Due diligence request lists: how to track 400 requests without a spreadsheet

On a mid-sized sale, the first request list from a buyer’s advisers often runs to 300 or 400 lines. Follow-up lists add more. By the end of confirmatory diligence, the seller’s team may have handled several hundred requests across legal, financial, tax, HR, IT and commercial workstreams.

The documents get the attention. The list that coordinates them usually gets a spreadsheet. This guide is about doing better than that. It is not a checklist of which documents to request; it is about how to run the list itself.

What is a due diligence request list?

A due diligence request list is a structured record of everything a buyer or investor asks the target to provide, from constitutional documents to customer contracts, together with the status of each item. It usually starts as the buyer’s document and becomes a shared working tool, updated by both sides until diligence closes.

It does three jobs at once:

• Scope. It defines what the buyer wants to review.
• Workflow. It tells the seller’s team what to find, who is finding it and by when.
• Record. At the end, it shows what was asked, what was answered and what was declined, which matters for disclosure against warranties.

What fields should every request have?

Agree the structure at the start, ideally before the first list is issued. Retro-fitting columns to 400 rows is miserable work.

The reference number should match the data room index wherever possible. If request LEG-3.2 is about material contracts and the index folder for material contracts is 3.2, nobody has to translate.

How does a request move from logged to closed?

Every request passes through the same handful of statuses. Problems happen at the handovers between them.

The figure shows the classic failure point at each status. The single most expensive one is usually the fourth: an answer that points to a file path, an email attachment or “sent last Tuesday” instead of a specific document in the room. When the buyer’s lawyer reviews disclosure three weeks later, nobody can find it.

Why do spreadsheet trackers break down?

Spreadsheets are flexible, familiar and already on every laptop. For a small deal with one buyer and a few dozen requests, they are perfectly adequate. They break down in predictable ways as volume rises.

The access control problem is often overlooked. In a competitive process, each bidder’s request list reveals its concerns. A seller who manages them in one master spreadsheet risks sending the wrong tab to the wrong party.

How do you set up a request list that works?

Whether you stay in a spreadsheet or move to a data room module, the setup is the same.

1. 1

   Agree the template with the buyer

   Before the first list arrives, share the fields, categories and reference format you want to use. Most advisers will adapt to a reasonable template.

2. 2

   Mirror the data room index

   Number request categories to match the top-level folders of the room, so a request and its answer share a location.

3. 3

   Name one owner per request

   A person, not a department. The owner finds the document or drafts the answer; the deal lead checks progress.

4. 4

   Set a review step before release

   Sensitive answers, such as anything touching litigation, key customers or employees, should pass through seller counsel before they are uploaded or published.

5. 5

   Fix a weekly cadence

   A standing call or status export each week, where overdue high-priority items are discussed by name. Momentum dies when nobody chases.

6. 6

   Close formally

   At the end of each phase, export the list with final statuses and answer links. That export is part of the disclosure record.

What should you do with duplicates and vague requests?

Buyers’ lists often contain overlapping requests from different advisers, and some requests are too broad to answer. Deal with both early.

• Duplicates: link the later request to the earlier one and close it with a cross-reference, rather than answering twice.
• Vague requests: reply with a clarifying question and a proposed narrower scope. “All correspondence with regulators” might become “correspondence with regulators in the last three years relating to licences or investigations”.
• Out of scope: decline politely in the notes field with a reason. A clear “not provided, because” is better than a request that stays open for weeks.

When should the list move into the data room?

When at least one of these is true: more than one bidder, more than about 150 requests, more than three workstreams on the seller side, or a need to prove later what was disclosed. At that point the cost of the spreadsheet’s failure modes usually outweighs the effort of learning a request module.

Many data rooms combine request tracking with the Q&A module: a request can be raised, assigned, answered with a link to a document and closed, all with a timestamped history. Some offer a dedicated request list feature with bulk import from Excel, which matters when the buyer’s list arrives as a spreadsheet. Check during a trial whether import keeps your reference numbers and categories intact.

Our earlier piece on how a data room changes an email workflow follows one request through both systems. For which platforms handle request tracking and Q&A well, see the best data rooms for due diligence.

How does the request list connect to disclosure?

In many deals, the seller qualifies its warranties by reference to what was disclosed in the data room. The request list, with links to answers, becomes evidence of what the buyer asked for and received. That is why “answered by email” is risky: it may sit outside the agreed disclosure record.

Seller counsel will usually want the final list, the room index and an archive of the room delivered together at signing. A list that already links each answer to a document makes that pack straightforward. Buyers benefit too: a closed list with clear answers is the starting point for reviewing red flags in the data room and planning integration.