
Welcome to Part 6. In Part 5, your finance and ops teams vetted the numbers and the business. They answered the question, "Is this business worth buying?"
Now, my team—the legal team—begins its "landmine sweep". Our job is to answer the question, "Is this business safe to buy?"
Legal diligence is not just "checking boxes" on a checklist. It is a forensic investigation into the target's corporate life. We are hunting for the hidden triggers, time bombs, and liabilities that your QoE report (from Part 5) will not see. What we find here translates directly into negotiating power and your strategy for mitigating future risk.
While our full diligence request list is hundreds of items long, our hunt focuses on three primary areas:
Is this company "real" and in good standing? We check that it is properly formed and qualified to do business in every state it operates in. We review its bylaws, board minutes, and shareholder records.
Red Flag: A messy or missing "capitalization table" (the shareholder record). If the company cannot prove, with 100% certainty, who owns every single share of its stock, you cannot be sure you are buying 100% of the company.
We review a full schedule of all active, pending, and—most importantly—threatened lawsuits.
Red Flag: We are not just looking for "bet-the-company" litigation. We are looking for patterns. For example, a string of "threatened" sexual harassment or employment discrimination lawsuits that always settle quickly. This points to a toxic culture or a systemic, unresolved compliance failure that you will inherit the moment you close.
This is the heart of legal diligence. We review all major customer contracts, supplier agreements, real estate leases, and equipment leases. We are looking for any unusual terms, but we are hunting for one clause in particular.
This is the landmine I warn every client about.
What it is: A "Change of Control" (CoC) clause is a provision in a contract that gives the other party (e.g., the target's biggest customer or a key supplier) the right to terminate the agreement the moment your deal closes.
The Threat: The seller may have "forgotten" to mention this. You could buy the company on Friday—based on a valuation of $100M in revenue—and on Monday, the target's top three customers (representing $60M of that revenue) all legally terminate their agreements. You have just bought a company that is worth a fraction of what you paid.
This is not just a theoretical risk. My team finds these clauses, and similar "anti-assignment" clauses, every day. We create a "consent list" of every key contract that requires the other party's permission for the deal to go through. This list becomes a Closing Condition (which we'll cover in Part 8)—meaning the deal cannot close until the seller gets written consent from those key customers.
This is not just a legal check-box; it is a commercial re-negotiation. When the seller has to go to their top customer and ask for "consent" to be acquired, that customer now has 100% of the leverage. They will often demand a lower price, better terms, or a one-time "consent fee" to sign the waiver. This is a cost to the deal that must be factored into your valuation. Who pays that fee—you or the seller? That is a negotiation.
In any technology, brand, or software acquisition, this is paramount. The value of the company is its IP. Your team must confirm that the company actually owns its core patents, trademarks, and, most importantly, its source code.
We are hunting for three common skeletons:
The Rogue Contractor: Did that "rockstar engineer" who built the core product 5 years ago actually sign an agreement assigning his IP to the company (a "work for hire" agreement)? If not, he may own a critical piece of the product you think you're buying.
The Open-Source "Virus": Did their developers use "copyleft" or "viral" open-source software (OSS) inside the proprietary product? This is a ticking time bomb. The terms of that OSS license could legally require you to make your entire, valuable source code public to comply.
The Trade Secret "Escrow": How are they protecting their "secret sauce"? We've seen deals where a target, desperate to land a big customer, agreed to place its source code in an escrow account. The release trigger for that escrow? A "Change of Control". Your acquisition could gift your new company's most valuable asset to its biggest customer.
Legal diligence is not a "pass/fail" test. It's an information-gathering exercise.
Every Change of Control clause, every pending lawsuit, every IP ambiguity... this is not a reason to walk away. It is leverage. It is a specific, quantifiable risk that we will now address in the Purchase Agreement—either by adjusting the price down or, as we'll see in Part 9, by forcing the seller to "indemnify" (pay you back) for that specific risk.
The legal diligence continues, but now we turn to the most complex and volatile assets: People. Continue to Part 7 where we'll cover labor, employment, and the regulatory compliance landmines like data privacy.
Previous: Part 5: The Diligence Gauntlet (Part 1 - Financial & Commercial)
Next: Part 7: The Diligence Gauntlet (Part 3 - People, Compliance, & Regulatory)

Ryan previously served as a PCI Professional Forensic Investigator (PFI) of record for 3 of the top 10 largest data breaches in history. With over two decades of experience in cybersecurity, digital forensics, and executive leadership, he has served Fortune 500 companies and government agencies worldwide.

The deal is closed—but this is the starting gun, not the finish line. Learn how to execute post-merger integration and avoid the talent exodus that destroys deals.

Reps & Warranties, Indemnification, and the 'hostage' escrow. Learn how to protect yourself from post-closing surprises when the seller lied.

The 100-page fortress that dictates every aspect of the transaction. Learn how to translate diligence findings into legal protections.