The most common answer to 'how long does M&A due diligence take?' is '60–90 days.' That's accurate as a rough benchmark for mid-market deals, but it obscures a lot of variation — and it doesn't tell you where those 60–90 days actually go. Understanding the breakdown matters because the bottlenecks are often fixable.
Timeline by deal size
Deal size is the strongest predictor of diligence duration, primarily because it determines data room complexity and the number of parties involved:
- —Small deals under $25M: 30–45 days. Data rooms are typically smaller (under 200 documents), financial statements may not be audited, and buyers often run diligence internally rather than engaging advisors.
- —Mid-market deals $25M–$500M: 45–90 days. Data rooms range from 300–2,000+ documents, QoE processes take 3–5 weeks, and legal diligence adds significant time for complex contract review.
- —Large deals over $500M: 60–120+ days. Regulatory review adds time regardless of document readiness. Data rooms can contain 5,000+ documents. Cross-border transactions add legal and tax complexity.
The real timeline breakdown by activity
For a typical 60-day mid-market deal, time roughly distributes as follows:
- —Days 1–7: Data room access, initial document inventory, building the financial model skeleton
- —Days 7–21: QoE fieldwork — management interviews, detailed financial review, preliminary add-back analysis
- —Days 14–35: Legal diligence — contract review, IP ownership verification, litigation and regulatory assessment
- —Days 21–45: Financial reconciliation — ledger-to-document matching, discrepancy investigation, gap follow-up with seller
- —Days 35–55: Synthesis — finalizing QoE adjustments, resolving outstanding diligence questions, drafting reps and warranties positions
- —Days 55–60: Final deliverables — QoE report, legal diligence memo, deal structure recommendations
Financial reconciliation — days 21–45 in the timeline above — is where most timeline overruns originate. When reconciliation is manual, discovering a significant discrepancy on day 35 triggers a follow-up cycle that pushes close.
What actually drives timeline overruns
Data room completeness at opening
The single biggest driver of timeline overrun is a data room that isn't substantially complete when buyers get access. Every missing document category triggers a request-response cycle that takes 3–7 business days. A data room with 15 incomplete categories adds 4–8 weeks of follow-up time to the diligence process — often more than the original timeline allowed.
Reconciliation speed
Manual reconciliation creates a hard capacity constraint. One analyst can carefully review roughly 50–75 ledger entries per day against supporting documents. A 5,000-row ledger requires 67–100 analyst-days of reconciliation work — which, at one analyst, takes 13–20 weeks. In practice, teams assign multiple analysts and accept sampling risk. But even with three analysts, a 5,000-row full reconciliation takes 4–6 weeks.
Automated reconciliation changes this constraint completely. The same 5,000-row ledger against 300 supporting documents runs in under 10 minutes. That's not a marginal improvement — it's an order-of-magnitude change that allows multiple reconciliation passes throughout the diligence period rather than one pass at the end.
Discrepancy investigation cycles
When reconciliation surfaces a discrepancy, the investigation cycle typically runs: identify the discrepancy → draft follow-up question → submit to seller via VDR Q&A module → wait for response → review response → close or escalate. This cycle averages 5–7 business days per discrepancy. In a large data room, there may be 20–40 discrepancies worth investigating. That's 2–6 additional weeks, on top of the reconciliation time.
How to compress the timeline without sacrificing rigor
The practical levers for timeline compression are: run reconciliation earlier (day 7–14 rather than day 21), batch discrepancy questions into fewer, larger submissions to minimize follow-up cycles, and use automated reconciliation to eliminate the capacity constraint on initial pass coverage.
Deal teams that run reconciliation early and iteratively — using automation to run a first pass before the QoE process starts — find discrepancies while there's still time to investigate them properly. That's a fundamentally different risk profile than finding discrepancies at day 50 of a 60-day timeline.