A commercial due diligence lives or dies by its calendar. The best teams don’t “work hard and hope”; they architect the sprint so that the right answers arrive before the right decisions. Workplan design and governance give you that edge. This chapter shows how to translate an Investment Committee date into a day‑by‑day run plan, identify the few activities that sit on the critical path, and build the gates, cadences, and escalation rules that keep the program on track. The aim is pragmatic: compress time without compressing judgment. You will back‑schedule from the decision date, lock resource commitments, protect long‑lead items (primary research, clean‑team approvals, data purchases), and install a governance rhythm that surfaces bad news early enough to act on it.
3.1 Critical Path and Timeline Mapping – Step-by-Step Guide
Critical path mapping turns a complex diligence into a sequence of promises: who will do what, by when, and in what order so that the decision is ready on time. The goal is not a pretty Gantt chart—it’s a schedule that correctly anticipates dependencies and allocates scarce hours to the few items that move value. Use the steps below to build a resilient plan in under a day and keep it current throughout the sprint.
- Fix the decision and work backward
Start by writing the single decision the plan must enable (price, structure, and conditions) and the exact Investment Committee date and time. From that timestamp, back‑schedule immovable activities: deck freeze, management Q&A, legal and QofE sign‑offs, and internal sponsor read‑outs. Place them on the calendar as “hard gates.” Everything else will move around these. - Define “done” in deliverable terms
List the deliverables required to make the decision credible: dual‑method market sizing, pricing and unit economics exhibits, customer evidence with anonymized quotes, competitor response scenarios, and a driver‑based model with sensitivities. For each, state acceptance criteria (replicable, footnoted, confidence level). If a deliverable can’t be described crisply in a sentence, it will be hard to land on time. - Enumerate activities and estimate durations
Break the work into atomic activities that produce those deliverables: expert calls, customer interviews, dataset purchases, outside‑in sizing builds, price architecture reconstruction, cohort analysis, model build, scenario runs, and synthesis. Give each a realistic duration in business days, not hours. Use base‑rate heuristics: scheduling 12–15 targeted customer conversations often takes a week, expert calls can begin within 48–72 hours, and clean‑team or counsel approvals may need 24–72 hours. Timebox analysis sprints (e.g., “bottom‑up build—2 days,” “price realization—3 days”) so they can be governed. - Map dependencies explicitly
For each activity, mark its predecessors (what must finish before it can start) and its potential to proceed in parallel. Examples: you can begin top‑down sizing while the bottom‑up build is still assembling inputs; you cannot compute realized price without either invoices/contracts or validated interview evidence. Note approvals that gate access—clean team, MNPI guidance, survey compliance—so you can start them Day 0. - Identify the critical path
With durations and dependencies defined, trace the longest chain of dependent tasks from today to the IC gate: that is your critical path. Everything on it is intolerant to slippage. Label those activities in your tracker and assign your most reliable capacity to them. Non‑critical tasks still matter, but they should flex first when trade‑offs appear. - Front‑load killer variables and long‑lead items
Anything that, if false, changes price or go/no‑go belongs at the front of the plan. Launch dual‑method market sizing and the first wave of customer work in the first 48 hours. Place purchase orders for external datasets immediately. Submit clean‑team and counsel approvals on Day 0, not “after we see what’s in the data room.” If access is uncertain, execute contingency paths (e.g., channel checks, distributor interviews) in parallel. - Build a T‑minus schedule with freeze points
Translate the path into a T‑minus narrative that everyone can follow. A practical four‑week pattern looks like this: T‑20 to T‑16—launch primary research, pull top‑down series, start bottom‑up build, and reconstruct price architecture from available artifacts; T‑15 to T‑11—land first customer evidence, reconcile top‑down and bottom‑up sizing, and run first pass on unit economics; T‑10 to T‑7—lock market definition, close the first pricing and retention exhibits, and run competitor response scenarios; T‑6 to T‑4—update the driver‑based model, run sensitivities, and begin storylining; T‑3—deck freeze for internal dry‑run; T‑2—final integration of cross‑stream answers; T‑1—sponsor read‑out and QA; T‑0—IC. Adjust durations to your deal, but retain the concept of scheduled freeze points—you need them to finish. - Insert buffers where risk is real
Buffers are not laziness, they’re insurance. Add explicit slack to activities with external dependencies (customer scheduling, legal reviews, data vendor delays). Use small, distributed buffers (0.5–1 day each) rather than one big cushion at the end. Protect the synthesis window—crowding it with unfinished analysis is the most common failure mode. - Parallelize safely
Run activities in parallel when they do not share a gating dependency. For example, launch expert calls, top‑down sizing, and survey programming simultaneously. Pair analysts (“two‑in‑a‑box”) on critical exhibits to allow handoffs and QA without time loss. Parallelization without clear ownership creates rework; use the chartered owners to keep lines straight. - Lock a daily cadence tied to the plan
Install a short daily stand‑up focused on the critical path: What slipped? What is blocked? What will clear the block today? Use a one‑page tracker with RAG status on each critical activity, the next milestone date, and a single line on risk and ask. Longer working sessions are fine, but the daily checkpoint exists to protect the schedule. - Tie governance gates to decisions, not dates
Set three formal gates: early (Day 3–4) to call red flags on killer variables, mid‑sprint (end of Week 1 or 2) to decide scope deepening or price changes, and pre‑IC (T‑3) to lock the story and exhibits. Each gate must end with a written decision: continue as planned, change price/structure, or stop. Gates without decisions are status meetings; don’t hold them. - Write escalation triggers into the plan
Decide up front what forces a schedule change: failure to secure customer access by a named date, unresolvable data quality issues, or discovery that a critical assumption is breaking (e.g., realized price is materially below expectation). Name who can approve extra spend, reallocate staff, or pivot scope, and specify the expected time‑to‑decision. Put these triggers next to the activities they govern. - Reserve synthesis and QA time explicitly
Block calendar time for exhibits to be peer‑reviewed, footnoted, and replicated from the model and source register. Require a model integrity check (formula transparency, version control, sensitivity coverage) before exhibits leave the workbench. Protect at least one full day for storylining and one for final QA—even on short sprints. - Publish the plan where people actually work
Store the critical path, dependencies, owners, and dates in your single source of truth (the same workspace that holds your hypothesis cards, risk ledger, and charters). Version it. Every status update should reference the same artifact. Email screenshots if you must, but the plan lives in one place.
Inputs you should confirm before you map the path
- Investment Committee date/time and any pre‑reads or sign‑off requirements.
- Clean‑team and MNPI rules; counsel turnaround times.
- Access realities: management availability, data room quality, permissions for customer/channel outreach.
- External vendors: dataset availability, PO process, typical delivery times.
- Cross‑stream interfaces: when QofE, legal, tech/ops need answers and when they will return theirs.
Sanity checks for your timeline
- Can all killer variables be tested with two methods before the mid‑sprint gate?
- Do long‑lead items start on Day 0, not Day 5?
- Is there an explicit buffer before synthesis and QA?
- Are non‑critical activities scheduled to flex first when trade‑offs arise?
- Is every dependency visible, owned, and tied to a date?
Common pitfalls to avoid
- Optimistic scheduling of primary research; treat recruiting and compliance as real work.
- “One big buffer at the end” that gets eaten by analysis creep.
- Gates that review but do not decide; make the outcome explicit.
- Hiding slippage inside the model or slide draft instead of re‑baselining the plan.
- Parallel work without owners, leading to duplicated effort and version chaos.
When you run this play, the calendar stops being a source of stress and becomes a source of control. The plan shows where hours win value, what must happen next, and how you’ll recover when the world behaves like the world. That is the practical definition of a critical path that works.
3.2 Role & Responsibility Matrix Template
Speed without clarity is chaos. A role and responsibility matrix is how you prevent it. In a compressed CDD sprint, decisions stack quickly: who owns hypotheses, who can change scope, who signs off on exhibits, who approves spend, who escalates access issues, and who is allowed to see what under clean‑team rules. The matrix answers these questions once, in writing, and becomes the control surface for the entire program. Build it on day one, publish it where the team works, and enforce it daily.
Use a simple RACI with one twist: add V for verifier (quality assurance). Definitions are crisp. Responsible (R) does the work. Accountable (A) makes the decision and carries the can—exactly one A per decision. Consulted (C) provides input before the decision. Informed (I) is updated after. Verifier (V) independently checks accuracy and replication before anything leaves the workbench. If you keep these five tags consistent, the matrix will survive pressure and handoffs.
Start with a compact catalog of roles, then map each critical decision or deliverable to R, A, C, I, and V. Keep the matrix short enough to be used—20 to 30 lines that track real milestones, not every task. When trade‑offs appear or access is thin, the matrix tells you who decides and how fast. When clean‑team rules apply, the matrix also tells you who can—even legally—see the data.
Role catalog (assign names next to each):
- Deal lead (sponsor side)
- CDD lead partner
- CDD engagement manager / PMO
- Market sizing lead
- Pricing & unit economics lead
- Customer & retention lead
- Competitive dynamics lead
- Go‑to‑market lead
- Primary research lead (surveys/interviews)
- Data & analytics lead (model owner)
- Storyline & quality lead (deck owner)
- Model QA verifier
- Legal counsel (including antitrust and MNPI)
- Quality of Earnings (QofE) lead
- Technology/ops diligence lead
- Tax diligence lead
- ESG/EHS diligence lead
- Clean‑team coordinator / compliance
- Vendor management / procurement (data purchases)
- Knowledge manager (sources, citations, data book)
How to build the matrix in 20 minutes:
- List the 12–15 decisions or deliverables that truly move value (killer variables first).
- For each, write one sentence that defines “done” and the date it is needed.
- Assign exactly one A; assign at least one R; add a V for QA; add C and I only where they change the outcome or reduce rework.
- Mark any clean‑team restrictions for that line (e.g., “clean only” for invoice‑level price analysis).
- Publish the matrix and pin it in your workspace; review it at the daily stand‑up.
Template you can copy and fill (one line per milestone):
- Milestone name — Due date — A: [name] — R: [name] — V: [name] — C: [names] — I: [names] — Clean‑team notes: [rule].
Default RACI+V for common CDD milestones (edit to fit your deal):
- Hypotheses locked — A: CDD lead partner — R: Engagement manager — V: Storyline & quality lead — C: Deal lead, workstream leads — I: All.
- Scope & not‑doing list set — A: Deal lead — R: Engagement manager — V: Storyline & quality lead — C: Legal, QofE — I: All.
- Clean‑team protocol approved — A: Legal counsel — R: Clean‑team coordinator — V: CDD lead partner — C: Deal lead — I: All.
- Primary research launched — A: Engagement manager — R: Primary research lead — V: Storyline & quality lead — C: Legal (MNPI), workstream leads — I: All.
- Top‑down market sizing (v1) — A: CDD lead partner — R: Market sizing lead — V: Model QA verifier — C: Deal lead — I: All.
- Bottom‑up market sizing (v1) — A: CDD lead partner — R: Market sizing lead — V: Model QA verifier — C: Primary research lead — I: All.
- Price architecture reconstruction — A: Pricing lead — R: Pricing analyst — V: Model QA verifier — C: Legal (rebates/MFNs), QofE — I: All.
- Retention & cohort analysis — A: Customer & retention lead — R: Analyst — V: Model QA verifier — C: QofE — I: All.
- Unit economics by segment — A: Pricing & unit economics lead — R: Analyst — V: Model QA verifier — C: Ops/tech lead — I: All.
- Competitor response scenarios — A: Competitive dynamics lead — R: Analyst — V: Storyline & quality lead — C: Deal lead — I: All.
- Driver‑based model (v1) — A: Data & analytics lead — R: Model owner — V: Model QA verifier — C: CDD lead partner — I: All.
- Mid‑sprint gate decision — A: Deal lead — R: CDD lead partner — V: Storyline & quality lead — C: QofE, legal — I: All.
- Synthesis & storylining — A: Storyline & quality lead — R: Engagement manager — V: CDD lead partner — C: Deal lead — I: All.
- Cross‑stream sign‑offs (QofE/legal/ops/tech) — A: Deal lead — R: Respective stream leads — V: CDD lead partner — C: Engagement manager — I: All.
- Deck freeze — A: Storyline & quality lead — R: Engagement manager — V: CDD lead partner — C: Deal lead — I: All.
- Final model lock & sensitivity suite — A: Data & analytics lead — R: Model owner — V: Model QA verifier — C: CDD lead partner — I: All.
- IC read‑out — A: Deal lead — R: CDD lead partner — V: Storyline & quality lead — C: Investment team — I: All.
- Post‑mortem & archive — A: Engagement manager — R: Knowledge manager — V: CDD lead partner — C: Deal lead — I: All.
Access and clean‑team overlay (apply line‑by‑line):
- Mark “clean only” for any task that touches competitively sensitive, customer‑level, or invoice‑level data.
- Identify which named individuals are clean vs. non‑clean; list what can be shared (aggregated, anonymized) and the path for counsel sign‑off.
- For primary research, record the approved script, who can field interviews, and how raw notes are redacted before wider sharing.
Decision rights and spend controls:
- Scope change authority — A: Deal lead; R: CDD lead partner; V: Engagement manager; C: Legal/QofE.
- External spend over threshold — A: Deal lead; R: Engagement manager; V: Procurement; C: CDD lead partner.
- Access escalation to management — A: Deal lead; R: Engagement manager; V: Legal; C: CDD lead partner.
Quality and verification rules (use V deliberately):
- Every exhibit tagged V must be replicated from source registers and model outputs before circulation.
- The verifier cannot be the same person as R for that line.
- Any unverified exhibit must carry a visible “Draft—Not Verified” label in working sessions.
Coverage and continuity safeguards:
- Name a deputy for each A and R; record out‑of‑office windows and time‑zone coverage.
- If R is unavailable >24 hours, the deputy becomes R until the owner returns; PMO updates the matrix.
- Keep a single “owner map” with mobile/Slack/email for all A/R/V roles.
Signals your matrix needs a fix:
- Two or more people think they are A for the same decision.
- QA is consistently late because V is assigned after work begins.
- Access is blocked because the clean team isn’t named at the task level.
- Rework appears after gates; C was missing or added too late.
Quick audit checklist (run at the daily stand‑up):
- Every critical milestone has exactly one A.
- Every killer variable has an R and a V.
- Clean‑team constraints are written next to the tasks they govern.
- C and I lists are short; no spectators with veto power.
- Deputies named for all A and R roles; availability confirmed.
When used rigorously, the matrix becomes your operating system. It reduces ambiguity, speeds decisions, protects compliance, and raises the quality bar—so your team can spend its scarce hours proving what moves value, not negotiating who does what.
3.3 Governance Cadence Checklist
Governance is the heartbeat of a diligence sprint. It keeps the workplan honest, converts analysis into decisions, and prevents last‑minute heroics from substituting for judgment. A strong cadence is light on ceremony and heavy on outcomes: short, frequent checkpoints that protect the critical path; time‑boxed gates that force go/continue/stop calls; and a simple set of artifacts that make progress and risk visible. Treat governance as design, not hygiene—you’re engineering a flow that gets the few value‑moving answers in front of decision‑makers on time.
Start with principles. Meetings exist to move decisions, not to recite status. The cadence must reflect the deal timeline, not habit. Clean‑team and MNPI rules are governance, not fine print. Every checkpoint should reference a single source of truth—the hypothesis tracker, critical path, risk ledger, and model version—so you never debate “which numbers.” Finally, governance is not just schedule control; it is also quality control. Exhibits that aren’t verified should be labeled as such, and QA should be a step in the cadence, not an afterthought.
A practical cadence for most CDD sprints includes four layers: a daily stand‑up to protect the critical path, a twice‑weekly sponsor touchpoint to unlock decisions, a weekly cross‑stream sync to clear dependencies with QofE/legal/ops/tech, and three formal gates (early, mid‑sprint, pre‑IC). In faster deals, you compress intervals but keep the structure. In longer ones, you add depth to QA and synthesis windows rather than more meetings.
Use the checklist below to design and run your cadence. Copy it into your workspace, fill each line with names and dates, and hold the team to it.
Cadence design essentials
- Decision date fixed and back‑scheduled; hard gates placed on the calendar.
- Single source of truth named and linked in every invite.
- Roles and decision rights mapped (R/A/C/I/V) for all governance events.
- Clean‑team/MNPI rules embedded in invites and recapped at the start of sensitive sessions.
- Buffers inserted before synthesis and QA, not piled at the end.
Daily stand‑up (10–15 minutes)
- Objective: protect the critical path and clear blocks.
- Inputs: one‑page tracker with RAG statuses, next milestone dates, risks, and asks.
- Prompts: what slipped, what’s blocked, what clears today, what decision is needed.
- Output: updated plan, explicit owner for each unblock, and any re‑baselining.
Sponsor touchpoint (2x per week, 20–30 minutes)
- Objective: make decisions and approve trade‑offs.
- Inputs: hypothesis confidence deltas, killer variable status, spend/access escalations.
- Output: price/structure guidance if a killer variable breaks; scope changes; PO approvals.
Cross‑stream sync (weekly, 30 minutes)
- Objective: clear dependencies with QofE, legal, ops/tech, tax, ESG.
- Inputs: issues log with owners and due dates, specific questions per stream.
- Output: confirmed handoffs, updated risk ledger, and integration of answers into the model.
Gate reviews (time‑boxed, outcome‑driven)
- Early gate (Day 3–4): confirm or kill top killer variables; decide to continue/deepen/stop.
- Mid‑sprint gate (end of Week 1 or 2): lock definitions, approve scope pivots, adjust price or structure if warranted, confirm dataset purchases.
- Pre‑IC gate (T‑3): deck/storyline freeze, model and sensitivity suite locked, cross‑stream sign‑offs complete, open risks translated into terms or conditions.
Artifacts required for governance
- Hypothesis tracker with numeric thresholds, owners, and confidence ratings.
- Critical path with dependencies, buffers, and next milestone dates.
- Risk ledger capturing issue, exposure, owner, due date, confidence, and mitigation.
- Decision log noting what changed (price, structure, scope), when, and why.
- Source register and model version log so exhibits can be replicated.
Quality assurance embedded in cadence
- Verifier sign‑off required before exhibits move beyond the workbench.
- Model integrity check scheduled prior to each gate (formula transparency, inputs, sensitivities).
- Footnotes mandatory for all material claims; any unverified exhibit labeled “Draft—Not Verified.”
- Random spot‑checks by the QA lead on source attribution and math.
Compliance and clean‑team controls
- Clean‑team roster and permissions reiterated in the first minute of any session involving sensitive data.
- Primary research guardrails restated: who calls, what scripts, how raw notes are redacted.
- Counsel turnaround times built into the calendar for approvals and data sharing.
- Prohibited topics (pricing coordination, customer allocation) listed in invites to avoid drift.
Health metrics to monitor
- On‑time completion rate for critical path tasks (target ≥ 90%).
- Interview completion vs. target by cohort (target ≥ 80% by T‑10).
- QA first‑pass acceptance rate (target ≥ 85%).
- Variance between top‑down and bottom‑up market sizing (target ≤ 15% before reconciliation).
- Open red‑flag count and days‑open (target: no red flag older than 3 working days).
Escalation triggers and SLAs
- Killer variable blocked >24 hours despite owner action → escalate to sponsor; decision within the next business day.
- Customer outreach below 50% of target by end of Week 1 → authorize substitutes (channel checks, expert calls) same day.
- Market sizing variance >25% after first reconciliation → add second method or new dataset within 48 hours.
- Legal/compliance approval pending beyond agreed SLA → engage counsel in the stand‑up and re‑route the plan within 24 hours.
- Model mismatch between exhibits and version log → freeze exhibits until model is re‑baselined and verified.
Asynchronous norms that reduce meeting load
- Written updates posted in the workspace before the stand‑up; meetings start from written status, not oral recaps.
- Decisions recorded in the decision log within one hour; links dropped into the relevant channel.
- File‑naming convention and versioning enforced; only links to the source of truth in emails and chats.
- Questions for sponsors batched into twice‑weekly touchpoints unless they block the critical path.
Synthesis prep built into cadence
- Storyline working session scheduled at T‑6 to align on narrative and exhibits.
- Dry‑run at T‑3 with adversarial Q&A; assign owners to close gaps the same day.
- Final QA day blocked at T‑2; no new analyses accepted unless a red flag demands it.
Signals your cadence needs a reset
- Stand‑ups drift past 15 minutes or become slide reviews.
- Gates end without a documented decision or owner.
- Confidence ratings change in decks but not in the tracker.
- “Who owns this?” or “Which number is right?” appears more than once.
- Sponsor questions repeatedly surprise the team; touchpoints aren’t absorbing decision demand.
One‑page governance pack (attach to your kick‑off)
- Calendar with stand‑ups, touchpoints, cross‑stream syncs, and gates.
- Names and contact details for A/R/V roles.
- Links to hypothesis tracker, critical path, risk ledger, decision log, and source register.
- Clean‑team memo and primary research compliance note.
- SLAs and escalation rules in five lines or less.
Run this checklist with discipline and your governance stops being a meeting habit and becomes a competitive advantage. The cadence will surface bad news early, protect synthesis time, and give sponsors the confidence to act—because every session ends with a decision, every artifact tells the same story, and every risk has an owner and a date.
3.4 Project-Level Risk Management Plan Template
In a CDD sprint, risk management is not a side document—it is the operating system that protects time, credibility, and compliance under pressure. A project‑level risk plan makes threats visible early, assigns clear owners, and pre‑authorizes the moves you will make when reality intervenes. The goal is to convert uncertainty into specific controls, triggers, and decisions that keep the program on track and the recommendation defensible. This template is designed for speed: complete it on Day 0–1, publish it in your single source of truth, and review it at every governance gate.
The strongest plans begin with a sharp view of materiality. Set dollar and schedule thresholds that define what “moves value” and what “breaks the timeline.” Then classify risks by cause rather than by symptom—access, evidence quality, compliance, modeling integrity, dependencies with other diligence streams, and stakeholder alignment. For each risk class, write early‑warning indicators you can actually observe in week one, the preventive controls you will deploy, and the contingency play you will run within 24–72 hours if a trigger fires. Finally, quantify residual exposure so price, terms, or conditions can reflect what you could not remove.
Use the template below as a fill‑ready scaffold. Keep the language crisp. Avoid vague labels like “monitor” or “mitigate.” Every line should lead to an action, an owner, and a date.
Project-Level Risk Management Plan (copy, fill, publish)
- Objective and decision date
State the decision you must enable (price, structure, conditions) and the exact Investment Committee date and time. - Risk leadership and roles
Name the risk owner, PMO coordinator, QA verifier, legal/compliance lead, primary research lead, data/model owner, and sponsor for escalations. - Materiality thresholds
Define EV impact that triggers action, acceptable schedule slip before re‑baselining, and zero‑tolerance items (antitrust, MNPI, data privacy). - Risk taxonomy for this engagement
List the categories you will track: timeline and critical path, access and management availability, data quality and evidence sufficiency, primary research bias and non‑response, clean‑team and MNPI, antitrust and counsel approvals, cross‑stream dependencies (QofE, legal, tech/ops, tax, ESG), modeling and version control, QA and citation rigor, scope creep and definition drift, vendor and dataset delivery, staffing and single‑point‑of‑failure, budget and PO cycle, cybersecurity and data retention, reputational risk. - Identification methods
Note how you will surface risks: Day‑0 pre‑mortem, hypothesis cards review, daily stand‑ups, vendor SLAs, interview recruiting dashboards, and cross‑stream syncs. - Scoring model
Specify fields and scales: likelihood 1–5, impact as value at stake in dollars, velocity 1–5 (how fast harm arrives), detectability 1–5, confidence high/medium/low, and an overall priority score you will sort by. - Early‑warning indicators
Write observable signals for week‑one detection: interview book rate below target, dataset vendor behind SLA, counsel approval pending past 48 hours, top‑down vs. bottom‑up sizing variance above threshold, exhibit without verifier sign‑off, model‑to‑deck mismatch, management access slipping, clean‑team roster incomplete, scope change requests increasing, burn rate exceeding budget. - Preventive controls
Record the controls you will deploy immediately: not‑doing list enforced, second‑method analysis pre‑committed, interview quotas and screeners approved, clean‑team memo issued, source register live, model version log created, QA checklist attached to every exhibit, PO pre‑approvals secured, deputies named for all A/R roles, encrypted workspace and restricted access enabled. - Contingency playbook
Pre‑authorize moves you will make within 24–72 hours: substitute channel checks for end‑customer interviews, add a second dataset, escalate to sponsor for access, narrow thesis scope, re‑sequence work to protect synthesis, increase sample incentives, pivot to downside‑first scenario, or call a price/structure change at the mid‑sprint gate. - Escalation path and SLAs
Define who approves added spend, who can re‑baseline the plan, who calls a stop, and the expected decision time once a trigger fires. - Decision levers if residual risk persists
List structural responses you will propose: price adjustment, earnout tied to NRR or price realization, reps and warranties, covenants, closing conditions, vendor top‑up CDD, or a staged confirmatory workstream. - Compliance guardrails
Document clean‑team roster and permissions, MNPI definitions, primary research scripts and disclosure, antitrust prohibitions, data handling and redaction rules, counsel turnaround SLAs. - Data security and retention
Specify storage location, access controls, encryption, retention period, and destruction date for raw notes, transcripts, datasets, and models. - Vendor and dataset risk
List critical vendors, expected delivery dates, backup providers, spend ceilings, and the process to switch if SLAs slip. - Primary research risk
Write quotas by cohort, recruiting channels, incentive levels, screeners, approval date, and fallback sources if direct access is blocked. - Modeling risk controls
Define the driver‑based structure, naming conventions, sensitivity suite, single‑model rule, versioning, peer review, and a model integrity check before any gate. - QA and verification
Assign a verifier for each critical exhibit, require footnotes for every material claim, and set a first‑pass acceptance target and spot‑check cadence. - Cross‑stream dependencies
Record the questions owned by QofE, legal, tech/ops, tax, and ESG, the dates answers are due, and the IC decisions they influence. - Governance integration
Link the plan to cadence: daily stand‑ups for EWI status, sponsor touchpoints for escalations, weekly cross‑stream syncs for dependency clearance, and three gates with written decisions. - Risk ledger fields
Include ID, description, category, owner, date opened, due date, likelihood, impact dollars, velocity, detectability, confidence, EWI observed, mitigation in place, next action and date, residual exposure dollars, and closure note. - Heat‑map view
Commit to a one‑page heat‑map generated from the ledger that shows top risks by priority score and value at stake; refresh it before each gate. - Residual risk quantification
Translate what remains into price haircuts, wider ranges in scenarios, or explicit terms and conditions; link each to the exhibit or assumption it affects. - Communications protocol
State how updates are shared: risk ledger link in every stand‑up, decision log entry within one hour of any escalation, and a single source of truth for files. - Training and reminders
Plan a five‑minute refresher at the first three stand‑ups on clean‑team rules, primary research compliance, and QA expectations. - Sign‑offs
Capture names and dates for owner, CDD lead, deal sponsor, legal/compliance, and QA.
Top risks in CDD and how to neutralize them fast
- Access risk
Mitigate with Day‑0 sponsor asks, explicit escalation dates, and pre‑approved substitutes such as distributor or channel partner interviews. - Evidence quality risk
Deploy dual‑method triangulation from the start, keep a source register, and set a variance threshold that triggers a second dataset purchase. - Primary research risk
Protect recruiting with clear quotas, incentives, multiple channels, and a fieldwork SLA; if book rates lag, reallocate to expert calls the same day. - Clean‑team and MNPI risk
Issue the clean‑team memo at kickoff, label “clean only” tasks in your RACI, and route any deviations through counsel within a 24‑hour SLA. - Modeling and version control risk
Enforce the single‑model rule, keep a version log, and require a model integrity check before exhibits leave the workbench. - Cross‑stream dependency risk
Name owners and due dates for QofE/legal/tech answers and put them in the risk ledger; escalate unresolved items at the sponsor touchpoint. - Scope creep and definition drift
Publish the not‑doing list and market/segment taxonomy; any change request must pass the price‑change test before work begins. - Staffing and single‑point‑of‑failure risk
Pair analysts on critical exhibits, name deputies for A/R roles, and publish coverage windows to handle time‑zones and PTO.
Risk triggers you should codify now
- Interview completion falls below 50% of target by end of Week 1.
- Clean‑team approval pending more than 48 hours beyond SLA.
- Top‑down vs. bottom‑up market sizing variance exceeds 25% after first reconciliation.
- Model‑to‑deck mismatch detected at any gate.
- Dataset vendor misses stated delivery by 72 hours.
- QA first‑pass acceptance drops below 85%.
- QofE or legal answers past due on assumptions tied to killer variables.
Residual risk translation guide
- Pricing power uncertainty
Apply a realized price haircut in the model, widen sensitivity ranges, and propose an earnout tied to price realization. - Retention uncertainty
Lower NRR to base‑rate median, increase churn sensitivity, and tie structure to renewal performance. - Competitive response uncertainty
Run a competitor push scenario, include a covenant on promo intensity if relevant, and set early‑warning indicators to track deal discipline. - Regulatory or policy timing uncertainty
Add scenario timing bands and a closing condition or rep tied to the specific approval or rule change.
One‑minute audit before every gate
- Are top five risks owned, dated, and showing fresh updates in the ledger.
- Do early‑warning indicators map to actions taken in the last 24–48 hours.
- Is residual exposure quantified in dollars and reflected in the model or terms.
- Are compliance and clean‑team entries current, with no unapproved access.
- Has the decision log captured any price/structure changes prompted by risk.
Build this plan once, use it daily, and let it drive real decisions. The payoff is diligence that absorbs shocks without drama, preserves synthesis time, and communicates risk in the only currency that matters—its impact on value, timing, and terms.
