M&A data room checklist: what goes in, and in what order

Build the tree before you buy the room

Every provider will bulk-upload your folders, and several now sort documents automatically. None of them can decide what a buyer needs to see and when. Draft the index first, in a spreadsheet, with an owner and a status against every line. That document is also your progress tracker, and it is what tells you whether you are two weeks or two months from opening.

The usual top-level structure

• Corporate. Constitutional documents, statutory registers, share capital history, group structure, shareholder agreements, minutes.
• Financial. Statutory accounts, management accounts, budgets and forecasts, debt and facility documents, working capital analysis, tax returns and correspondence.
• Commercial. Customer and supplier contracts, standard terms, revenue by customer, pipeline, distribution and agency agreements.
• Employment. Contracts for senior staff, standard terms, org chart, pensions, share schemes, consultations and disputes.
• Property and assets. Leases, title documents, plant registers, insurance policies and claims history.
• Intellectual property and IT. Registered rights, licences in and out, domain names, software agreements, data protection documentation.
• Legal and compliance. Litigation, regulatory correspondence, licences and permits, health and safety, environmental.
• Data protection. Records of processing, data sharing agreements, breach log, and the diligence documents your buyer's counsel will ask for by name.

That structure is a starting point, not a standard. Your lawyer's due diligence questionnaire is the real index, and mapping your folders to it saves everyone a week.

Stage the disclosure

The reason permissions exist is that not everything should open at once. A common pattern is three phases: a first phase for all bidders with the information memorandum and the non-sensitive material, a second for shortlisted bidders with contracts and detailed financials, and a clean team phase for anything competitively sensitive, such as customer-level pricing, where a competitor is at the table. Datasite describes staged disclosure logic built into its platform; Virtual Vaults publishes clean team and non-clean team separation as a plan feature. If your provider does not support this natively, you are managing it with separate folders and human discipline, which is where mistakes happen.

Set up Q&A before you open, not after

1. Decide who triages questions and who is allowed to answer, before any arrive.
2. Map subject areas to named experts so routing is automatic rather than a daily judgement.
3. Agree the approval flow: who reviews an answer before it is published to a bidder, and what the turnaround commitment is.
4. Publish reusable answers where several bidders ask the same thing, rather than answering four times differently.
5. Agree in advance when Q&A freezes, and tell bidders.

Watch the audit trail as an early-warning system

Every provider here records who opened what and for how long. That record is usually described as a compliance feature, and it is, but during a live process it is also the most honest signal you will get about bidder intent. A bidder whose advisers have not opened the material contracts folder three weeks in is telling you something. Providers describing engagement or activity reporting on the pages we read include SecureDocs, CapLinked, Firmex, Ansarada, Virtual Vaults and Datasite.

Plan the close

Decide before you open what the archive looks like and who gets one, because it is far harder to agree at completion. Virtual Vaults publishes archive pricing at £199 per USB drive with a comfort letter and £50 per cloud archive recipient. Drooms describes a read-only cloud archive preserving documents and audit trails in their final state. Admincontrol charges £250 for a first export and £100 per additional one. Put the archive obligations in the sale documents and the cost in the deal budget.