Due Diligence: Commercial, Operational & People Risks
Would you still buy a company if its revenue is growing, its factories are busy, and its founder says the team is “like family”? Due diligence exists because attractive deals often hide the exact risks that destroy value after signing - weak customer stickiness, fragile operations, or people who walk out when ownership changes.
- Due diligence is the structured investigation of a target before a transaction decision, price, contract or integration plan is finalised.
- Commercial due diligence asks: “Will the revenue and market story actually hold?” It tests market size, growth, competition, customers, pricing and churn.
- Operational due diligence asks: “Can the business deliver profitably and reliably?” It tests capacity, cost, assets, supply chain, systems and scalability.
- People due diligence asks: “Will the organisation survive the deal?” It tests leadership depth, critical talent, culture, incentives, attrition and labour risks.
- The best diligence does not just find problems - it separates deal breakers, price adjustments, contract protections and integration priorities.
- The biggest red flag is not “a risk exists”; it is when a key assumption in the investment thesis depends on a risk that the buyer cannot control.
Big Picture: Due Diligence Is a Thesis Stress Test
A deal begins with a thesis: “If we buy this company, we can create value.” Due diligence tests whether that thesis survives contact with customers, operations and people. If you are new to where this work sits inside consulting, deal diligence is one of the core service lines explained in Strategy, Operations, Technology & Deal Advisory Compared.
Core Explanation: The Three Risk Lenses
Think of due diligence as three connected lenses. Commercial risk is about whether the business can keep winning in its market. Operational risk is about whether the business can fulfil that promise at the expected cost and quality. People risk is about whether the leaders, teams and culture needed for the plan will still be there after the deal.
1. Commercial Due Diligence - Is the Revenue Story Real?
Commercial due diligence tests the attractiveness and defensibility of the target’s market position. It answers questions like:
- Is the market growing, stable or structurally declining?
- Are customers genuinely loyal, or just locked in temporarily?
- Is growth coming from repeatable demand or one-off wins?
- Can competitors copy the proposition or undercut pricing?
- Are customer concentration, churn or channel dependency hiding inside headline revenue?
For an Indian example, a buyer assessing a quick-commerce asset like Blinkit would not stop at “online grocery is growing.” It would test dark-store catchments, SKU economics, rider availability, city-level contribution margins, food and safety compliance, and whether customer frequency survives when discounts reduce. The strategic point: commercial due diligence must test quality of demand, not just size of demand.
2. Operational Due Diligence - Can the Business Deliver the Plan?
Operational due diligence tests the engine room of the company: plants, warehouses, technology, procurement, fulfilment, cost structure, working capital and execution routines. A business can have demand and still fail the deal thesis if operations are brittle.
- A factory may show high utilisation but require major maintenance capex.
- A distributor network may look wide but depend on a few fragile partners.
- A SaaS platform may scale revenue but have weak uptime, cyber hygiene or product debt.
- A retail chain may grow stores but suffer from shrinkage, poor inventory turns or inconsistent service levels.
3. People Due Diligence - Will the Organisation Survive the Deal?
People due diligence tests leadership depth, key-person dependency, culture, incentives and employee obligations. This is where many otherwise sensible deals leak value: the founder exits, regional sales heads resign, integration incentives are unclear, or legacy employment liabilities surprise the buyer.
People risk is not “soft.” It directly affects revenue continuity, customer relationships, delivery quality and integration speed.
Definitions You Should Be Able to Say Clearly
- Due diligence: A structured investigation of a target to validate deal assumptions, risks, valuation, contracts and integration choices.
- Commercial due diligence: Testing whether the target’s market, customers, growth, pricing and competitive position can support the investment thesis.
- Operational due diligence: Testing whether the target’s assets, processes, systems, supply chain and cost base can deliver the business plan.
- People due diligence: Testing whether leadership, critical talent, culture, incentives and workforce obligations support or threaten deal value.
- Red flag: A finding that can change price, contract terms, integration priorities or the decision to proceed.
What to Track: Metrics That Make Due Diligence Real
A strong answer names the evidence you would inspect. Do not say “I will check operations” and stop. Say exactly which measures you would test, how they are calculated, and what a strong reading looks like relative to the investment thesis and peer benchmarks.
A Small Worked Example: How One Finding Changes Value
Assume a buyer is valuing a B2B services target at 8x EBITDA. The seller shows revenue of ₹500 crore and EBITDA of ₹75 crore, so the headline enterprise value is ₹600 crore.
During commercial due diligence, customer calls reveal that one major account contributing ₹50 crore revenue is unlikely to renew. The account contributes ₹10 crore EBITDA. Normalised EBITDA becomes ₹65 crore, so at the same 8x multiple, value becomes ₹520 crore.
The lesson is simple: diligence is not a checklist ritual. One validated commercial risk can change price, earn-out structure, indemnities or even the go/no-go decision.
Case Study: Microsoft - Activision Blizzard
Microsoft’s acquisition of Activision Blizzard shows why commercial, operational and people risks must be tested together in a large strategic deal.
Microsoft announced in January 2022 that it would acquire Activision Blizzard in an all-cash transaction valued at $68.7 billion (Microsoft News, January 2022). It completed the acquisition on October 13, 2023 (Microsoft News, October 2023).
The primary strategic driver was control of major gaming content and communities across console, PC, mobile and subscription ecosystems. Supporting drivers included Microsoft’s distribution through Xbox and Game Pass, Activision Blizzard’s game franchises, mobile exposure through King, and the broader shift toward cloud and subscription-led gaming.
But this was not a simple “big company buys content” story. The due diligence challenge would have included three hard risk buckets:
The UK Competition and Markets Authority examined the transaction closely, especially cloud-gaming concerns, before the deal ultimately closed after remedies and restructuring of cloud-streaming rights (UK CMA merger inquiry). The lesson for due diligence is powerful: the deal did not depend on one risk being absent. It depended on whether the buyer could understand, price, mitigate and contract around multiple connected risks.
How AI Changes Due Diligence
AI is making diligence faster, but not easier in the lazy sense. The consultant’s job shifts from collecting documents to asking sharper questions, checking contradictions and judging materiality.
- Commercial diligence becomes evidence-rich: AI can summarise customer reviews, call transcripts, competitor websites, app-store feedback and social sentiment to identify churn signals, price complaints or unmet needs. The human still decides whether the signal is material.
- Operational diligence gets pattern detection: AI can scan procurement data, maintenance logs, inventory records and service tickets to spot supplier dependency, recurring downtime, abnormal returns or process bottlenecks.
- People diligence becomes more structured: AI can map roles, spans, attrition patterns, skills, compensation anomalies and organisation-network signals. The caveat: employee data must be handled lawfully, with privacy, consent and bias controls.
Load a company annual report, investor presentation and two competitor summaries into NotebookLM. Ask it to create a diligence issue tree across commercial, operational and people risks, then generate 10 management questions and the evidence needed to answer each.
Interview Relevance
“A private equity fund is evaluating a mid-sized Indian manufacturing company. How would you conduct due diligence across commercial, operational and people risks?”
Use this sentence in interviews: “I would not run diligence as a checklist; I would stress-test the investment thesis and convert findings into price, protection and integration actions.”
Common Mistake
The most common mistake is giving a generic checklist - market, operations, HR - without linking risks to the deal thesis. It costs candidates because it sounds like textbook memory, not transaction judgement. One-line fix: for every risk, say “so what for price, contract, go/no-go or integration?”