Building a Data Room That Survives Due Diligence
What goes in, how it is organised, and the documents that kill deals when they are missing
Who this is for
SMEs that have received investor interest and are preparing for formal due diligence — or founders who want to be ready before the first serious conversation begins.
What it costs you to ignore it
The diagnosis behind it
This playbook is triggered by a Red or Critical finding on:
Vital 4 — Fundraising & Investor ReadinessThe Protocol
Set up a secure, access-controlled virtual data room (VDR). Use a dedicated platform — Google Drive with shared links is not a data room. Minimum requirement: folder-level access control and an audit log of who viewed what.
Populate the corporate section: Certificate of Incorporation, MOA/AOA, all shareholder agreements, cap table (fully diluted), board resolutions for the last 3 years, and any ESOP scheme documents.
Populate the financial section: 3 years of audited accounts, latest management accounts, 13-week cash flow forecast, and a financial model with assumptions documented.
Populate the commercial section: top 10 customer contracts (redacted for confidentiality if needed), top 5 supplier agreements, any exclusivity or non-compete arrangements, and a customer concentration analysis.
Populate the legal and compliance section: all pending or threatened litigation, tax assessment orders, regulatory licences, and statutory compliance certificates (PF, ESI, GST, ROC filings).
Conduct a mock diligence review: ask a trusted advisor or CA to spend 2 hours in the data room and identify gaps before the investor does.
What you can do yourself vs what needs help
The data room can be built internally by a CFO and Company Secretary working together. The mock review in Step 6 should always be done by an external advisor — internal teams are too close to the business to spot the gaps that will matter to an investor.