Due diligence is not a financial audit under another name. The audit asks: are the numbers right? Diligence asks a wider question: what am I actually buying, and what will change once I buy it? The market in which these transactions happen is large and moving: more than 1.89 million active commercial registrations at the end of the first quarter of 2026, about 623 thousand of them companies, according to the Ministry of Commerce business sector bulletin, and every one of them is a potential target for an acquisition or partnership preceded by diligence, or regretted for its absence.
Seven integrated tracks
| Track | Question | What usually surfaces |
|---|---|---|
| Financial | Quality of earnings, not their size: what is recurring and what is exceptional? | An exceptional gain on an asset sale presented as operating |
| Commercial | Who are the customers and how concentrated? | One customer accounting for a third of revenue |
| Operational | Do operations run on a system or on particular people? | One manager holding every supplier relationship |
| Legal and contractual | Which licences, contracts and change-of-control clauses? | A key contract that terminates automatically on a change of ownership |
| Tax and zakat | Which liabilities exist and which are contingent? | Unpaid assessments or periods with no returns filed |
| People | Who does not stay after closing? | A sales team tied to the founder, not the company |
| Technology | Who owns the systems, data and code? | A core system licensed in a person's name, not the company's |
The statutory checks missed even though the law names them
Statutory diligence in the Kingdom has specific references that can be verified, not impressions. The first is partners' agreements outside the articles: Article 11 of the Companies Law allows partners to “conclude one or more agreements organising the relationship among them or with the company” and makes them binding even when not part of the articles of association, so a buyer who reads only the articles may buy a company bound by an agreement they never saw. The second is the loss threshold: Article 182 obliges the manager of a limited liability company to call the assembly within sixty days when losses reach half of capital, and the absence of that minute when losses have reached the threshold signals a management that does not know its obligations or ignores them.
The third is the bankruptcy register. The Bankruptcy Law obliges the debtor to deposit orders opening procedures and ratifying proposals in the bankruptcy register run by the Bankruptcy Commission: Article 36 sets five days for depositing a ratified proposal, and Article 37 makes the plan “binding on the debtor, the creditors and the owners”. Searching the target company, its partners and its major customers in the bankruptcy register takes minutes and reveals what three years of statements do not. The fourth is personal data: Article 5 of the Personal Data Protection Law requires the data subject's consent to change the purpose of processing, and Article 29 restricts transfer outside the Kingdom, so the target's customer base may not be transferable to the buyer in the form the buyer imagines.
The data room: what is requested on day one
- The articles of association and every partners' agreement outside them: under Article 11, the binding agreement may not be in the articles.
- Assembly and board minutes for three years: including the half-capital minute if losses ever reached it.
- The ten largest customer and supplier contracts: in full text, not summaries, because the change-of-control clause hides on the last page.
- Zakat and tax returns and their assessments: and any pending objection.
- The data protection policy and the customer consent register: because a customer base is an asset that cannot be transferred without its owners' permission.
- The list of employees who hold a relationship or knowledge nobody else holds: by name, with their contracts.
A seller who is slow to deliver an item on this list tells the buyer something, and a seller who delivers it complete in a week tells them something else. The speed and order of the data room is an indicator of the operating model itself before operational diligence begins, and the first observation recorded in the diligence memo without a single interview.
Where the risks hide
In the experience of IAD Business Services Group, what spoils deals is rarely a wrong number in the statements. It is usually one of four: customer concentration, an operation dependent on one person who does not stay after closing, a contractual clause that changes with ownership, or working capital dressed up in the months before the offer. The four share the fact that none appears in the income statement, and all appear in the first quarter after closing.
A worked example: an acquisition, figures disguised
A target services company with revenue of SAR 45 million, declared operating profit of SAR 7 million, and an initial price of SAR 42 million, six times operating profit. Diligence produced three findings: one customer represents 35% of revenue and its contract includes a termination clause on change of control; working capital was dressed by delaying SAR 2.5 million of supplier payments in the last quarter; and SAR 1 million of the declared profit came from selling vehicles rather than from operations.
| Item | Effect on recurring operating profit | Treatment in the purchase agreement |
|---|---|---|
| Non-recurring profit (vehicle sale) | SAR 7 to 6 million | Price adjustment: 6 x 6 = SAR 36 million |
| Dressed working capital | No change to profit | SAR 2.5 million deducted from the price at closing |
| Customer concentration with a change-of-control clause | Risk to 35% of revenue | Closing condition: the customer's written consent, and 15% of the price held for a year |
| Price after diligence | SAR 33.5 million, of which SAR 5 million held |
The difference between SAR 42 million and SAR 33.5 million is SAR 8.5 million, about 20% of the initial price, a familiar range in deals that are seriously examined. But the most important item in the table is not a number but the closing condition: without the major customer's written consent the deal does not close at all, because the company without that customer is a different company at a different price.
How long diligence takes and what it needs
Serious diligence on a mid-sized company usually takes four to six weeks, neither one week nor six months. The first week for the document request and reading the data room, the next three for the seven tracks in parallel with management interviews and major customers where permitted, and the final week for the memo and the recommendation. Diligence squeezed into a week misses the change-of-control clause; diligence stretched to six months loses the deal itself because the seller finds a buyer with fewer questions. The team IAD Business Services Group works with is deliberately small: a diligence lead who holds the whole picture, a financial specialist, a licensed law firm for the legal track, and a technology specialist when needed.
Diligence from the seller's side
A seller who examines their own company before the buyer does sells at a higher price on fewer conditions. Vendor diligence surfaces the same four findings before the other side finds them and turns them into a discount: customer concentration is treated with longer contracts before the offer, dependence on one person with documented procedures and a retention package, the change-of-control clause with the customer's prior consent, and working capital presented as a twelve-month average rather than a dressed quarter. In the example above the seller would have kept much of the SAR 8.5 million gap had those four been done before the company was offered for sale.
The output: a memo a decision is taken on
- The investment thesis on one page: why we are buying, and what must be true for the deal to succeed.
- What was confirmed and what was not: by the seven tracks, with no courtesy to whoever supplied the information.
- Risks ranked by financial effect: not by count; one risk with an SAR 8 million effect precedes ten risks at SAR 100 thousand.
- What must be addressed in the purchase agreement specifically: a price adjustment, a warranty, a closing condition, or a holdback.
- The single recommendation: buy on these terms, or do not buy.
Diligence that ends in a binder of notes serves nobody. The real value of diligence is sometimes that it ends in one recommendation: do not buy. That recommendation, when it is right, is the cheapest thing the buyer ever paid for, and IAD Business Services Group writes it without hesitation when it is warranted, because diligence fees do not depend on the deal completing.
The audit asks whether the numbers are right. Diligence asks what I am actually buying.
Sources
- Companies Law, Royal Decree M/132 (1443H), Articles 11 and 182.
- Bankruptcy Law, Royal Decree M/50 (1439H), Articles 36 and 37.
- Personal Data Protection Law, Royal Decree M/19 (1443H), Articles 5 and 29.
- Business sector bulletin, Q1 2026, Ministry of Commerce via SPA.