What they check before they trust you with something big
It arrives as a spreadsheet from procurement, a list of attachments a bank needs, or a question about what happens if you are unavailable. The hard part is already won, and the delay from here is administrative.
In short
The questionnaire arrives after the hard part is done. You won the work on merit, and now somebody in procurement, risk or finance has to sign off, and they do it by asking questions nobody at your company owns. Most of the delay is not that the answers are bad. It is that they live in six places and three heads, and assembling them under time pressure is what makes a competent company look shaky.
What we take on
Who you are
Entity in good standing wherever you operate, ownership clear, and a written answer to who can commit the company to what. The cheapest section to get right and the most damaging to fumble.
Whether you can deliver
Concentration risk, subcontractors, and real capacity. The key person question is asked politely and weighted heavily, because it is the thing that has burned them before.
Money and cover
Certificates that are current and name the right entity, invoicing that runs on a rhythm, and financials you could hand over without a week of preparation.
Data and access
Who can see a customer system, and what happens the day somebody leaves. Access removal is the single most predictive question at this size and the one most often unanswered.
Records that outlive people
Executed contracts in one findable place, a written path for scope changes, and enough audit trail that events can be reconstructed afterwards.
The folder, not the fire drill
The point is not to pass once. It is to answer in an hour, every time, without pulling three people off delivery to do it.
They are not testing whether you are good
This almost never arrives as a diligence process with a name. It arrives as a spreadsheet from somebody in procurement, or a list of attachments a bank needs, or a founder asking what happens if you get hit by a bus. It lands after you have already won on merit, which is what makes it so frustrating: the hard part is done and the delay is administrative.
And the delay is the real cost, not the outcome. Most competent companies would eventually pass. What they lose is three weeks assembling answers under time pressure while the other side watches, and watching a company assemble basic facts about itself is itself information. It suggests the same thing would happen if something went wrong mid-contract.
The pattern in the questions is consistent once you see it. Almost none of them tests whether you are good. They test whether the company works when the person in the room is not there. Is it written down, does somebody own it, could a stranger find it. A brilliant operation held entirely in one head scores badly, and that is not a flaw in the questionnaire.
Which is why the fix order matters more than the effort. Good standing and the access list are days of work and they are disproportionately visible, because a lapsed filing or a former employee with live access are the two findings that make somebody wonder what else is loose. Key person documentation is weeks, and nobody will hold it against you if it is genuinely in progress and you can say so.
The buyers who handle this best treat it as an asset rather than a hurdle. Assembled once and kept current, it becomes a folder you send in an hour, and the effect on the other side is out of proportion to the effort. A company that answers immediately reads as a company that has done this before, which is exactly the impression you are trying to make while asking somebody to trust you with something large.
None of this requires a compliance function or a consultant sitting in your business. It is a finite list, it is mostly writing things down that already exist, and the whole thing is normally a few weeks rather than a project.
The thirteen questions, and what each one is really for
Almost none of these is asking what it appears to ask. The good standing question is not about the filing, it is about whether anybody owns the calendar. The key person question is not curiosity, it is the risk they are most often burned by. Answering the surface question well and missing the real one is how competent companies still fail these.
| What they ask | What they are actually testing | What a weak answer tells them |
|---|---|---|
| Is the entity in good standing everywhere you operate? | Whether anybody owns the compliance calendar. It is the cheapest possible signal of whether the rest is looked after. | That an administrative failure went unnoticed. They now assume others have too. |
| Who is authorized to sign this? | Whether authority is defined or improvised. Also whether the person negotiating can actually commit. | That a contract might later be disputed as unauthorized, which is their risk, not yours. |
| What happens if your key person is unavailable for a month? | Concentration risk. This is the question most often asked politely and weighted heavily. | That they are buying one person rather than a company, and that person is not on their payroll. |
| Employees or subcontractors, and who exactly? | Whether their work will be done by people they have not vetted, and whether classification is clean. | That there is a compliance exposure attached to their contract that they did not agree to. |
| What is your capacity right now? | Whether you will take the work and then discover you cannot staff it. They have been burned before. | That the answer is being calculated for the first time in the meeting. |
| Do you carry the insurance the contract requires? | Whether the certificate exists today, names the right entity, and has not lapsed. | A scramble here reads as a company that renews things when reminded. |
| How fast do you invoice, and what are your terms? | Whether your cash cycle is stable enough that you will still be here in eighteen months. | Erratic invoicing suggests the finance function is somebody doing it when they get time. |
| Who at your company can see our data? | Whether access is granted deliberately or accumulated. The follow-up is always about removal. | That the list cannot be produced, which means it is longer than anybody thinks. |
| What happens to access when somebody leaves? | The single most predictive security question for a company this size, and the one most often unanswered. | That former staff probably still have access, and nobody would know. |
| Have you had an incident, and what happened? | Honesty, and whether there is a process. A well-handled incident is a better answer than none. | A flat no with no detection capability behind it reads as not having noticed. |
| Where are the signed contracts? | Whether records survive the person who made them. | That the relationship depends on goodwill and memory rather than documents. |
| How do you handle a change of scope? | Whether there is a change process or whether extra work is absorbed and later argued about. | That disputes are likely, and that they will be resolved by whoever is more stubborn. |
| Can you show who did what, and when? | Whether an audit trail exists at all. In regulated buyers this one is disqualifying. | That nothing can be reconstructed after the fact, including in your own defense. |
Notice how many are about whether something is written down rather than whether it is good. That is the whole pattern. They are not auditing your judgment, they are testing whether the company works when the person in the room is not there.
The order to fix them in, and roughly what each takes
Do not start with the hardest. Start with the ones that are cheap, fast, and most visible to somebody forming a first impression, because those buy you the benefit of the doubt on the slower ones.
- Good standing and the compliance calendar, a few daysCheck every state you operate in, fix what has lapsed, and put renewals on a calendar with a named owner. It is the cheapest item on this list and the most disproportionately damaging to fail.
- The access list, about a weekWrite down who can see what, across every system. Then remove everything belonging to people who have left. Almost every company doing this the first time finds at least one account that should have gone months ago.
- Offboarding, a day to write, ongoing to holdA checklist that runs every time somebody leaves, with a name against it. This converts the previous item from a one-off cleanup into something that stays true.
- Insurance and the certificate, a dayConfirm the coverage matches what your largest contracts require, that the named entity is correct, and that a current certificate can be produced in an hour rather than a week.
- Signing authority, a dayWrite down who can commit the company to what, and up to what value. One page. It removes an entire category of later dispute.
- Contract storage, about a weekOne place, searchable, with the executed version rather than the draft. The test is whether somebody other than you can find a contract from two years ago in five minutes.
- Key person cover, several weeksThe genuinely slow one, because it means documenting what only one person knows. Start with the process that would hurt most if they were unavailable, not with everything.
- Change control, a fortnightA written path for scope changes, including who approves and how it is recorded. This one pays for itself in disputes avoided regardless of whether anyone ever audits you.
Would you pass one tomorrow?
Five areas. Answer for what you could actually produce tomorrow morning without a scramble, not for what exists somewhere in principle.
How to use it, about two minutes
- Answer for tomorrow morning, not for the ideal caseThe question is what you could hand over without a scramble. Anything that would need writing first counts as missing, because under a deadline it is.
- Score the five areasDocumentation, systems and access, dependencies, incident history and what happens under load. These are the five that get tested.
- Fix the item that would take longest to produceLongest to produce is the same thing as most damaging under a deadline, and diligence deadlines are always somebody else's timetable.
1. Entity and authority
Good standing in every state you operate in, and who can sign what.
2. Delivery risk
What happens if your key person is unavailable, and who actually does the work.
3. Money and cover
Insurance certificates, invoicing terms, and financials you could hand over.
4. Data and access
Who can see a customer system, and what happens the day somebody leaves.
5. Records
Signed contracts, change control, and being able to show who did what and when.
Producible tomorrow, without a scramble
0 of 5
Answer the five to see where you stand.
What that means
A second opinion
Have one landing on your desk right now?
Send this over and you get back which gap would stall your deal first, what a good answer to it looks like in writing, and the order I would close them in. Your answers travel with it, so there is nothing to explain twice.
Goes to one inbox.
Diligence readiness is one of six areas in the broader business health check, which is the better starting point if a sale or a raise is not the immediate reason you are here.
What this usually leads to
Most of what fails a diligence check is documentation nobody wrote rather than work nobody did. Business documents is the writing, and legal operations covers the entity, filings and contract side that gets examined in the same week.
Questions we get
We are not raising or selling. Does this still apply?
More than if you were. The commonest version of this is a large customer sending a vendor questionnaire, and that happens to companies with no intention of ever raising anything.
Banks reviewing a facility, insurers, and enterprise procurement all ask overlapping versions of the same list. Doing it once covers all of them.
How long does it actually take?
Two to four weeks for most of it, and days for the parts that matter most on first impression. Good standing, the access list, insurance and signing authority are the fast ones.
Key person documentation is the slow one because it means writing down what somebody carries in their head. That can run in the background while everything else is already done.
What if we fail on something?
A known gap with a plan is treated very differently from a gap discovered during the process. Procurement and lenders deal with imperfect companies constantly. What they cannot price is surprise.
Saying "we do not have that yet, here is when we will" is a normal answer. Not knowing whether you have it is the one that costs you.
Who should own this internally?
One person, named, and not necessarily senior. Most of it is assembly and maintenance rather than judgment, and it fails when it belongs to everybody.
The one part that has to sit with a principal is signing authority, because that is a decision about the company rather than a record of it.
Is this a security questionnaire?
It overlaps and it is broader. Security questionnaires focus on data and access, which is two of the five areas here.
If your buyers are enterprise and your product touches their data, expect a longer security-specific list on top, and expect access removal to be the question they press hardest on.
We use subcontractors for most delivery. Is that a problem?
Not inherently, and it is common. It becomes a problem when it is discovered rather than disclosed, or when classification and agreements are informal.
What is needed is knowing who they are, having agreements that exist, and being able to say what happens to customer data they touch. Stated plainly up front it is rarely an obstacle.
Can we just fill it in when it arrives?
You can, and that is what most companies do. It is why most companies lose weeks.
The difference is not the quality of the answers. It is that assembling them under a deadline pulls people off delivery at exactly the moment you are trying to demonstrate capacity.
Does any of this help us if nobody ever asks?
Yes, and this is the part that surprises people. An access list, a written offboarding path and findable contracts pay for themselves in ordinary operation regardless of who asks.
The diligence request is just the event that finally makes somebody do it.
Do you do the work or tell us what to do?
The work, and the point is that it ends. The output is a folder your team maintains, plus the processes underneath it that keep it true.
Where something needs counsel, a broker or an accountant, that gets brought in for that piece rather than the whole thing being priced as advisory.
What does the first week look like?
Working through the list above against your actual situation, which usually takes a couple of sessions and produces more surprises than expected. Access lists in particular.
The output is a ranked gap list with a time estimate against each, so you can decide what to close before responding and what to disclose honestly.
More in the guides and every answer in one place.
Shaheer Shaikh, operations lead at LARVOL, a San Francisco AI company working with global pharma on clinical trial data and model benchmarking. Six Sigma on the process side, Anthropic certified on the Model Context Protocol, ten years across eight industries. More about the firm
Read next
The four areas this breaks into, and where each one is covered properly.