The Reverse-Diligence Questionnaire: 75 Questions to Answer Before a Buyer Re-Trades You

The re-trade happens on a Thursday, three weeks before close

You've signed the LOI. The QoE held up. Then the buyer's operational diligence team — not the deal lawyers, the operators they brought in — asks one question: "Walk us through your disaster recovery test from last quarter." Your portfolio CEO goes quiet. There was no test. There is no documented plan. And in the next forty minutes, that single "I don't know" cascades into four more, the buyer's confidence interval widens, and the price you shook hands on quietly starts moving the wrong direction.

That is the re-trade, and it almost never starts in the financials. Roughly half of M&A transactions still collapse or get repriced during diligence (Rapid Diligence, 2025), and the cause is rarely a missed decimal in the EBITDA bridge — that's exactly the part everyone over-prepares. The damage comes from the operational black box: undocumented processes, key-person dependency, technical debt nobody priced, and security gaps. Cybersecurity alone now sits at the top of most deal teams' risk lists, and a clear majority of acquirers will widen indemnities, hold back escrow, or walk when they find an unmitigated exposure (PwC M&A Outlook).

So run their diligence first — 12 months early

Reverse diligence is simple in concept and brutal in execution: you sit in the buyer's chair and audit your own portfolio company with the scrutiny a strategic acquirer will apply a year from now. The deals that hold their price aren't the ones with the cleanest data room on day one. They're the ones where the operating partner already found the skeleton, decided whether to fix it or disclose it, and controlled the narrative. The 75 questions below are the ones I've watched buyers actually ask. None of them are soft "culture" questions. Every one is binary: there's evidence, or there isn't.

The 75 questions, sorted by what they cost you when the answer is "no"

Run this on each portfolio company 12 to 18 months before you intend to take it to market — not at the LOI stage, when it's too late to do anything but disclose. Score each as 1 (yes, with evidence a stranger could verify) or 0 (no, partial, or "let me check"). The domains are ordered the way buyers triage risk: revenue durability first, then the technical and human machine, then the deal-killers, then the finance plumbing.

Domain 1: Commercial & Revenue Architecture — "Is this revenue repeatable or just lucky?"

• 1. Is there a documented customer journey map that matches how sales actually closes deals today?
• 2. Is revenue quality backed by contractual price escalators, not handshake renewals?
• 3. Do you have gross margin by individual product/service line — not a blended number?
• 4. Is CAC payback tracked by segment, and is it under 12 months?
• 5. Is Net Revenue Retention calculated excluding price increases? (Buyers will recompute this.)
• 6. Does any single customer exceed 10% of revenue?
• 7. Are commissions paid on cash collected or on bookings?
• 8. Is there a Deal Desk with documented discount-approval authority?
• 9. Does win/loss analysis come from CRM data, not the VP of Sales' memory?
• 10. Is rolling 90-day forecast accuracy above 85%?
• 11. Are there phantom pipeline opportunities older than 2x the average sales cycle?
• 12. Is the channel/partner program governed by signed agreements?
• 13. Is churn coded by reason — product vs. service vs. price?
• 14. Are implementation fees margin-positive, or are they loss leaders hiding in revenue?
• 15. Do you measure Time to Value for new customers?

Domain 2: Technical Maturity & Product — quantifying the engineering black box

• 16. Has a third-party technical debt assessment been done in the last 12 months?
• 17. Is open-source licensing scanned and inventoried automatically?
• 18. What share of R&D spend is "keeping the lights on" vs. new features?
• 19. Is there a disaster recovery plan that was actually tested this year — the question that started this article?
• 20. Is there a written SDLC policy people follow?
• 21. Is cloud infrastructure codified (Infrastructure as Code)?
• 22. Where are the single points of failure in engineering? (Name the person.)
• 23. Is the product roadmap tied to specific revenue targets?
• 24. Are escaped defects reaching customers measured?
• 25. Is there a documented integration/API strategy?
• 26. If GenAI is in the product, is there governance for it?
• 27. Is there an end-of-life inventory for deprecated software?
• 28. Is data architecture documented (schema, data-flow diagrams)?
• 29. Are third-party libraries patched on a cadence, not on incident?
• 30. Can you demonstrate the platform scaling to 10x current volume?

Domain 3: Operational Scalability & Human Capital — "Does this survive the founder leaving?"

• 31. Is the founder personally closing more than 20% of deals?
• 32. Do SOPs exist for the core delivery functions?
• 33. Is the org chart documented with a clear definition of done per role?
• 34. Do you track founder dependency as a metric, not a feeling?
• 35. Is utilization tracked weekly against billable targets?
• 36. What's voluntary turnover by department?
• 37. Are non-solicit/non-compete terms in place for key staff?
• 38. Is there a real succession plan for the top three executives?
• 39. Are operational KPIs reviewed in a standing weekly meeting?
• 40. Is there a vendor management process for procurement and renewals?
• 41. Is onboarding formal, with a sub-30-day ramp?
• 42. Are functional leaders compensated on EBITDA contribution?
• 43. Does delivery depend on "heroics" to hit deadlines?
• 44. Are there SLAs for internal support functions?
• 45. Is engagement (eNPS) measured on a regular cadence?

Domain 4: Legal, Compliance & Cyber — the deal-killers

• 46. SOC 2 Type II or ISO 27001 — certified, not "in progress"?
• 47. Penetration test in the last six months?
• 48. Is everyone trained on phishing and security awareness?
• 49. Is there a documented incident response plan?
• 50. GDPR/CCPA compliant?
• 51. Are all IP assignments signed — employees and contractors?
• 52. Any pending or threatened litigation?
• 53. Are there change-of-control clauses in key customer contracts? (These detonate at signing.)
• 54. Is there cyber, D&O, and E&O coverage in force?
• 55. Are phantom stock or option grants documented and capped?
• 56. Is there a whistleblower policy?
• 57. Are contractor classifications legally defensible?
• 58. Do you audit supplier compliance, especially on data handling?
• 59. Is all software fully licensed — no untracked seats?
• 60. Any environmental liabilities, where applicable?

Domain 5: Financial Infrastructure — where operations and finance meet

• 61. Are financials audited by a reputable firm, not merely compiled?
• 62. Does the monthly close finish within 10 days?
• 63. Is there a 13-week cash flow forecast updated weekly?
• 64. Are EBITDA add-backs documented and defensible — the ones the QoE will challenge?
• 65. Is revenue recognition ASC 606 compliant?
• 66. Is billing-vs-revenue reconciled monthly?
• 67. How much receivable is aged past 90 days?
• 68. Is budget-vs-actual variance consistently under 10%?
• 69. Are LTV/CAC unit economics computed on a cash basis?
• 70. Is there a tax nexus study for every operating jurisdiction?
• 71. Are intercompany transactions documented (transfer pricing)?
• 72. Is there a CapEx vs. OpEx policy for software capitalization?
• 73. Are board decks standardized and reproducible?
• 74. Is a QoE prep file ready before the banker asks?
• 75. Can you produce a customer profitability report on demand?

What your score actually buys you — and the order you fix it in

Add it up. The total isn't a grade; it's a calendar.

• Above 65 — Exit-ready. The data room is clean and buyer confidence is high. This is where premium multiples live, because the buyer's diligence team finds nothing that lets them argue the price down.
• 45 to 65 — Yellow zone. You have six to nine months of work and a real risk of a protracted process. If you take it to market now, plan to defend every zero in the legal and cyber columns under pressure.
• Below 45 — Not ready. Don't run a process. The probability of a busted deal or a punishing re-trade is close to certain. Pull it back and rebuild the operating system first.

The sequence matters more than the score

If you land in the yellow zone, do not attack the questionnaire in numerical order. Fix it in the order that costs the most time and scares buyers the worst. Start with technical debt and cybersecurity — a pen test, a tested DR plan, and a SOC 2 path take months of calendar time you cannot compress, and they're the items most likely to make a buyer walk (the value-destruction pattern HBR documented holds: the new M&A playbook rewards integration-ready operations, not heroics). Next, clean up revenue quality: move customers onto standard contracts and purge the phantom pipeline. Last, write down the SOPs, because removing founder dependency is what turns a magician into a machine a buyer will pay a premium for.

Operational due diligence isn't a checkbox at the end. It's the moat that protects your multiple. Schedule a 75-question audit on every company you intend to exit in the next 18 months — and answer these on your timeline, in your conference room, instead of across the table while someone is renegotiating the price.