Safety Norms: Business Valuation and Due Diligence

1Purpose, scope, and safety principles

These norms apply to anyone who prepares, reviews, or supports a business valuation or due diligence engagement, including employees, contractors, and advisors working in offices, client premises, or remote settings. The scope covers equity and enterprise value estimates, specific asset values, and transaction risks found through financial, commercial, legal, tax, and operational review.

The core principles are simple: verify before relying, separate duties before money or sensitive information moves, escalate before pressure makes silence seem easier, and keep records that another competent person could follow. In this context, safety means protecting clients, counterparties, colleagues, and the firm from financial loss, legal exposure, and personal harm.

• MUST: Work only within a written engagement scope that names the client, the purpose, and the information permitted for use.
• SHOULD: Treat every management representation as unverified until source evidence supports it.
• Laws, accounting frameworks, valuation standards, and professional codes vary by jurisdiction. Verify current applicable versions with the relevant regulator, professional body, or qualified counsel.

2Roles, competence, and accountability

Every engagement needs named people for each role: an engagement lead who owns scope, conclusions, and sign-off; analysts who gather data and build models; an independent reviewer who checks the work; a data room administrator who controls access; and a compliance or privacy contact who handles conflicts, sanctions screening, and information handling. In small teams one person may hold two roles, but the same person must never prepare and approve the same output.

Competence means documented training and supervised experience for the specific task. Analysts may not issue valuation opinions, fairness conclusions, or reliance letters unless a person with the required credential or written authority signs them, as local law or firm policy requires.

• MUST: Record the engagement lead, reviewer, and data room administrator in the engagement file before any client data is accessed.
• MUST: Complete a conflicts of interest check, including ownership, family, and prior advisory links, before work starts.
• MUST NOT: Approve your own model, payment, or access request.
• SHOULD: Keep a competence matrix showing which tasks each person may perform and when supervision is required.

3Course-specific hazards and risk assessment

Valuation and due diligence work involves recurring activities: management interviews, financial statement normalization, adjustments for nonrecurring items, forecasting, discounted cash flow and market multiple analysis, asset appraisals, site visits, contract and tax review, and reporting. Typical tools include spreadsheets, valuation software, data room platforms, shared drives, email, laptops, and mobile devices. People involved include sellers, buyers, lenders, management, employees, counterparties, and external specialists. The decisions with the largest consequences are the value or price range recommended, which add-backs are accepted, how forecasts are weighted, and whether to proceed.

Risk is rated by combining likelihood and impact on a three-level scale. The engagement lead records each rating, the controls that reduce it, and a named owner. Ratings are reviewed whenever scope, counterparties, or data sources change.

• HIGH: Overstated earnings from unsupported add-backs, aggressive revenue recognition, or ignored working capital needs. Control: a normalization schedule tied to source documents.
• HIGH: Fraud or concealment, including fictitious revenue, round-tripping, related-party transactions, and undisclosed liabilities. Control: independent confirmations and red flag review.
• HIGH: Disclosure of material non-public or competitively sensitive information. Control: access restrictions and clean team rules where needed.
• MEDIUM: Spreadsheet errors, broken links, hard-coded numbers, and version confusion. Control: model review and version control.
• MEDIUM: Reliance on unverified management statements or stale forecasts. Control: written representations and sensitivity testing.
• MEDIUM: Sanctions, anti-money laundering, or anti-bribery red flags in counterparties. Control: screening before engagement and escalation.
• LOWER: Physical risks at plant visits, warehouses, or during travel. Control: site induction and host safety rules.

4Preventive controls and safe work practices

Preventive controls work best when they are built into the workflow rather than added at the end. Analysts should record each key input with its source, the document reference, and the person who obtained it. Reviewers should test a sample of entries against original records, not only check that totals add up.

Model discipline matters because a small error can materially change a price. Inputs belong on a separate sheet with labeled assumptions. Formulas should be consistent across rows, check totals should reconcile to source statements, and each scenario should show sensitivity to key assumptions.

• MUST: Tie every normalization adjustment to at least one source document and a written rationale.
• MUST: Obtain a second-person review of the model and conclusion before anything leaves the engagement team.
• MUST NOT: Hard-code numbers inside formulas, except documented constants.
• SHOULD: Reconcile reported revenue to bank deposits, tax filings, or customer records for a sample of periods.
• SHOULD: Save each version with a file name showing the engagement, purpose, and reviewer initials.
• SHOULD: Record management representations in writing and request signed confirmations where the engagement permits.
• Site visits: attend only after a briefing from the host, follow the host's protective equipment and safety rules, and leave immediately if conditions are unsafe.

5Financial control safety and fraud prevention

Advisors should never hold client funds, initiate payments, or change bank details unless a separate engagement and dual control structure has been approved in writing. Segregation of duties means the person who prepares a funds request is not the person who approves it, and the person who verifies recipient details is not the person who enters them. These separations protect the firm and prevent one person from creating or hiding a loss.

Fraud risk is not only about criminals. Pressure to close quickly, unusual revenue spikes near period end, unexplained journal entries, cash-heavy margins that do not reconcile to bank records, and sudden turnover among finance staff are warning signs that require documented follow up. Professional skepticism means testing explanations against evidence, not accepting them because they sound plausible or come from senior management.

• MUST: Require two independent approvers for any payment instruction connected to an engagement.
• MUST: Verify changed bank or payee details by calling a number obtained independently, never a number supplied in the same message.
• MUST NOT: Accept changes to payment details by email alone.
• SHOULD: Compare management accounts with statutory filings and bank statements, and document every unexplained difference.
• SHOULD: Request third-party confirmations for significant receivables, debt, and contracts where practical and lawful.
• SHOULD: Log each red flag, the test performed, and the result in the working papers.
• Report apparent fraud to the engagement lead and compliance immediately. Do not confront suspects or alter records to hide findings.

6Information, confidentiality, and regulatory safeguards

Due diligence exposes trade secrets, customer lists, pricing, employee records, health information, and personal financial details. Collect data only to the extent needed for the stated purpose. Grant access by role and review it at intervals set by the firm. Data room permissions should default to view only, with downloads disabled or logged where the platform allows, and watermarks applied to sensitive files.

Clean team arrangements may be required when a buyer and seller are competitors. Under these arrangements, only named individuals who do not make pricing or competitive decisions may see the most sensitive information. Compliance should confirm the rules before access is granted. Privacy, securities, antitrust, sanctions, and cross-border data transfer obligations are jurisdiction-dependent and must be verified with counsel.

• MUST: Use firm-managed devices with encryption, multifactor authentication, and current security patches.
• MUST NOT: Send client files to personal email, consumer cloud storage, or unapproved messaging apps.
• MUST: Redact personal identifiers that are not needed for the analysis.
• SHOULD: Review sensitive files only in private spaces, and never leave printed drafts at client premises.
• SHOULD: Use approved secure disposal for paper and storage media at the end of the retention period.

7Incident, escalation, and emergency response

An incident is any event that could cause financial loss, unauthorized disclosure, regulatory breach, misleading conclusions, or physical injury. Near misses count and must be logged, because they reveal weak controls before harm occurs. Staff should not investigate suspected fraud, data breaches, or sanctions matches alone, and should not raise the concern with suspected persons unless compliance or counsel has agreed.

Physical emergencies take priority over documentation. Call local emergency services and follow the site emergency plan. Once people are safe, preserve evidence, record times and sources, and inform the engagement lead. Where law imposes mandatory reporting duties for suspicious activity or breaches, compliance decides the route and timing, and those requirements must be verified locally.

• MUST: Report suspected fraud, misstatement, data exposure, or sanctions matches to the engagement lead and compliance on the same working day.
• MUST: Preserve original files, emails, and system logs without altering them.
• MUST NOT: Delete, rewrite, or change the timing of working papers to conceal a finding.
• SHOULD: Record near misses such as a misdirected email or an unexplained access request.
• SHOULD: Hold a short lessons learned review after each closed matter and record corrective actions with named owners.

8Records, training, monitoring, and review

Working papers must allow an independent reviewer to reproduce conclusions. They should include engagement terms, the conflicts check, the source list, model versions, review sign-offs, management representations, and reasons for significant judgments. Retention periods are set by law, professional rules, and contracts, and must be verified locally.

Training should be completed before access to client data and repeated at intervals set by the firm. It covers confidentiality, red flags, model controls, and escalation routes. Monitoring checks whether controls actually operate through access reviews, sampling of working papers, open exception counts, and overdue reviews. Findings should drive changes to procedures, and this document should be reviewed whenever law, professional standards, or firm practice changes.

• MUST: Complete required training before accessing client information.
• MUST: Retain working papers for the period required by applicable law and firm policy, then dispose of them securely.
• SHOULD: Review data room access and payment approvals at fixed intervals and after any staffing change.
• SHOULD: Track exceptions, late reviews, and escalations, and report trends to the engagement risk committee.

Implementation checklist

• Confirm written engagement scope, conflicts check, and named roles before accessing any client data.
• Tie every key valuation input and add-back to a source document and a written rationale.
• Obtain independent second-person review of models and conclusions before release.
• Verify any payment or bank detail change by independent call back.
• Restrict data room access to named, need-to-know users and log all downloads.
• Test management explanations against evidence and record every red flag.
• Report suspected fraud, breach, or sanctions matches to compliance on the same working day.
• Preserve evidence and do not alter or delete working papers.
• Confirm local laws, standards, and retention rules with qualified counsel or regulators.