Insights / Investment due diligence

What the data room cannot tell you

In short

Financial diligence audits the past. Commercial diligence tests the market. Legal diligence reads the contracts. None of the three is built to answer whether this company can execute the plan it just pitched - and that question has become more expensive to get wrong, because with multiple expansion and cheap leverage constrained, revenue growth drove 71% of the value created in 2024 exits. When the return depends on the company growing, execution capability is the return. This piece covers what operational diligence assesses, why the gap is structurally invisible inside a data room, and why a lender is more exposed to it than an equity investor.

The return moved, and diligence did not move with it

For a long stretch, a meaningful share of returns could be produced without the underlying company changing very much. Cheap debt, rising multiples and a benign exit environment did real work. Diligence was built for that world: confirm the numbers are true, confirm the market is real, confirm the contracts hold, and let financial structure do the rest.

That has tightened. Bain's private equity research found revenue growth accounted for 71% of the value created in 2024 exits, up from 64% the year before, and that with leverage and multiple expansion constrained, a typical deal now needs roughly 10-12% average annual EBITDA growth to produce a 2.5x over five years. The implication is not subtle. If most of the return has to come from the company actually growing, then whether the company is capable of growing is not context around the investment case. It is the investment case.

71% of the value created in 2024 exits came from revenue growth, up from 64% in 2023 - the highest share in any recent five-year period.Bain & Company, Global Private Equity Report
10-12% average annual EBITDA growth now required on a typical deal to produce a 2.5x return over five years, with the old levers unavailable.Bain & Company

Venture is not private equity, and the mechanics differ. The direction is the same: the further the exit environment moves from easy, the more of the outcome rests on the company doing what it said it would do, on the timeline it said it would do it.

What each diligence stream is actually built to answer

The three standard workstreams are good at what they do. The problem is that what they do leaves a specific question unasked, and the question is not a small one.

WorkstreamThe question it answersWhere it looks
Financial Are the numbers true, and what do they say about what already happened? The past, in artifacts
Commercial Is the market real, is it big enough, and is this company positioned in it? Outside the company
Legal and tax What are we bound to, exposed to, and liable for? Documents
Operational Can this company do the thing it says it will do, at the speed and scale the plan assumes? The present, in behaviour

Read down the third column and the gap becomes structural rather than accidental. Three of the four streams examine things that hold still: statements, contracts, market data. The fourth examines how a group of people currently behaves under load, which is not a document and cannot be produced on request.

THE STANDARD PACK Financial the past Commercial the market Legal and tax documents All three read things that hold still Operational how the company behaves under load the present, not an artifact The plan assumes a speed, a scale and a kind of team. Only one of the four streams is pointed at whether those assumptions hold.
Figure 1. The gap is structural, not an oversight. Three workstreams are designed to examine stable artifacts, which is exactly what makes them reliable. Execution capability is not a stable artifact, so it falls outside all three by construction.

Why a data room hides this by design

A data room is a collection of artifacts. Artifacts are produced deliberately, reviewed before they are uploaded, and represent the company at its most composed. That is not deception. It is what a data room is for.

The consequence is specific and worth stating plainly: you can read an architecture diagram and have no idea that the engineering team routinely works around it. You can read a documented approval process and not know that in practice three people bypass it every week because it is too slow, which is the reason the company ships at all. You can read a roadmap and not know that the last four quarters of it were reprioritised mid-quarter by whoever escalated loudest.

The distinction the whole assessment turns on

A data room tells you what a company has written down. It does not tell you what the company does when the written thing is inconvenient.

The gap between those two is where post-close surprises live. It is also not discoverable by asking, because the people answering are not withholding it - they have usually stopped noticing. Workarounds become invisible to the people performing them within about a quarter.

The four things worth checking, and what each reveals

An operational assessment starts from the business processes the plan depends on and works outward. The technology and the AI claims are examined against those processes, not on their own terms, because a stack is only impressive relative to the work it has to carry.

How the work actually moves

A workflow analysis of the processes the plan depends on: who decides, where work queues, where handoffs drop things, what is handled by exception, and cycle time between a decision and a delivery.

Reveals: whether the processes that work at 40 people survive the 120 the plan requires

Whether the systems carry those processes

Architecture, data model, tooling and security, judged against the work they exist to support. Where the team is working around the system rather than through it, and what that costs at scale.

Reveals: rebuild cost hiding inside the growth curve

Whether the AI claims sit on a real process

Whether the AI in the deck maps onto a process that exists, with a data foundation capable of supporting it, and a team that can operate it - or is a layer proposed on top of a process nobody has fixed.

Reveals: the difference between an AI product and an AI slide

Founder, team and key-person risk

Decision patterns under pressure, how cross-functional work actually gets coordinated, where the company depends on individuals in ways nobody has written down.

Reveals: what breaks if one person leaves in month four

Two of the standard failure modes show up here rather than in the numbers. CB Insights' analysis of startup post-mortems puts "not the right team" at 23% of failures, alongside no market need at 42% and running out of cash at 29% - and running out of cash is usually the final event rather than the cause. Commercial diligence is built to catch the 42%. The 23% is an operational question, and so is a meaningful share of what precedes the 29%.

There is a smaller number that says something similar about product organisations. Pendo's 2024 benchmarks find that of every 100 features built and launched, roughly 6.4 drive 80% of usage. A company can have shipped an enormous amount and still have a thin layer of things anyone uses, with the rest carrying permanent maintenance cost. That divergence between output and effect is visible in an operational review and does not appear in a revenue line.

If your capital has to come back, this is not optional

Equity and debt are not the same buyer of this assessment, and the difference is worth being precise about.

An equity investor is underwriting upside. A company that executes slowly is a dilution problem, painful and usually survivable, repriced at the next round. A lender is underwriting downside. Repayment is mandatory whether the milestone lands or not, and the upside is capped, so the risk that actually matters is the company failing to do the thing it said it would do. A missed milestone that an equity investor absorbs in the cap table is a liquidity event for a lender.

Which makes the case stronger, not weaker, for venture debt funds, tech-lending desks, revenue-based financiers and family offices. Covenants only protect you if someone has read the operation sitting behind them. And for a loan with a multi-year term, the same read is worth repeating during the term rather than only before the money is drawn.

What it costs to skip

The cost is rarely a failed investment. It is more often a value-creation plan built on assumptions that were never tested.

The 90-day plan gets written from the deck. It assumes the team can absorb change at a certain rate, that the platform can carry a certain load, that decisions can be made at a certain speed. If any of those is wrong, the first two quarters after the close are spent discovering it, with a board expecting progress against a plan that was never executable. The capital is not lost. The time is, and in a fund with a defined horizon time is the scarcer input.

The honest limit of this argument Operational diligence does not tell you whether to invest, and it will not make a bad thesis good. A company can be operationally excellent and still be in a market that does not exist. What it does is remove one specific category of surprise from the list, and give the post-close plan a foundation that was checked rather than assumed. It is one input among several, and it is the one currently missing from most underwriting.

How it runs

One to two weeks, at deal pace rather than consulting pace. Document review, interviews across levels rather than only with the leadership team, and a walk through the systems that carry the work. The output is written: what was found, what it means for the plan being underwritten, what would need to be true for the plan to hold, and what the first 90 days should cover.

The reason it can run in that window is that it is narrow by design. It is not a transformation study and not a full-scope review. It answers one question, and one question can be answered quickly when the person asking has run the thing being assessed.

Scope of engagement. This is an operational, technical and organizational assessment of a target company. It is not investment advice, investment marketing, securities advice, a valuation, an audit, or a legal or tax opinion, and it is not a recommendation to make or refrain from making any investment. May Mor is not a licensed investment adviser, investment marketer or portfolio manager. The investment decision, and all responsibility for it, remains entirely with the client. Findings are based on the documents, systems and interviews made available within the agreed timeframe and cannot be complete. Where a finding requires a licensed professional, that is stated in the report and referred out. Every engagement is covered by a written scope and a mutual confidentiality agreement before work begins.

The one-line version

Financial diligence tells you whether the past was real. Commercial diligence tells you whether the market is. Operational diligence tells you whether the next three years are available to this particular company, with this particular team, on this particular platform. When most of the return has to come from growth, that is the question with the most money attached to it, and it is the one the data room was never built to answer.

Sources

  • Bain & Company, Global Private Equity Report. Source of the finding that revenue growth accounted for 71% of value created in 2024 exits (up from 64% in 2023), and that with leverage and multiple expansion constrained a typical deal requires roughly 10-12% average annual EBITDA growth for a 2.5x over five years. Private equity data, used here as directional for venture and growth investing rather than as a like-for-like comparison.
  • CB Insights, "The Top Reasons Startups Fail". Source of the post-mortem breakdown: no market need 42%, ran out of cash 29%, not the right team 23%, outcompeted 19%. Based on self-reported and published post-mortems, so subject to survivorship and reporting bias, and read here as indicative of failure categories rather than precise incidence.
  • Pendo, 2024 Product Benchmarks. Source of the finding that 6.4 of every 100 launched features drive 80% of click volume, rising to 15.6 for best-in-class products. Vendor research drawn from the company's own analytics install base, read as directional.
  • Companion pieces: the operational due diligence engagement, and The Coverage Model on why an important number frequently has no real owner inside a company.
Operational due diligence What the assessment covers, and how the relationship works after the wire
Have a deal in motion? 30-minute scoping call. NDA-friendly, written scope before anything starts.