter and bylaws through board and shareholder approvals to each issued security. Trace revenue from signed contract to invoice, collection, accounting entry, renewal term, and concentration schedule. Trace IP from creator to assignment, repository, license, and product use.
A polished PDF does not cure a broken chain. If the cap table omits a SAFE, a contractor never assigned code, or reported recurring revenue includes a cancellable pilot, quantify the exception, identify the corrective action, and decide with counsel when and how it is disclosed.
Worked example: turn red flags into a closing list
Illustrative example, not a benchmark: a company finds three exceptions — one unsigned founder IP assignment, a $100,000 SAFE absent from the cap table, and a customer contract whose renewal was counted as committed revenue. Each becomes a row with severity, owner, cure, disclosure status, and target date.
Legal obtains the assignment, finance models the SAFE conversion, and sales separates contracted from forecast renewal. The CEO reviews whether the term sheet or disclosure schedule must change. Closing readiness is measured by resolved or expressly accepted exceptions, not by gigabytes uploaded.
- Corporate90 score
- Cap table75 score
- Contracts60 score
- IP and people45 score
NVCA Yearbook (worked example). Illustrative readiness scores, not observed market data.
Control access and jurisdiction
Stage access: index first, standard evidence after serious engagement, and sensitive source code, personal data, security material, or privileged advice only through counsel-approved controls. Keep an access log and a clean-room process where competition, privacy, export, sanctions, or trade-secret risk requires it.
NVCA documents, SEC guidance, YC forms, and Delaware records describe US mechanisms. They do not define Iranian, UAE, EU, or other disclosure, privacy, labor, tax, foreign-investment, or corporate requirements. Local counsel must set the actual checklist and privilege rules. This is not legal advice.
Frequently asked questions
What should founders upload first?
Upload a current index, corporate records, cap table support, financial statements, material contracts, IP chain, and exception log.
Should missing documents be hidden until fixed?
No. Record the exception, owner, cure, and disclosure decision with counsel.
How do I know the room is ready?
Material claims reconcile to signed evidence, and unresolved exceptions are quantified and deliberately disclosed.
Can I use this checklist outside the US?
Use it as an operating index only. Local counsel must add governing corporate, tax, labor, privacy, and investment rules.
Answers to the questions this topic usually leaves hanging.
How we sourced this
Every statistic in Build Investor Diligence from Claims to Evidence is attributed. Where a number is an estimate rather than a census, the note says so.
- NVCA model legal documentsUS venture closing documents and disclosure schedules.
- SEC capital-raising building blocksOfficial US offering, disclosure, and exemption context.
- Y Combinator documentsStandard financing instruments founders must inventory.
- Delaware Division of CorporationsOfficial entity and filing context for Delaware companies.
Primary sources used for this edition.
The bottom line
A red flag with an owner and disclosure path is safer than an immaculate folder hiding it.
If you want the adjacent decisions after Build Investor Diligence from Claims to Evidence, start with Legal diligence preparation, Cap table structure, Term sheet negotiation, Pre-money valuation.
