vaayaa Inclusive Education
Finance risk assessment

Business Valuation and Due Diligence Risk Assessment: Forecast, Disclosure and Data Controls

A worked example of how a deal team finds, scores and controls the risks in valuing a business and testing its claims through due diligence, from forecast bias and data room gaps to hidden liabilities and adviser conflicts.

Updated November 2026 8 hazards assessed Review every 6 months Highest risk: Critical to Medium
See the Business Valuation and Due Diligence course

Executive summary

This assessment shows how a deal team can find, rate and control the risks that affect the value it places on a business and the trust it can place in the information provided. Eight risks were chosen because they are plausible in everyday valuation and due diligence work. Overstated earnings, forecast bias and undisclosed liabilities carry the highest inherent scores because they can move the price by a large amount. Each risk is scored before controls and again after existing and added controls. Most risks fall to Medium or Low once evidence checks, source access and independent searches are in place. The first actions are evidence for every add-back, a written net debt definition, limits on data room downloads and a refreshed conflicts check. The target is a teaching example, so every score illustrates method, not a real deal.

Focus area
Business valuation and due diligence
Setting
Deal team evaluating the purchase of a privately held trading business under a short due diligence window
Method
Five by five likelihood and impact risk register

Scope

This assessment covers the work of a deal team valuing a privately held trading business and testing its claims through financial, tax, legal and commercial due diligence before purchase. It looks at risks to the accuracy of value, the quality of information, confidentiality and the conduct of advisers. It does not give valuation opinions or investment advice for any real target. Jurisdiction, sector, deal size and data room systems are assumptions made for teaching.

Context

The buyer has a deal team with a transaction manager, a financial due diligence lead, a transaction accountant, a legal counsel and an information security lead. The seller provides information through a virtual data room, with management accounts, contracts and a forecast model. External advisers review financial, tax and legal matters and report to an investment committee. Each risk is scored before controls to show its natural level, then again after the existing controls and the controls that should be added.

Objectives, assets and stakeholders

The objective is to reach a supportable valuation, price the business on verified information, protect confidential data, meet legal and tax duties, and keep the trust of the investment committee, lenders and advisers. The assets in scope are the target's accounts, contracts, customer and employee data, the valuation model, the data room and the deal team's reputation. Stakeholders include the deal team, the investment committee, the sellers, the target's management and staff, lenders, insurers and the relevant tax and corporate authorities. Clear roles matter: every risk has one owner role, and the deal team manager reports progress to the investment committee at each stage.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely Likelihood 4, impact 3, score 12, high: H02 Likelihood 4, impact 4, score 16, high: H01 H04 Likelihood 4, impact 5, score 20, critical: H05
3 Possible Likelihood 3, impact 3, score 9, medium: H07 Likelihood 3, impact 4, score 12, high: H08 Likelihood 3, impact 5, score 15, high: H03
2 Unlikely Likelihood 2, impact 5, score 10, high: H06
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible Likelihood 3, impact 2, score 6, medium: H08
2 Unlikely Likelihood 2, impact 2, score 4, low: H02 H07 Likelihood 2, impact 3, score 6, medium: H01 H04 H06 Likelihood 2, impact 4, score 8, medium: H03 H05
1 Rare
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Overstated earnings and forecast bias 16 High 6 Medium Financial due diligence lead
H02 Net debt and working capital misstatement 12 High 4 Low Transaction accountant
H03 Fraud and document manipulation in the data room 15 High 8 Medium Forensic accounting lead
H04 Data room confidentiality and cyber exposure 16 High 6 Medium Information security lead
H05 Undisclosed liabilities and contingent claims 20 Critical 8 Medium Legal due diligence counsel
H06 Conflicts of interest among advisers 10 High 6 Medium Engagement partner
H07 Key person dependency and deal team overload 9 Medium 4 Low Deal team manager
H08 Counterparty, financing and deal completion risk 12 High 6 Medium Deal finance lead
H01

Overstated earnings and forecast bias

Strategic Before 16 After 6

Earnings are adjusted upward and growth forecasts rest on optimistic assumptions, so the value placed on the business is higher than its true worth.

Who or what is affected: Deal team, investment committee and lenders

Causes

Seller pressure, one-off add-backs left unchallenged and forecasts built from management hopes.

Consequences

Overpayment, failed returns, lender covenant pressure and claims under the purchase agreement.

Existing controls

  • Management accounts are compared with statutory figures each month.
  • The deal team reviews the main forecast assumptions at each stage.

Control gaps

Add-backs are accepted on management explanation without third party evidence or trend testing.

Additional controls

  • Prevent: Require evidence for every add-back and test each against prior years and peer benchmarks.
  • Detect: Compare forecast growth with the last three years of actual trading and flag any gap.
Likelihood 4 x impact 4 before; 2 x 3 after Owner: Financial due diligence lead Target: Within 30 days Early warning: An add-back that is not supported by invoices or contracts at the review date.
H02

Net debt and working capital misstatement

Operational Before 12 After 4

Debt like items, deferred revenue, overdue payables or seasonal working capital are miscounted, so the price adjustment at completion does not reflect the real cash position.

Who or what is affected: Deal team, buyer and sellers

Causes

Incomplete ledgers, cutoff errors at period end and reconciliations completed under time pressure.

Consequences

Price disputes, delayed completion, post completion claims and unexpected loss of cash.

Existing controls

  • A net debt schedule is prepared and sent to the advisers for review.
  • Bank statements are matched to ledger balances at the cutoff date.

Control gaps

The working capital target is set from a single month without seasonal testing.

Additional controls

  • Prevent: Agree a written definition of net debt and working capital before the offer is made.
  • Detect: Test cutoff on sales and payables for the weeks before the review date.
Likelihood 4 x impact 3 before; 2 x 2 after Owner: Transaction accountant Target: Within 45 days Early warning: Unreconciled balances on the debt schedule that remain open after the cutoff review.
H03

Fraud and document manipulation in the data room

Financial Before 15 After 8

Altered invoices, backdated contracts or missing documents mislead the diligence team, and small fake entries are hidden within large ledgers.

Who or what is affected: Deal team, investors and staff of the target business

Causes

Pressure to close quickly, limited access to source systems and reliance on copies supplied by the seller.

Consequences

Acquisition of a misstated business, loss of funds, litigation and damage to the buyer's reputation.

Existing controls

  • Key contracts are requested in original form from the seller's advisers.
  • Bank and customer confirmations are requested for material balances.

Control gaps

Documents are accepted as copies with no check against source systems or third party confirmations.

Additional controls

  • Prevent: Obtain direct access to source systems for a sample of transactions under agreed terms.
  • Detect: Use data analysis to find duplicate invoices, round sums and entries posted after period end.
Likelihood 3 x impact 5 before; 2 x 4 after Owner: Forensic accounting lead Target: Within 30 days Early warning: Documents supplied in edited form or with metadata that does not match the stated date.
H04

Data room confidentiality and cyber exposure

Technology and data Before 16 After 6

Commercially sensitive files are shared through weak links, copied to personal devices or opened by people outside the deal, so confidential information leaks or is stolen.

Who or what is affected: Target staff, customers, buyer and advisers

Causes

Shared links with no expiry, unmanaged downloads and phishing aimed at the deal team.

Consequences

Breach of confidentiality agreements, competitive harm, data protection claims and loss of the deal.

Existing controls

  • The data room requires a named user login and a signed confidentiality agreement.
  • Files are watermarked with the name of the recipient.

Control gaps

Access logs are not reviewed and download rights are not limited by role.

Additional controls

  • Prevent: Limit download and print rights by role and set access to expire at the end of the process.
  • Respond: Revoke access at once when a user leaves the deal and record the reason.
Likelihood 4 x impact 4 before; 2 x 3 after Owner: Information security lead Target: Within 14 days Early warning: Access from unknown devices or repeated downloads of the same folder outside working hours.
H05

Undisclosed liabilities and contingent claims

Legal and compliance Before 20 After 8

Pending lawsuits, tax exposures, warranty claims or environmental obligations are not disclosed or are understated, so the buyer inherits costs that were never priced.

Who or what is affected: Buyer, lenders, employees and insurers

Causes

Incomplete disclosure by the seller, claims held in separate teams and no independent search of court or registry records.

Consequences

Large unexpected payments, indemnity disputes, regulatory penalties and reduced value of the acquired business.

Existing controls

  • The seller gives written warranties and disclosure schedules.
  • Tax and legal advisers complete a standard review questionnaire.

Control gaps

Legal and tax reviews are scoped narrowly and no one reconciles them to the financial statements.

Additional controls

  • Prevent: Require full disclosure schedules and reconcile provisions to the reviewed balance sheet.
  • Detect: Run independent searches for claims, liens and registered charges against the target.
Likelihood 4 x impact 5 before; 2 x 4 after Owner: Legal due diligence counsel Target: Within 30 days Early warning: A disclosure schedule with few or no entries for a business with a long operating history.
H06

Conflicts of interest among advisers

Reputational Before 10 After 6

An adviser has a link to the seller, a lender or a competing bidder, and the valuation or diligence opinion is shaped by that relationship rather than by the evidence.

Who or what is affected: Buyer, investment committee and the public

Causes

Repeat work for the same sellers, referral fees and unclear rules on which parties an adviser may act for.

Consequences

Biased valuation, loss of independence, professional sanctions and reputational harm.

Existing controls

  • Advisers sign a conflicts declaration before appointment.
  • The engagement lead reviews the scope of each opinion.

Control gaps

Conflict declarations are gathered at appointment and not refreshed when new parties join the deal.

Additional controls

  • Prevent: Refresh conflict checks against every party named in the deal at each stage.
  • Respond: Replace any adviser with an undeclared link and record the reason in the deal file.
Likelihood 2 x impact 5 before; 2 x 3 after Owner: Engagement partner Target: Within 21 days Early warning: A new party to the deal that appears on an adviser's client list without a declaration.
H07

Key person dependency and deal team overload

People Before 9 After 4

A single valuation analyst holds the model, the contacts and the knowledge of the target, and when that person is absent or overloaded, errors go unchecked and deadlines slip.

Who or what is affected: Deal team, investment committee and sellers

Causes

Tight timetable, few trained staff and models kept in personal files.

Consequences

Missed deadlines, model errors, poor handover and weaker decisions.

Existing controls

  • Workstream leads report progress at a weekly meeting.
  • The main valuation model is saved in a shared folder.

Control gaps

No peer review of the model and no written handover plan for each workstream.

Additional controls

  • Prevent: Assign a second reviewer for each model and name a backup for each workstream.
  • Recover: Keep a written handover note, updated weekly, for each open workstream.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Deal team manager Target: Within 14 days Early warning: One person holding more than one critical workstream or model without a named backup.
H08

Counterparty, financing and deal completion risk

Financial Before 12 After 6

The buyer's financing falls away, a seller withdraws, or a key supplier or customer of the target fails before completion, so the deal collapses or is repriced late.

Who or what is affected: Buyer, sellers, lenders and target staff

Causes

Long timetable, reliance on one funder and key contracts with change of control terms.

Consequences

Sunk advisory costs, failed completion, forced repricing and loss of staff confidence in the target.

Existing controls

  • A funding letter is sought before exclusivity is granted.
  • Key customer contracts are reviewed for change of control clauses.

Control gaps

Funding and key contract terms are not tested against the expected completion date.

Additional controls

  • Prevent: Agree break fees, long stop dates and funding conditions in the draft purchase agreement.
  • Respond: Hold a standby list of alternative funders and update it at each deal stage.
Likelihood 3 x impact 4 before; 3 x 2 after Owner: Deal finance lead Target: Within 30 days Early warning: A funder or key counterparty that asks to delay or change terms ahead of the agreed date.

Rating method and evaluation

Each risk is rated on two five-point scales. Likelihood runs from Rare to Almost certain, and impact runs from Insignificant to Catastrophic. Multiplying the two gives a score from 1 to 25, which falls into one of four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. The score guides the order of work and is not a measurement. Inherent risk is the score before any controls. Residual risk is the score after the existing and added controls. Impact is judged on the price effect, the time to correct, the effect on the decision and harm to trust, and a financial or legal risk is never rated down only because it has not yet happened. Anything still High needs investment committee attention and a dated plan, anything Medium needs routine checks with a named owner, and anything Low is accepted and monitored. Owners challenge each other's ratings in a short review, and any rating is reopened when an indicator reaches its threshold or a new document changes the facts.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 6 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Add-backs or forecast growth rates not supported by evidence at the review date.Escalate to the financial due diligence lead at once, and to the investment committee if unresolved after 10 days.
Net debt or working capital items still unreconciled after the cutoff review.Escalate to the deal finance lead when any item is open after 10 days, and to the investment committee if the gap exceeds the agreed price tolerance.
Repeated downloads or access from unknown devices in the data room.Escalate to the information security lead within the same working day, and suspend the access until it is verified.
Disclosure schedules with no entries, or claims found in public searches that the seller did not list.Escalate to the legal due diligence counsel at once, and to the deal team manager before the next bid.
Adviser or party links not recorded in the conflicts register.Escalate to the engagement partner the same day, and to the compliance officer if the adviser is not replaced within a week.

Contingency arrangements

If a serious event occurs, such as confirmed fraud in the data room, a data breach or a funder that withdraws, the deal manager pauses the timetable and informs the investment committee. The information security lead revokes access and preserves logs. Legal counsel handles contact with the seller, regulators and insurers as the relevant jurisdiction requires. The deal finance lead reviews the price, the break terms and the standby funders, and staff at the target are told what they need to know early and plainly.

Prioritized action plan

  1. Require evidence for every add-back and reconcile forecasts to actual trading, owner financial due diligence lead, within 30 days.
  2. Agree net debt and working capital definitions in writing before the offer, owner transaction accountant, within 45 days.
  3. Limit data room download rights and revoke expired access, owner information security lead, within 14 days.
  4. Obtain direct source system sampling and independent claim searches, owner forensic accounting lead, within 30 days.
  5. Refresh adviser conflict checks against every named party, owner engagement partner, within 21 days.

Conclusion

Reliable valuations depend on a few steady habits: evidence for every adjustment, source checks on key documents, written definitions for money owed and owed to others, limits on data access and a conflicts check at every stage. The highest scores sit with earnings quality, hidden liabilities and data room risks, and each has actions that bring the residual score down. Treat the register as a living record, review it on the stated cycle, and seek qualified valuation, tax and legal advice for any real transaction.

Assumptions and limitations

Assumptions

  • The target is a privately held trading business with audited or reviewed annual accounts.
  • The deal team uses a standard data room and advisers who are independent of the seller.
  • Jurisdiction is not specified, so legal and tax duties are described in general terms only.

Limitations

  • The scores are examples for learning and do not describe any real target or transaction.
  • Valuation, tax and legal rules differ by country and change over time, so specialist review is needed.
  • This is educational content and is not financial, tax, legal or investment advice.

Related frameworks to study

  • Discounted cash flow and multiples valuation methods
  • Quality of earnings review approach
  • Three lines model of risk ownership
  • Hierarchy of controls

Finance Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Business Valuation and Due Diligence course Read the best practices for this course

More Finance risk assessments

Hourly Active: 40,745 Learners