Whitepaper · Due Diligence
Biotech & Pharma Due Diligence:
Best Practices, Pitfalls & Checklist
A checklist is where diligence starts, not where it ends. The practices that hold up under deadline pressure, and the issues that recur across assignments.
Due diligence is the formal exercise of quantifying risk and confirming value. I have called it art meeting science, and the description holds: the science is a documented method, and the art is knowing where a target company's account of itself will not survive contact with its own data. What follows is drawn from diligence assignments across therapeutic areas, modalities, and transaction types since 2009.
The basics
A checklist opens a diligence exercise. Judgment closes it.
To some, diligence is simply a question of working through a detailed checklist, but that is only a starting point. An experienced multidisciplinary team, available under tight deadlines, is a second essential. A skilled process leader with cross-functional communication skills is the third.
Skepticism in this context is calibration rather than pessimism. Across more than 21,000 compounds, roughly one in seven drugs entering clinical development goes on to be approved.1 Against a base rate of that order, a reviewer who assumes a program will work is not being generous; they are ignoring the distribution.
Target companies have a duty to provide accurate and candid information to the diligence team, and not all of them do. They usually carry an inbuilt bias toward promoting value. Without deliberately obscuring risks, they may deemphasize them in presentations or bury them in a mass of detail. The intangible aspect, the art of diligence, is the ability to apply a detective's nose to opaque and unexpected issues that are not apparent on first or even second inspection.
Since 2009, Alacrita has conducted 375+ due diligence assignments, drawing on consultants active in each of the major disciplines involved in healthcare R&D. Each brings prior experience inside the industry, often decades in pharma and biotech roles. They understand the mindset of target companies and know where to look. This complements the standard investor approach of interviewing academic KOLs, who may be at the cutting edge of science and medicine but who can lack industry context.
When presence is worth the cost
How a management team answers is evidence in its own right.
Remote diligence is now the default, and for document review that is the right default. The useful question is the inverse one: which parts of an exercise still justify being in the room. Three do. Facility inspection, where a walkthrough surfaces what a quality dossier presents in its best light. Manufacturing assessment, where seeing a process run tells you what batch records cannot. And the management meeting, where the object under assessment is the team rather than the paperwork.
Direct access to key management unearths more issues than a data room review alone. Where timing, geography, or budget rule out a visit, videoconference is a reasonable substitute for the conversation, though not for the walkthrough.
When even that is not possible, it can pay to have the target company review a draft diligence report, provided this does not undercut a negotiating position. The target then has a chance to rebut findings or supply additional information, which sharpens the team's conclusions. On occasion we have been deliberately provocative in a draft report. The tenor of management's response is highly illuminating; anything other than a reasoned, measured reply constitutes at least a yellow flag.
Expertise is the key
The hundredth diligence exercise informs the hundred and first.
Due diligence is not a task for a generalist. Experience counts: when you have conducted 100 diligence exercises, that provides considerable context for the 101st. Successful diligence requires depth across multiple functional areas, concentrated into a narrow window and usually under deadline pressure. Reviewing a clinical trial protocol and the resulting data calls for experienced industry physicians who have done this many times and who have personally experienced both success and failure in clinical programs.
Staging the exercise offers process efficiencies. A small team conducting a pre-diligence review can identify critical issues without the time and expense of a full documentation review. If any of those issues prove to be showstoppers, the process can be truncated with material savings. The two exercises answer different questions.
| Pre-diligence and triage | Full technical and commercial diligence | |
|---|---|---|
| Question answered | Is there a showstopper here? | What is the risk, and what is it worth? |
| Inputs | Public information and a limited document set | Full data room, management access, expert interviews |
| Team | Small and senior, typically two or three people | Domain specialists assembled to match the asset |
| Output | A go or no-go recommendation | Risk report ranked by severity, with mitigations |
| When it pays | Early screening, competitive processes, limited internal bandwidth | Once an asset has cleared triage and terms are in play |
Table 1 · Pre-diligence is not a shorter version of full diligence. It asks a narrower question, and a negative answer ends the process before the larger cost is committed.
Common pitfalls
The same issues recur across assignments, in predictable places.
So where are the bodies usually buried? Two failures are behavioral rather than technical. The first is not understanding the context of the buyer: a new fund may accept more risk because it is establishing a reputation, while a large pharma may be defending a valuable franchise, and recommendations have to be set into that context. The second is treating diligence as an extension of the sales pitch. Diligence is part of the negotiation process, and the common trap of polishing the data and hiding the negatives backfires. Which findings prove negotiable and which end a transaction is treated separately.3
A related habit is worth naming: target companies that ask which documents the team would like to see, keeping the scope as narrow as they can rather than opening everything relevant. The corresponding discipline on the reviewer's side is to treat the management deck as a claim rather than a record. It may not match the clinical study reports, the agency correspondence, or the raw data, and we have seen it diverge from SEC filings as well. Never believe the PowerPoint.
The rest are findings in the asset itself. They recur in predictable places, surface at predictable points, and are largely preventable.
| Finding | Domain | Where it surfaces | What prevents it |
|---|---|---|---|
| Presentation does not match source data | Clinical and scientific | Data room review, when the deck is checked against study reports and agency correspondence | Reconcile every claim in the deck to a primary source before the data room opens |
| Chain of title gaps in licensed IP | Intellectual property | IP review, sometimes years after the license was signed | Confirm the licensor had authority to grant. For university inventions, confirm institutional consent, not only the researcher's |
| Third-party license left until after proof of concept | Intellectual property | IP review and deal negotiation | Approach the third party early, while your negotiating position is strongest |
| Royalty stacking | Intellectual property | Financial modeling, once cumulative obligations are totaled | Model the cumulative royalty burden against realistic pricing before signing each license |
| USPTO and EPO divergence, overlapping filings | Intellectual property | Patent estate review | Use counsel practiced in both jurisdictions. Check whether your own filings have created prior art |
| European exposure under the Unified Patent Court | Intellectual property | Patent estate review, and at any point a competitor chooses to act | Record the opt-out position for every European patent and the reasoning behind it. Since June 2023 a single central action can revoke across all participating states at once |
| Commercial supply chain deferred | CMC and manufacturing | Launch planning, when timelines are stress-tested | Begin commercial supply work during Phase II. Do not assume clinical material can serve the launch market |
| No payer or KOL validation | Commercial viability | Commercial review, often after clinical and regulatory have passed | Run payer and KOL research while the target product profile can still change |
| Key person dependency undocumented | Operational and financial | Management meetings and team assessment | Identify key person risk and put retention arrangements in place before diligence begins |
Table 2 · Recurring findings mapped to domain, to the point in the process where they typically emerge, and to the step that would have prevented them. The cases below show how several of these look in practice.
Two of these are cultural as much as technical, and both are worth naming because they are attitudes rather than oversights. Biotech companies working toward a first launch can treat the supply chain as though it were only manufacturing, when the reality is considerably more complex. And the people, how good they are and whether they are likely to stay, are routinely neglected in diligence despite being essential to the success of any project or business. The exception is an asset being transplanted into an existing mature organization, and even then continuity is close to paramount.
Two that were not preventable by checklist
- The university that never consented. Some target companies know they need access to third-party IP but consciously wait until proof-of-concept before approaching the third party, which leaves them negotiating from the weakest possible position: the greater the value created, the stiffer the terms. Chain of title is the sharper version of the same problem. In one case a company had licensed an invention from a university researcher, and it was not until diligence years later that we discovered the university had never consented and retained rights that had to be accommodated. Since June 2023 the European dimension has changed too. Patents now fall under the Unified Patent Court unless opted out, so one central action can revoke across all participating states at once, and assets filed or licensed before that date were often never subjected to a deliberate opt-out decision.
- The product no payer would fund. Competition, differentiation, the patient journey, market segments, and standard of care all matter, but the question that settles commercial viability is whether anyone will pay. In the worst case we have encountered, payer and KOL research on a development candidate found no circumstances in which payers would reimburse the product and no KOL who would recommend prescribing it. The medical unmet need was real. The target product profile was judged to have little value in practice, which is a different finding and a fatal one.
AI and information control
A category of risk that did not exist when this paper was first written.
Early-stage companies now run substantial parts of their operation through AI tools: documentation, transcription, drafting, literature synthesis, and workflow support. The risk is rarely the one people picture. It is not a model acting maliciously. It is unpublished sequences, draft patent claims, confidential datasets, and internal business development material moving into systems whose retention rules, training settings, and administrative ownership were never examined.
Two consequences follow, and the commercial one usually arrives first. Disclosure of unpublished subject matter into a third-party system raises questions a patent attorney will want to answer about confidentiality and novelty, and those questions are easier to answer before filing than after. Separately, a target that cannot describe how its own information is handled invites a discount that is applied quietly rather than argued.
Four questions establish the position. Which systems touch sensitive data? What are the default retention and training settings on each, and were they changed? Who controls configuration and vendor oversight? And are AI outputs treated as draft material requiring expert review, or as finished analysis? Used deliberately, these tools accelerate synthesis. Used casually, they contaminate the evidence base that the whole exercise depends on.
Key questions checklist
Five questions that open any diligence exercise, whatever the asset.
A universal checklist is difficult to apply to every scenario. Any diligence exercise can nonetheless start from the following five questions. A question is only useful if you know what would answer it, so the evidence that settles each one is set out alongside.
- What is the nature of the opportunity, and what is the evidence supporting it? Is there sufficient differentiation from competition? What answers it: preclinical packages and whether the key findings have been reproduced outside the originating laboratory; the target product profile set against current standard of care rather than against no treatment; competitor assets in development, not only those approved.
- Is the project or business truly in the condition being presented? Have corners been cut? Are there gaps? What answers it: clinical study reports read against the summary deck; the full regulatory correspondence including the difficult exchanges; batch records, deviation reports, and change control logs; contemporaneous records rather than explanations written for the data room.
- What is the pathway to market, and the pathway to value realization? These are two different considerations. Are there alternative pathways, and is the right tradeoff in place between time to market and value potential? What answers it: agency meeting minutes confirming the pathway rather than a slide asserting it; a commercial supply plan with named facilities; reimbursement precedent for comparable products in the target markets; deal comparables at the same stage.
- What are the uncertainties on that pathway? How can they be addressed, how long will that take, and what will it cost? Is there scope for a killer experiment, meaning a single study designed so that either result is decisive, to yield a definitive go or no-go? What answers it: a written list of what the team does not yet know, and what each unknown would cost to resolve. Where a program has no clinical precedent, the distinction between quantifiable risk and genuine uncertainty matters,2 and we treat it at length in a companion paper.4
- Is the organization and the team up to the job? What answers it: the track record of named individuals on comparable programs; where key person dependencies sit and whether retention is arranged; and how management handles a hard question in the room, which is evidence independent of the answer given.
What findings do to a deal
A risk report that does not change the terms has not been used.
Diligence findings are not a verdict, and treating the report as one wastes it. In practice a finding does one of four things to a transaction, and which one depends less on severity than on whether the risk can be quantified and who is better placed to carry it.
A finding with a calculable cost, an additional study, a second supplier, a formulation change, usually moves the price. A finding with a knowable cost but an uncertain trigger, such as a patent challenge or an unresolved agency question, tends to move into escrow or a holdback, where the money is released once the question resolves. A finding that shifts the probability of success rather than its cost pushes value into milestones, which is how a buyer pays for an outcome instead of a forecast. And a finding that is genuinely binary, usually a factual claim about what was disclosed, belongs in representations and warranties, because the appropriate remedy is recourse rather than a discount.
The practical consequence for the diligence team is that a report has to be written to be used. A risk described only in technical terms leaves the deal team to perform the translation themselves, usually under time pressure and usually less well. Findings should carry their commercial implication: what this costs, what it delays, and what would have to be true for it to stop mattering. Which findings prove negotiable and which end a transaction outright is treated separately.3
The other side of the table: preparing to be assessed
Everything above describes what a diligence team will do to you. This section is what to do about it.
The preceding sections take the reviewer's position. This one takes yours. A company that understands how the exercise is run can arrive with its problems already identified, already analyzed, and already accompanied by a plan, which is a materially different negotiating position from having them discovered.
Well prepared target companies have generally implemented the following practices.
- Build and maintain a real data room. Include all important documentation and keep it current. A well-defined structure will itself highlight gaps the company needs to fill, and it is better to do this early. Data rooms need constant maintenance; many documents have a limited shelf life.
- Know your own risks. Be critically aware of key risks and consider mitigation strategies and responses to a diligence team. Do not try to obscure risks. It is better to have declared them than to let the diligence team discover them.
- Understand the competitive landscape, including potential infringers in both directions.
- Consider a focused internal diligence process, preferably using an external team, before exposing the company to diligence by investors, acquirers, or licensors.
When it lands
Diligence is not a single event, and knowing which one you are in determines how much preparation time you actually have. In a financing round, serious diligence usually begins once a lead has indicated terms, and the window between that point and closing is short. In a licensing or acquisition process it starts earlier and runs longer, because the counterparty is buying an asset rather than backing a team, and it will want to reach the primary data itself.
The practical implication is the same in both cases. The work described here cannot be started when diligence begins. A data room assembled under time pressure looks like a data room assembled under time pressure, and the reviewer draws conclusions about operational discipline from that alone.
What a reviewer expects to find
The question we field repeatedly from companies entering the process for the first time is what a data room should contain. There is no universal answer, but a reviewer working through the six domains will look for the following, and a structure organized this way makes your own gaps visible before anyone else sees them.
| Domain | What a reviewer will look for |
|---|---|
| Clinical and scientific | Protocols and amendments, clinical study reports, underlying datasets with statistical analysis plans, the investigator brochure, and the safety database. Preclinical study reports, including the studies that did not work |
| Regulatory strategy | The complete agency correspondence file, meeting minutes and briefing books, IND or CTA submissions, and any hold or deficiency history with its resolution |
| CMC and manufacturing | Batch records, deviation reports, change control logs, analytical method validation, stability data, and CDMO agreements with capacity terms |
| Intellectual property | Patent families with status by jurisdiction, prosecution history, Unified Patent Court opt-out position, in-licenses with chain of title evidence, assignments, and cumulative royalty obligations |
| Commercial viability | The target product profile, competitive landscape including assets in development, and any payer or KOL research conducted rather than assumed |
| Operational and financial | Budget and burn with the assumptions exposed, vendor contracts, clinical trial accruals reconciled against those contracts, organization chart, and key person arrangements |
Table 3 · A data room organized by assessment domain rather than by department. The gaps in a structure like this are self-announcing, which is the point of building it early.
What internal diligence actually involves
Running the exercise on yourself means commissioning a team to reach conclusions you may not want, and then acting on them. It is not a rehearsal, and its value comes from the reviewer having no stake in a favorable answer. A useful internal exercise produces three things: the issues a counterparty will find, an honest assessment of what each one does to value, and a decision on which to fix before the process and which to disclose during it.
Finding a problem you cannot fix is a result, not a failure. It is considerably cheaper to learn that a competitor is three years ahead, or that the patent position is narrower than assumed, while you still control the timing of the conversation.
From the files
Five assignments, five different answers. Diligence that only ever finds fault is not diligence.
The findings above are patterns. What follows is five assignments in which they played out, selected because the outcomes differ. Diligence that reaches the same verdict every time is not measuring anything. The last of the five is the exercise run by a company on itself.
Rapid reality check · Oncology · Cell therapy
A venture investor needed a verdict on a clinical-stage cancer biologic in four days, ahead of a proposed $10m investment. A cancer immunotherapy specialist reviewed a full data room spanning preclinical, clinical, regulatory, manufacturing, and IP, and reported the key risks with proposed mitigations.
The detail that matters is what happened next: the target company reviewed the report and agreed with the findings, including the major risks identified. A target that engages with an adverse finding rather than disputing it is providing information about itself, and that reaction is one of the more reliable signals available in a compressed timeline.
Pre-diligence triage · CNS · Small molecules
A venture firm considering a US drug repurposing company wanted to know whether full diligence was justified. The target was using the FDA's 505(b)(2) pathway to move several CNS candidates toward market within five years. The review covered preclinical and clinical data, the development plan, regulatory position, exit strategy, market opportunity, and the management team, with preliminary findings discussed with the target before the report was finalized.
The binding constraint turned out not to sit in any single program. Running that many candidates through critical phases at once was judged ambitious and demanding of resource, with deeper review recommended on CMC planning and clinical development capability. Risks were labeled by severity and impact. This is an operational finding, and it is the kind that a program-by-program review structured around the science alone will not surface.
Technical diligence and valuation · Oncology · Small molecules
A preclinical kinase inhibitor, assessed by three former industry specialists across mechanism, in vivo efficacy, pharmacokinetics, dosing, toxicology, competitive position, clinical strategy, IP, CMC, and management. The science held up. Patent claims were robust and valid, formulation was adequate for the stage, and the work already conducted was of high quality.
The problems sat elsewhere. Competitive analysis identified a large pharma program several years ahead in a target indication. Toxicity rivaled cytotoxic chemotherapy, though the narrow therapeutic window was judged manageable against the strength of the efficacy data, and initial dosing concerns were resolved by additional company data. The recommendations were that the management team be significantly strengthened and the development strategy be changed to differentiate the molecule. A separate rNPV model with Monte Carlo simulation was built to inform the investment negotiation, documenting the rationale for every assumption.
Investor diligence · Infectious diseases · Vaccines
Following a pre-diligence exercise, a Middle East investor commissioned deeper diligence on a preclinical vaccine platform. The work concentrated on the specific risks the earlier exercise had flagged, alongside the standard regulatory, manufacturing, and clinical risks, with further discussion of key issues directly with the target.
The conclusion was favorable: the platform had exceptional potential, programs were well targeted, risks were manageable, and the management team was of high calibre. The Series B proceeded and was oversubscribed. An exercise designed to disprove a thesis is worth little unless it is also capable of failing to disprove one.
Vendor diligence · Orphan disease · Small molecules
A biotech and its investors commissioned diligence on their own asset, to understand how partners would see it before business development discussions began. A team of functional experts ran the standard process against the company's own materials: pharmacology reports and publications, toxicology and preclinical study reports, clinical development plans, CMC and manufacturing strategy, regulatory correspondence, market and competitive analysis, and a strategic assessment of the IP position. Key individuals working on the project were interviewed to test and extend the findings.
What the company bought was a report written in the vocabulary its counterparties would use: the marketable advantages of the asset, the nature and level of each risk, and recommendations for positioning. The gaps were identified while there was still time to close them, and the weaknesses were ones the company could introduce on its own terms rather than have surfaced by somebody else.
Conclusion
Specialists reach conclusions that generalists reach late, or not at all.
Due diligence is not for the faint-hearted. It requires expertise, experience, and a manageable process and timeline.
The case against generalists is not a matter of professional preference. A reviewer who has seen a hundred data rooms recognizes the shape of an omission, knows which reassurance is standard and which is unusual, and can tell a protocol deviation with a documented rationale from one without. That recognition is not in any checklist, because it is the accumulated residue of having been wrong before. A generalist working from the same documents will reach a defensible conclusion and reach it late, or reach a conclusion that is defensible and wrong.
What the exercise buys is not certainty, which is not available at any price. It is a calibrated account of what is known, what is being assumed, and what cannot be resolved until an experiment is run. That account is worth paying for because the decision it supports is asymmetric. An investor who misses a flaw can lose the entire position; one who declines a sound asset loses an opportunity, and there will be others.
For the company being assessed, the asymmetry runs the other way and is easy to misread. Every program has problems. The ones that damage a transaction are rarely the problems themselves; they are the problems a counterparty finds before the company discloses them, because at that moment the finding stops being a technical issue and becomes a question about the team. Companies that understand this arrive with their weaknesses already identified, already analyzed, and already carrying a plan. They are not disclosing more than their competitors. They are disclosing first.
Common questions
Questions about the exercise itself. Questions about engaging Alacrita are answered on the due diligence practice page.
The recurring ones are a management presentation that does not match the source data, intellectual property chain-of-title gaps where a licensor lacked authority to grant a license, European patents whose Unified Patent Court opt-out position was never decided, commercial supply chain work deferred past Phase II, royalty stacking that erodes asset economics, commercial viability tested too late to change the target product profile, and key person dependencies that were never documented.
Remote is the sensible default for document review. Three things still justify being present: facility inspection, where a walkthrough shows what a quality dossier presents in its best light; manufacturing assessment, where watching a process run reveals what batch records do not; and the management meeting, where the team rather than the paperwork is the object of assessment.
Pre-due diligence is a short exercise by a small senior team that asks one question: is there a showstopper here? It uses public information and a limited document set rather than a full data room, and it produces a go or no-go recommendation rather than a risk report. It is worth doing when screening early, when competing against other bidders, or when internal bandwidth is limited, because a negative answer ends the process before the larger cost is committed.
Chain of title establishes whether whoever granted a license actually had the authority to do so. Where an invention was licensed from a university researcher without institutional consent, the university may retain rights that have to be accommodated, and the licensee's position is weaker than it appears on paper. The time to verify this is before entering a process, while remediation is still straightforward and the timing is yours.
During Phase II. Deferring it is one of the more reliable ways to push a launch date back, and the assumption that clinical trial material can supply the initial launch market is common and frequently wrong.
In a financing round it usually begins once a lead investor has indicated terms, and the window from there to closing is short. In a licensing or acquisition process it starts earlier and runs longer, because the counterparty is acquiring an asset rather than backing a team and will want to reach the primary data itself. In both cases the preparation cannot begin when the diligence does.
It has become a live question. Where unpublished sequences, draft patent claims, confidential datasets, or internal business development material have moved into third-party AI systems, the retention settings, training settings, and administrative ownership of those systems matter. Disclosure of unpublished subject matter raises questions a patent attorney will want answered about confidentiality and novelty. A target that cannot describe how its own information is handled tends to attract a valuation discount that is applied quietly rather than argued.
It cannot tell you whether the underlying science will work. Rigorous diligence establishes whether data are reliable, whether manufacturing is controlled, whether the regulatory pathway is viable, whether the IP position holds, and whether the team is competent and candid. Whether a novel mechanism produces clinical benefit is not answerable by document review at any level of thoroughness; only experiments resolve it.
References
- Wong CH, Siah KW, Lo AW. Estimation of clinical trial success rates and related parameters [published correction appears in Biostatistics. 2019;20(2):366]. Biostatistics. 2019;20(2):273-286. doi:10.1093/biostatistics/kxx069
- Knight FH. Risk, Uncertainty, and Profit. Boston, MA: Hart, Schaffner & Marx; 1921.
- Walker A, Hepler C. Pharma due diligence: what kills deals vs. what's negotiable. Alacrita. alacrita.com/blog/due-diligence-preparation-what-kills-deals
- Walker A, Hepler C. When probability is fiction: risk vs. uncertainty in biotech due diligence. Alacrita. alacrita.com/blog/risk-vs-uncertainty-biotech-due-diligence
Discuss your due diligence needs
Whether you are assessing an asset or preparing your own for diligence, the decision turns on what the data actually supports and where the risk sits. Contact us to scope an engagement around your asset and your transaction.