In this article
Before you start
This page is one step of the investor pitch questions learning path. Diligence usually follows the metrics deep-dive and comes before term-sheet negotiation. Ownership questions also connect to valuation and dilution, and a practice list is in the investor Q&A prep sheet.
Why interviewers ask this
Finance and venture interviews use diligence because it tests judgment under scrutiny. The question rarely asks you to recite a checklist. It asks what an investor would want to see, why, and what you would do when a document contradicts a claim. The question can come from either side of the table: a founder is asked how to prepare a room, and an investor candidate is asked what to check.
A weak answer lists documents: "contracts, financials, cap table." A strong answer ties each document to the concern behind it, such as ownership clarity or financial discipline, and says what happens when two numbers disagree. A Staff-level answer adds process: who owns each response, how the room is staged, and when a question goes to counsel before anything is shared. No public source describes how any firm scores this question, so treat the structure on this page as the author's synthesis of the sources below, not as a reported rubric.
Due-diligence questions and the data-room from first principles
- Due diligence
- Due diligence is the level of reasonable care expected before a legal or financial commitment, usually carried out by reviewing financial records and other documents before a securities offering or a business acquisition.
- Data room
- A data room is a secure, usually virtual, repository where a company shares organised documents with an investor or buyer and their advisers, often with access permissions and a question-and-answer (Q&A) channel.
In plain words
Think of buying a used car. You ask to see the service history, you check the owner's name matches the registration, and you ask the seller about anything odd. Due diligence is that process for a company, and the data room is the folder of papers the seller hands over. The analogy breaks in one place: a car check is mostly physical, while company diligence is almost entirely documents and the answers to written questions.
In one precise sentence, due diligence is a bounded verification of facts for a decision. The data room is the controlled place where the evidence lives. Cornell's legal dictionary frames it as "reasonable care". That corrects a common belief: it is reasonable, not exhaustive. It applies to venture rounds as well as acquisitions, since the Corporate Finance Institute says a data room can support the process for a merger and acquisition (M&A) deal or a venture capital transaction.
Step 1: Scope the questions by investor concern
Scoping means deciding what the investor needs to believe. A practitioner guide says most investors review the same themes in roughly the same order: legal setup, ownership, financial control, product and intellectual property (IP), customers, team and security. That is seven areas.
Input: the deal and the investor's stated concerns. Output: a list of areas, each tied to one worry. Write each worry as a plain question, such as "who really owns the company?" or "does spending match the plan?", so every document you later add has a reason to be there. Cap table and fundraising maps to ownership clarity and dilution; financials map to financial discipline. You now know what will be asked. The next step is where the answers will live.
Text description of the diagram
- Cap table and fundraising maps to ownership clarity and dilution.
- Financials map to financial discipline.
Step 2: Organise the data room with structure and permissions
A data room is more than a folder dump. Donnelley Financial Solutions (DFIN) describes a secure platform for organising and sharing documents that supports efficient, collaborative reviews, and the Corporate Finance Institute describes a virtual data room as a secure cloud solution accessed over a secure connection. A virtual room can be opened to reviewers anywhere without a physical room.
Input: documents grouped by the areas of step 1. Output: a room with a folder per area, an index at the front and access that can be staged. A common failure is the panic folder assembled the night before diligence. Stage access instead: open the basics first, and release sensitive material only when sensitive diligence begins, for example behind a restricted link.
Step 3: Reconcile the numbers across deck, model and data room
Reconciliation is where diligence finds real problems. Every figure should reconcile across the pitch deck, the financial model and the data room. Ownership is the clearest case, because convertible paperwork changes it.
The SAFE from Y Combinator is a simple agreement for funding now in exchange for shares later, and its post-money form makes the ownership sold transparent and calculable. A common formula is purchase amount divided by the post-money valuation cap. Signed SAFEs, board consents and side letters then become cap-table material, so the cap table must include them. Input: the deck's ownership claim and every instrument. Output: one reconciled percentage, or a flagged gap. The worked example below computes one.
Step 4: Answer follow-up questions in a logged Q&A
After the first review, investors ask follow-ups, and the data room's Q&A tool is the channel. A request log is a record of who requested each item, when it is due and who owns the response. Without an owner, an item is late by default. Each log line also records the date of the answer, so the investor can see how quickly the company responds and the team can see which item is stuck.
Input: a question from the investor. Output: an answer or document, logged with owner and date, or an escalation. Legal, tax, privacy and security questions go to counsel first. Sharing everything to look transparent is a mistake, because staged access protects the company. You now have the whole loop: scope, organise, reconcile, answer.
Step-by-step description
- Tie each area to a concern.
- Build the room with permissions.
- Match every figure across documents.
- Log each follow-up with an owner.
- Scoping ties each area to one investor concern.
- Every figure should reconcile across the pitch deck, the financial model and the data room.
- A request log is a record of who requested each item, when it is due and who owns the response.
Knowing it is half the job. Saying it is the other half.
Interview Clozo is an AI interview copilot for real interview rounds: it hears the question and puts a strong answer on your screen, and you say it in your own words. See the features or how it works.
Start Free Trial →Worked example
Take a startup whose deck says the founders own 80% before the next priced round. The numbers are illustrative and the amounts are in any currency. SAFE A is 1,000,000 invested on a 10,000,000 post-money cap, so it converts to 1,000,000 / 10,000,000 = 10%. SAFE B is 500,000 on a 12,500,000 cap, so it converts to 4%. An option pool of 10% is reserved.
Founders hold what remains: 100 − 10 − 4 − 10 = 76%.1 Each post-money SAFE's share is fixed against the pre-round capitalisation (which includes the other SAFEs and the pool) when the round prices above its cap; the priced round's new money dilutes all holders afterwards (Y Combinator). The deck says 80%, so there is a four-point gap that an investor will find and ask about. This is a simplified model; real conversion mechanics have more terms.
| Holder | Share of company (illustrative) |
|---|---|
| SAFE A (1,000,000 on a 10,000,000 cap) | 10% |
| SAFE B (500,000 on a 12,500,000 cap) | 4% |
| Option pool | 10% |
| Founders, reconciled | 76% |
| Founders, claimed in the deck | 80% |
Text description of the diagram
- SAFE A converts to 10% and SAFE B to 4%.
- Reconciled founder ownership is 76% against 80% claimed in the deck.
A request log shows process quality. In an illustrative tracker of six items, the days from request to response are 1, 2, 7, 3, 7 and 5, an average of 4.17 days, and two items (the IP assignment, 3 days late, and the customer contracts, 2 days late) missed their due date.1 The late IP item matters most: a company that cannot show it owns its intellectual property has a gap in its chain of title, and an investor will ask about it.
Trade-offs and edge cases
Transparency and protection pull against each other. A fuller room speeds review and signals discipline, but releasing everything early exposes sensitive material. Staged access resolves it: share the basics first and the sensitive items when the investor is serious.
In venture deals the contract is where findings become protection. The National Venture Capital Association (NVCA) model documents are a free set of venture financing templates. The five documents revised in 2025 are the Certificate of Incorporation, Stock Purchase Agreement, Investors' Rights Agreement, Voting Agreement, and Right of First Refusal and Co-Sale Agreement.
The NVCA updated five of its model documents in October 2025, adding mechanics for tranched financings, where money arrives in stages, and its page shows later updates to the Voting Agreement (June 2026) and the Right of First Refusal and Co-Sale Agreement (April 2026), as of October 2026. The Stock Purchase Agreement is where the company's representations and warranties sit, so diligence findings are tested against them (NVCA model documents). The documents are templates, so a deal outside their assumptions needs counsel to adapt them.
Two further edge cases. Diligence is not an audit: an audit is an independent examination of financial statements, while diligence verifies facts for a decision. And no primary source gives a standard request list or typical duration, so treat any quoted document count or timeline as a vendor claim.
How to answer it in an interview
How would you prepare for investor due diligence?
I would start from the investor's concerns: ownership, financial control, product and IP, customers, team and security. I would build a data room with a folder per area, an index and staged permissions. Then I would reconcile every number across the deck, the model and the cap table, including SAFEs and the option pool, because a mismatch costs credibility. Finally I would run a request log with an owner and due date per question, and send legal, tax and security questions to counsel before sharing anything.
The spoken structure: name the concerns, describe the room, reconcile the numbers, then run the log.
Common mistakes
- "Due diligence means finding every problem." (wrong) The standard is reasonable care. (right) "It is a bounded check for the decision at hand."
- "A data room is a shared folder." (wrong) Permissions, structure and a Q&A trail are the point. (right) "It is an organised, access-controlled record with a log."
- "Diligence is only for acquisitions." (wrong) It also applies to venture and SAFE rounds. (right) "Any investor writing a cheque will verify claims first."
- "Share everything to look open." (wrong) Sensitive items need staging and counsel. (right) "I release in stages and escalate legal and security questions."
- "The deck and the cap table can differ slightly." (wrong) Mismatches are what investors look for. (right) "Every figure reconciles across all documents."
Follow-up questions
What is a data room in due diligence?
A data room is a secure repository, usually virtual, where a company shares organised documents with an investor and their advisers. Typical features are access permissions and a way to ask and answer questions.
What do investors ask for in due diligence?
Investors usually review legal setup, ownership, financials, product and IP, customers, team and security. The exact list varies by investor, and no official standard list exists.
Is due diligence the same as an audit?
No. An audit is an independent examination of financial statements. Due diligence is broader and verifies facts for a decision.
Should you share everything in the data room?
No. Stage access, and send legal, tax, privacy and security questions to counsel before sharing. A restricted link can mark when sensitive diligence begins.
Does due diligence apply to a SAFE round?
Yes. A SAFE is still an investment, so the investor can verify claims first, and signed SAFEs feed the cap table they check.
What would you check first as the investor?
Start with the claims the decision rests on: who owns the company, since a post-money SAFE's ownership sold is calculable from its cap, and whether the cap table matches the deck. Then check revenue quality through customer contracts and reference calls, the chain of title for intellectual property, and the management team. The areas follow the themes practitioners say investors review; the ordering of this list, including reference calls and the management team, is the author's judgement.
- Due diligence is reasonable, bounded verification of claims, not an exhaustive hunt.
- A data room is an organised, permissioned record with a Q&A trail, not a folder dump.
- Scope questions by the investor's concern behind each area.
- Reconcile every figure across deck, model and cap table, including SAFEs and the pool.
- Log each request with an owner and due date, and escalate sensitive questions to counsel.
Sources
- Due diligence (Wex legal dictionary) — Cornell Law School Legal Information Institute, 1 Jul 2025
- NVCA Model Legal Documents — National Venture Capital Association, 26 Oct 2026
- NVCA Releases 2025 Updates to Model Legal Documents — National Venture Capital Association, 2 Oct 2025
- The SAFE — Y Combinator, 26 Oct 2026
- What is a Due Diligence Data Room? — DFIN, 26 Oct 2026
- Data Room — Corporate Finance Institute, 26 Oct 2026
- Startup data room guide — datarooms.com.hk (practitioner), 26 Oct 2026
