Policy Due Diligence in M&A: What to Check Before You Sign
A target’s policy binder tells you what it says it does. Its records tell you what it actually did. Here is what to request, what to look for, and how to turn the gaps into something your deal team can use.
In short
Pre-close policy due diligence means asking the target for evidence, not just documents: the policy library plus approval records, version history, acknowledgment and training records, exceptions, incident logs and regulator correspondence. Look for policies nobody approved or acknowledged, rules that contradict practice, and missing policies for regulated activities. Score each gap by risk, then take the serious ones to deal counsel before signing.
This guide covers the weeks before signing. For what to do with two policy libraries once the deal closes, see the M&A policy integration guide. For running policy programs across subsidiaries over the long term, see building policy programs across acquired subsidiaries.
What to ask the target for
A request for “all policies” gets you a folder of PDFs. Ask for the records around them too, because that is where you find out whether the policies were ever in force.
Policy library
Every current policy and procedure, with owner, effective date and the locations or business units each one covers.
Approval records
Who approved each policy and when: board or committee minutes, sign-off emails, or approval logs from whatever system they use.
Version history
Prior versions of key policies and what changed. You want to know which version was in force on the dates that matter.
Acknowledgment records
Evidence that employees received and acknowledged policies, by person and date. A roster of names with no dates proves very little.
Exception and waiver records
Approved departures from policy, who granted them and whether they have ended. Long-running waivers often hide the real operating rule.
Training records
Required courses by role, completion records and dates.
Incident and complaint logs
Internal incidents, hotline reports and customer or employee complaints, with how each was resolved.
Regulator correspondence
Inspection reports, examination findings, notices, and the target’s responses. Ask whether every commitment made to a regulator has been met.
Red flags in a target’s policy program
None of these automatically sinks a deal. Each is a question to get answered in writing before signing.
Governance
No approval date
Policies with no record of who approved them, or when. It may be unclear whether they were ever adopted at all.
Evidence
No proof anyone read them
Policies exist but there is no acknowledgment record. If an employee breaks a rule, the target may struggle to show the employee knew it.
Practice
Policy contradicts practice
Interviews or samples show staff doing something different from what the policy says. The written rule may be the riskier of the two.
Control
Old versions still circulating
Different sites working from different versions of the same policy, or superseded copies on shared drives and noticeboards.
Coverage
Missing policies for regulated work
The target does something regulated, such as handling health or payment data, serving alcohol or operating equipment, with no written policy behind it.
Test practice, not paper. Pick a handful of employees from the headcount list and ask for their acknowledgment and training records. Pick two or three incidents and trace which policy applied and whether it was followed.
Score each gap by risk
A long list of findings is hard for a deal team to act on. Rank them so the few that matter are obvious.
- 1
Tie each gap to an activity
Write down what the target actually does that the gap affects, and where. “No privacy policy” means more for a business holding customer records than for one that does not.
- 2
Ask whether a law or regulator is involved
Gaps in areas a regulator supervises, or that a contract requires, usually rank higher than gaps in internal good practice.
- 3
Check for evidence of harm
Look across the incident logs, complaints and regulator letters. A gap that has already caused incidents is a live issue, not a theoretical one.
- 4
Rate it high, medium or low
High: regulated activity with no policy or no evidence, or open regulator issues. Medium: policies exist but records are weak. Low: housekeeping such as formatting or ownership.
- 5
Estimate the fix
Note who would need to fix it, roughly how long it would take, and whether it can wait until after close.
What findings can mean for the deal
How a finding is handled is a legal and commercial decision. Bring the high-rated items to deal counsel early; these are the usual levers they will consider.
Price
Remediation costs, or exposure from past non-compliance, may justify a price discussion or money held back after close.
Reps and warranties
Counsel may want specific statements from the seller about compliance, records and regulator contact, backed by indemnities where a risk is known.
Conditions to close
Some fixes may be worth requiring before close, such as adopting a missing policy for a regulated activity or answering an open regulator letter.
Integration plan
Most medium and low findings belong here: fixed in the first months after close rather than negotiated into the contract.
Hand findings to the integration team
Diligence findings are often lost between signing and Day 1. Before close, give the integration team a short pack:
- The scored findings list, with owner and agreed fix for each high item.
- The target’s policy index, marking which policies are approved, current and evidenced.
- Any commitments made to regulators, and deadlines.
- Anything the deal terms now require, such as post-close remediation steps.
- Names of the target’s policy owners and who to contact for records.
From there, the integration guide picks up the Day 1 to Day 90 work.
The records you wished the target had kept are also a useful spec for your own program. In PolicyTrak:
Policy management
After close, the target’s existing documents can be brought in using PDF import with AI extraction. Imported drafts still need human review before they go out.
Version control
Each save creates a numbered version with the author’s name and date and time, so the question “which version was in force?” has an answer.
Document acknowledgment
Each person’s acknowledgment is recorded with a date and time, and acknowledgment reports can be exported for auditors.
NotePolicyTrak does not perform due diligence. It manages policies once they are yours; the diligence review itself is done by your deal team and advisers.
Give the Business You Buy Records Worth Inheriting
Versioned policies and dated acknowledgments in one place. Sign up and see plans without booking a call.
