SaaS Due Diligence: The 50 Questions That Decide Your Multiple

The deduction starts the moment you say “let me check on that”

Picture the Tuesday a Series B-C SaaS founder doesn’t forget. A buy-side analyst, twenty-six years old, has your data room open on one monitor and your last board deck on the other. She isn’t reading your roadmap. She’s reconciling two numbers: the ARR you reported to your board, and the ARR she can actually tie to signed contracts and recognized revenue. When those two numbers don’t match, she doesn’t email you. She writes a note in a model, and that note becomes a number, and that number comes off your purchase price.

This is the part founders misunderstand. Roughly 47% of M&A deals collapse during due diligence, and the survivors get repriced on the way to close (Rapid Diligence). They don’t fail because the product is weak. They fail because the documentation of the business quietly contradicts the story the founder has been telling for three years — and the buyer assumes that wherever the story drifts from the paper, the paper is the truth and the story was optimism.

SaaS is uniquely exposed here. A manufacturer’s diligence is mostly about machines and inventory you can count. Your business is a stack of recurring-revenue assertions: that the ARR renews, that the code is yours, that the gross margin survives at scale. Every one of those assertions is auditable, and a 2026 buyer audits all of them. With the median SaaS ARR multiple sitting around 6.1x (First Page Sage), a single percentage point of net revenue retention you can’t defend in a cohort table moves real millions.

What follows is the actual interrogation — not a generic acquisition checklist, but the 50 questions a SaaS-native buyer aims at a recurring-revenue business specifically. They cluster into five places where SaaS deals die. The point of reading them now is so that on your Tuesday, the answer is never “let me check on that.”

The 50 questions, and why each one is a trap

Revenue quality: is the ARR real, and does it stay?

A buyer doesn’t trust your ARR number. They trust the cohort table underneath it. SaaS revenue is the one asset that can grow while quietly rotting, so these ten questions test whether your growth is compounding or just being refilled with cash.

• 1. Net Revenue Retention by cohort, monthly, for 36 months — not a single blended figure. (>104% is median; the top decile clears 120%, per SaaS & Co.)
• 2. Gross Revenue Retention separately — expansion can’t be allowed to hide churn. Under 90% and the bucket leaks.
• 3. CAC payback on a gross-margin basis, not a revenue basis — the version that includes your cost to serve.
• 4. Any single customer over 10% of ARR? (The concentration math: how one logo compresses your multiple.)
• 5. Logo churn versus revenue churn — losing many small accounts and losing one whale are different diseases.
• 6. How much “ARR” is actually one-time implementation or professional services dressed as subscription?
• 7. The bridge from bookings to recognized revenue under ASC 606 — this is where SaaS founders get caught.
• 8. Win rate against your three named competitors, by quarter.
• 9. Average end-of-quarter discount versus start-of-quarter — a proxy for how badly the sales team is sandbagging.
• 10. How many “active” accounts are dark — zero logins in 30 days — but still counted in ARR?

Technical debt: the silent rewrite tax

For a SaaS company the codebase is the asset, so this is where the “black box” discount lives. If the buyer suspects a rewrite is coming, they price the rewrite and hand you the bill.

• 11. Share of engineering hours on maintenance and bugs versus new features. Over 30% on bugs is a flag.
• 12. An automated software bill of materials for every open-source dependency.
• 13. A third-party license-compliance scan — Black Duck, Snyk, or equivalent.
• 14. Automated test coverage percentage, with the trend line.
• 15. Single points of failure — the one legacy box that, if it dies, the product dies with it.
• 16. A disaster-recovery plan that was actually executed in a drill in the last 12 months, not just written.
• 17. Enforced MFA across every internal system — no exceptions for the founder.
• 18. True multi-tenancy versus single-instance “fake cloud” spun up for big logos — the latter destroys your gross margin at scale.
• 19. Measured uptime versus contracted SLA, including any penalties paid.
• 20. Date of last penetration test, with every Critical and High remediated.

Financial rigor: where your EBITDA gets stripped

Buyers assume your adjusted EBITDA is generous. They rebuild it from the bottom to find the cash the business actually throws off.

• 21. Your current Rule of 40 score (growth % + margin %), and the trend.
• 22. A line-by-line justification for every add-back (which ones survive and which get rejected).
• 23. Days Sales Outstanding trend — rising DSO often means quietly unhappy customers slow-walking renewals.
• 24. Whether you capitalize software development costs, and the exact methodology if you do.
• 25. Your burn multiple: net new ARR divided by cash burned.
• 26. Whether unit economics use blended CAC or fully loaded CAC.
• 27. Forecast-to-actual variance across the last eight quarters — this measures whether you can forecast at all.
• 28. A detailed COGS breakdown: hosting versus support versus implementation.
• 29. Whether sales commissions are expensed on signing or amortized over contract life (ASC 606 again).
• 30. Any debt covenants and their triggers.

Legal and IP: do you even own what you’re selling?

This is the fastest kill in the deck. There is no negotiation if the buyer discovers you don’t hold clean title to your own product.

• 31. Signed IP-assignment agreements from 100% of current and former employees and contractors — including the offshore dev you used in year one.
• 32. Change-of-control clauses in your top 20 contracts — the ones that let a customer walk the day the deal closes.
• 33. Any GPL or copyleft code touching your proprietary codebase.
• 34. SOC 2, plus GDPR, CCPA, and any vertical regime (HIPAA if you touch health data).
• 35. Pending or threatened litigation.
• 36. Clean title to every domain and trademark.
• 37. Sales-tax nexus — have you collected in every state where you have it? An unbooked SaaS sales-tax liability is the classic seven-figure surprise.
• 38. Whether your published privacy policy matches what your code actually does with data.
• 39. Adequate cyber and E&O coverage.
• 40. Any side letters or undisclosed pricing concessions buried in customer files.

People: who walks when the check clears

The buyer is acquiring a system that runs without you. These questions test whether it actually does.

• 41. Unwanted attrition by department, last 24 months.
• 42. The key-person list — the three to five people whose departure stalls the business.
• 43. Whether a real founder-extraction plan exists, or the CEO is still personally closing every enterprise deal.
• 44. Quota attainment distribution — is revenue spread across the team, or carried by two hero reps?
• 45. eNPS, with the methodology.
• 46. The real org chart versus the shadow one.
• 47. Change-of-control bonuses and retention triggers this deal would fire.
• 48. Any undocumented equity promises.
• 49. Whether the roadmap freezes if the founders leave tomorrow.
• 50. Who, specifically, the buyer must retain for 24 months — and whether they’re already locked in.

How to make sure none of these surprises you

Fifty questions is meant to feel like a lot. The buyer’s leverage comes entirely from asymmetry: they’ve run this script a hundred times and you’re running it once. You close that gap by running diligence on yourself, on your schedule, before anyone with a checkbook does it on theirs.

Reconcile the two ARR numbers first

Before anything else, do the exact reconciliation the analyst will do: tie the ARR in your board deck to ARR you can prove from signed contracts and recognized revenue. If those two figures diverge by even a few points, that gap is the first thing a buyer will find — and the first thing they’ll use to argue your whole story is inflated. Fix the number or be ready to explain the difference cold.

Run a mock diligence six months out

Hand this list to a third party — an operator who has sat on the buy side — and let them attack your answers the way a hostile auditor would. It is far cheaper to discover an unbooked sales-tax nexus liability from someone on your payroll than from a buyer’s accountant who will use that same liability to carve a multiple of it off your price. Build the answers into a data room you maintain monthly, so when they ask for question 17, you send a folder link, not a freshly drafted policy.

Write the narrative bridge for every red flag

You will have ugly answers. The goal isn’t a perfect business; it’s a defended one. For each weak number, prepare the one-sentence bridge that controls the story: “GRR dipped to 88% the quarter we deliberately offboarded three unprofitable legacy accounts; it’s back to 92% and gross margin rose four points.” Stated by you, that’s a deliberate margin decision. Discovered by them, it’s churn you tried to hide.

The spread between a SaaS asset that survives this script clean and one that gets repriced through it is enormous — often a 2x to 3x swing on the revenue multiple, on the same product. The difference almost never lives in the code. It lives in whether the founder treated diligence as something done to them, or something they rehearsed until there was nothing left to find. For the underlying mechanics, see how to build a data room that impresses PE buyers.