Startup Due Diligence Checklist: Self-Diligence Before the VC

TL;DR Startup due diligence is an investor's check of whether a company's financials, contracts, cap table, and deck all describe the same company; self-diligence is the founder running that check first.

Due diligence isn't about the volume of documents you can produce. It checks whether your financials, contracts, cap table, and deck all describe the same company.

Small mismatches, like revenue that differs between two documents, turn into questions, and enough questions turn into a trust problem.

Run a 7-step self-diligence and build a 12-section data room with an owner for each section before any investor sends a request.

Who this is for: Korean and other non-U.S. founders who have just received, or expect to receive, a diligence request from a U.S. VC.

What does a VC due diligence request include?

A VC diligence request covers nearly every part of the company. Ours arrived after a promising meeting, under the plain subject line Additional Information Request. I assumed it meant an updated deck and some financials. The attachment ran several pages.

Typical items on the list:

Area	What was requested
Financial	Financial statements, monthly revenue, projections, bank accounts, tax
Customers	Largest customers, revenue split by customer, all material contracts
Equity	Cap table, shareholder register, option ledger
IP	IP list, patent filings and grants
People	Employment agreements, key employee details
Risk	Litigation, related-party transactions, government grants
Governance	Business plan, board minutes

Reading it, I wondered whether they planned to invest in us or audit us. The difference from a pitch is control: in a pitch you choose what to show, and in diligence the investor chooses.

What does VC due diligence actually test?

VC due diligence tests whether the same company appears in every document. Some of our materials lined up perfectly: the deck claimed ten customers and the contracts folder held exactly ten; the patent list showed twelve and we had twelve certificates.

Other items drifted. Revenue in the financial statements didn't quite match revenue in the company profile. Ownership percentages in the cap table were slightly off from the shareholder register. Each gap had an explanation, such as mismatched as-of dates, an update that hadn't been applied yet, or a contract still being finalized. But the investor's first reaction was not the explanation. It was: why don't these match?

Most companies carry several versions of themselves:

Finance's version: booked revenue.
Sales' version: pipeline counted as customers.
Engineering's version: IP in development counted as an asset.
Legal's version: only registered IP counts.
Management's version: some blend of all four.

None of these is false. Trouble starts when all five reach the investor at once.

What is the most dangerous moment in startup due diligence?

The most dangerous moment in due diligence is a question about something you've never seen. Hard questions were manageable. What rattled me was an investor pointing to a clause in one of our own contracts, asking why it was there, while I read it for the first time.

What matters is not only whether a problem exists but who already knows about it. When management knows the issue, can explain its cause, and has a documented fix, the investor can weigh it. When management looks surprised by something small, the investor starts asking what else they've missed.

How do you run startup self-diligence before investors arrive?

Startup self-diligence means opening your own company the way an investor would, in seven steps, before anyone else does.

Pick one source of truth. When one folder holds Final_new, Final_CEO_edits, Final_v2, and plain Final, nothing in it is authoritative. Name the executed contract, the current cap table, and the projection that went to the board.
Write your own red-flag list. Use three columns: Issue / Risk / Remediation. For example: one customer accounting for 55 percent of revenue → a steep drop if that contract ends → sign four new customers within 12 months. Or: two jointly owned patents → rights must be cleaned up before an acquisition → go through the co-ownership agreement. Once written down, a worry becomes a task.
Rebuild the cap table on a fully diluted basis. List each shareholder with share class, date acquired, conversion rights, preferences, and anti-dilution terms, then add the option pool and the potential dilution from any convertible notes or SAFEs. Founders often know their ownership on issued shares; the fully diluted figure is the one investors use, and it's usually different.
Read the fine print in your contracts. Look for change-of-control termination, exclusivity, most-favored-nation terms, IP assignment, uncapped liability, auto-renewal, and key-person terms. A deal that looks excellent on revenue can be a liability in an acquisition, because diligence weighs rights and obligations, not just signatures.
Sort IP by who owns it, not how much there is. Is each patent granted or pending, and in which countries? Do employee inventions belong to the company? Does a co-development partner or university hold rights? Was any of it built with government funding? A single patent count can spawn ten questions, and deeper technology makes this heavier.
Reconcile your financials in advance. The deck, board packs, management accounts, audited statements, tax returns, and bank submissions each exist for a different reason, so they can differ for valid reasons. Build a bridge table ahead of time, for example: revenue of 1.0M in source A versus 1.1M in source B, with the 0.1M gap explained by revenue recognition timing. Unexplained gaps invite the worst interpretation.
Hold a mock diligence session. Assign roles: one person as a hostile VC, one as the lawyer, one as the accountant, one as an existing shareholder. Ask things like "Is this customer really under contract?", "Does the company actually own this IP?", and "If the CEO left tomorrow, would the company keep running?" It will be uncomfortable, and that discomfort is the purpose.

How should a startup data room be organized?

A startup data room should be organized into twelve sections, each with a named owner and an index:

Corporate
Capitalization
Financial
Tax
Commercial
Material Contracts
IP
HR
Litigation & Compliance
Government & Grants
Insurance
Board & Governance

Speed signals control. An investor notices the difference between a company that spends three hours hunting for a file and one that replies in five minutes.

Is startup due diligence only for fundraising?

No, due diligence is not only for fundraising. The same data room gets reused for M&A, onboarding as a vendor to large enterprises, partnership deals abroad, bank lending, and government reviews. As a company grows, it has to prove itself more often, so the data room becomes standing infrastructure rather than a one-off fundraising task.

On honesty: saying "I don't know" carries risk, but concealing a problem is far worse. If an investor uncovers something you hid, you face the original issue plus a trust issue, and the trust issue is the bigger of the two. Accuracy matters more than looking flawless.

Startup self-diligence checklist

☐ One authoritative version of every contract, cap table, and projection
☐ Red-flag list with Issue / Risk / Remediation filled in
☐ Cap table recalculated on a fully diluted basis
☐ Material contracts reviewed for change-of-control, exclusivity, MFN, IP assignment, liability, auto-renewal, and key-person terms
☐ IP sorted by ownership, status, jurisdiction, and funding source
☐ Reconciliation table for any revenue figure that differs across documents
☐ Mock diligence session completed
☐ Twelve-section data room indexed, with an owner per section

FAQ

Q. When should a startup prepare for due diligence? Before an investor asks. Once the request arrives you lose control over what gets shown, so the reconciling and cleanup should already be done.

Q. What do VCs look for first in due diligence? Consistency. They check whether figures like revenue, customer count, and ownership match across the financials, contracts, cap table, and deck.

Q. How to handle red flags in startup due diligence? Write it down with its risk and a remediation plan before diligence starts. A documented, explained issue can be evaluated; a surprise raises doubts about everything else.

Q. What is a fully diluted cap table, and why do investors use it? It's the ownership figure investors use. It includes options, SAFEs, and convertible notes, so it is often lower than the percentage founders quote from issued shares.

Q. What is mock due diligence? An internal rehearsal where team members play the VC, lawyer, accountant, and existing shareholder and ask the hardest questions. It surfaces gaps while you still have time to fix them.

Q. What should be in a startup data room? Twelve sections, each with an owner and an index: corporate, capitalization, financial, tax, commercial, material contracts, IP, HR, litigation and compliance, government and grants, insurance, and board and governance.

Related reading

Basis: the author's own fundraising experience (a multi-page "Additional Information Request" from a U.S. VC, during a raise covering 180 U.S. VCs and 40 meetings). Figures such as 55 percent customer concentration and the 1.0M vs. 1.1M revenue bridge are worked examples for the method.

Last updated: 2026-10-14

Venture Insider — Led fundraising and overseas expansion at an Asian deep-tech startup. Writes under a pen name to protect the companies and investors involved.

Facing a diligence request from a U.S. investor? Self-diligence is step five (Proof) in the sequence I'd follow next time: Customer → Numbers → Exit path → Structure → Proof → Valuation → VC. The full record covers 180 U.S. VCs, 40 meetings, 0 term sheets, and 72 checkpoints across all seven steps.

Free first chapter: https://ventureinsider.gumroad.com/l/free-chapter

Not legal, tax, or investment advice. One practitioner's record.