Commercial Due Diligence (2026): TAM×NRR 4-Quadrant + Stress Test

Quick answer. Commercial due diligence (CDD) tests whether the target's revenue survives the buyer's ownership. The 2026 buy-side stack uses three Peony-original frames: the CDD 4-Quadrant Buyer Posture Map (TAM growth × NRR) for go/no-go, the Customer Concentration Stress Test for the Repricing Floor Rate, and the CDD-Firm Vendor Lens for choosing Bain, L.E.K., OC&C, McKinsey, or in-house. Median public SaaS EV/revenue compressed 7.7× → 4.2× (Q3 2025 → March 2026), the HSR threshold reset to $133.9M on February 17 2026, and Bain's Global PE Report 2026 names diligence red flags + inflated seller expectations as the two top deal-completion blockers in the 2025-2026 cohort. CDD is the deal-pricing engine.

TL;DR

• Median public SaaS EV/revenue compressed from 7.7× (Q3 2025) to 4.2× (March 2026) — a 45% multiple compression that flows through every commercial diligence model.
• HSR notification threshold reset to $133.9M for 2026 (FTC, February 17 2026) — deals at $130-200M EV now route around HSR but still face state-level antitrust review when commercial overlap is high.
• Bain's Global Private Equity Report 2026 names diligence red flags and inflated seller expectations as the two top deal-completion blockers in the 2025-2026 cohort.
• The CDD 4-Quadrant Buyer Posture Map (TAM × NRR) tells the buyer in one frame whether to compound, reprice, repair, or walk — and which workstream to overweight.
• The Customer Concentration Stress Test produces a Repricing Floor Rate (RFR) — typically 8-22% of EV haircut for SaaS, 15-35% for industrials with backlog risk.
• The CDD-Firm Vendor Lens ranks Bain, L.E.K., OC&C, McKinsey, and in-house corp-dev across sector depth, primary-research speed, partner attention, and report defensibility — there is no single best provider, only best-fit per deal archetype.

This is the DD-Subtype anchor for commercial due diligence. For the M&A workstream sequence, see the M&A due diligence process guide. For the diligence question library, see the due diligence questionnaire post. For ops-level customer concentration and System 4 customer operations diligence, see operational due diligence — this CDD post handles the financial revenue-at-risk model, ODD handles the operations stress on the customer base.

What does commercial due diligence cover and how is it different from financial or operational DD?

Commercial due diligence covers six workstreams that test whether the target's forecast survives the customer base, the market, and the competition under new ownership. The six workstreams are: (1) market sizing — TAM, SAM, SOM with primary research overlay; (2) customer decision drivers — win/loss interviews and reference calls; (3) competitive positioning — share by segment, displacement risk, threat-of-substitute; (4) retention mechanics — NRR, GRR, cohort tables, churn-by-tenure; (5) customer concentration — top-decile revenue-at-risk, anchor customer renewal probability; (6) GTM efficiency — CAC payback, magic number, CSM productivity.

The cross-cluster boundary matters. Financial diligence audits the past P&L, working capital, and quality of earnings. Operational diligence audits the production engine — the eight operating systems including System 4 (Customer Operations) which covers NPS, churn, and support load at the process level. Commercial diligence is forward-looking and tests whether the revenue forecast holds. The three workstreams overlap on customer concentration — ODD owns the ops-side stress (can the support team absorb a 30% customer growth spike), while CDD owns the financial stress (what is the revenue-at-risk if the top three customers churn).

For the broader M&A workstream sequence and the LOI-to-close timeline, see the M&A due diligence process guide. For the staged document-staging logic the sell-side uses to release commercial files in tiers, see the due diligence data room checklist.

How does the CDD 4-Quadrant Buyer Posture Map work?

Frame A: The CDD 4-Quadrant Buyer Posture Map. This is Peony's proprietary commercial diligence frame and the first one a buyer should run before scoping a CDD engagement. The map plots TAM growth on the x-axis (declining vs expanding, 0% TAM CAGR as the breakpoint) against Net Revenue Retention on the y-axis (leaking vs compounding, 115% NRR as the breakpoint). The breakpoints produce four buyer postures:

Quadrant 1: "Compound and Hold" (expanding TAM, NRR ≥115%). The buyer's posture is to pay the premium and underwrite the compounding. Workstream weight: market sizing 35%, retention mechanics 35%, GTM efficiency 20%, the rest 10%. Examples: vertical SaaS in expanding logistics or fintech sub-segments, regulatory-tailwind enterprise SaaS. The 4-Quadrant Buyer Posture Map tells the buyer that in this quadrant, the commercial workstream is a confirmation exercise — the real risk is operational scaling (route to ODD).

Quadrant 2: "Re-Underwrite Pricing" (declining TAM, NRR ≥115%). The TAM is fading but the target is taking share. The buyer's posture is to pay a discount to the comps and underwrite the pricing reset — typically a 10-15% multiple haircut. Workstream weight: market sizing 25%, competitive positioning 30%, retention mechanics 25%, the rest 20%. The 4-Quadrant Buyer Posture Map flags this as the highest-skill posture — most buyers misread it as "Compound and Hold."

Quadrant 3: "Repair Retention" (expanding TAM, NRR below 105%). The market is growing but the target is leaking. Workstream weight: retention mechanics 45%, customer concentration 25%, GTM efficiency 20%, the rest 10%. The 4-Quadrant Buyer Posture Map says: pay a 15-25% discount to the comps, structure 50% of the price in escrow tied to NRR milestones, and budget a $5-12M repair-retention plan in the 100-day plan.

Quadrant 4: "Walk or Reprice 25-40%" (declining TAM, NRR below 105%). The 4-Quadrant Buyer Posture Map flags this as the most-common walk quadrant. If the buyer's debt service requires more than 2.5× EBITDA coverage, walk. If the buyer is a strategic with a clear synergy path, reprice 25-40% with a 36-month earnout. Workstream weight: customer concentration 35%, retention mechanics 30%, competitive positioning 20%, the rest 15%.

The 4-Quadrant Buyer Posture Map is the input to scoping the engagement — it tells the lead partner which CDD workstream to over-weight, which tells the CDD-Firm Vendor Lens which firm to hire. Run this frame in the first 48 hours after term sheet.

What is the Customer Concentration Stress Test and when does a deal break under it?

Frame B: The Customer Concentration Stress Test. This is Peony's second proprietary frame and the one that breaks the most deals in 2026. The Stress Test models revenue-at-risk under three loss scenarios and produces a Repricing Floor Rate (RFR) — the EBITDA multiple haircut the buyer should apply before signing.

Scenario 1: Top customer churn at renewal. Pull the top customer's contract, the renewal date, and the historical renewal probability by tenure. If the renewal is within 18 months and the customer represents ≥15% of ARR, model 100% loss. RFR contribution: (top customer ARR / target ARR) × EV multiple × 0.7 (recovery factor over 24 months).

Scenario 2: Top three customers reprice down 30%. Top-three concentration is the most-common stress driver in 2026. The Twitter / X 2022 advertiser collapse — where the top 100 advertisers paused or cut spend by 60-90% inside 12 weeks — is the canonical commercial diligence anchor for this scenario. Even where the top three are not at risk of churning, they have the leverage to reprice at renewal. Model a 30% reprice on top-three ARR. RFR contribution: 0.3 × (top-three ARR / target ARR) × EV multiple.

Scenario 3: Top decile churns over 24 months. This is the slow-bleed scenario. Pull the cohort retention table by ARR tier. If the top decile shows declining NRR by cohort vintage, model a 25-40% top-decile loss over 24 months. RFR contribution: 0.35 × (top-decile ARR / target ARR) × EV multiple × 0.5 (because half the loss is absorbed by expansion in the bottom 90%).

Sum the three contributions to get the Repricing Floor Rate. A deal breaks under the Customer Concentration Stress Test when RFR exceeds 35% of the headline price or when stressed EBITDA falls below 2.5× the buyer's debt service. The Customer Concentration Stress Test should be run before the LOI is signed — not after. WeWork's November 2023 bankruptcy is the canonical industrial-real-estate version of this stress test failing post-close: occupancy concentration by single-tenant whales unwound under recession pressure, and the post-LOI repricing never matched the operating reality.

The Customer Concentration Stress Test pairs with the ops-level diligence in operational due diligence System 4 — ODD asks whether the support team can absorb top-decile churn velocity; the CDD Stress Test asks whether the EBITDA model survives it.

Which CDD firm should I hire — Bain, L.E.K., OC&C, McKinsey, or run it in-house?

Frame C: The CDD-Firm Vendor Lens. This is Peony's third proprietary frame. It scores the five most-common CDD provider archetypes across four axes — sector depth (0-5), primary-research speed (0-5), partner attention (0-5), and report defensibility (0-5) — and maps the score against deal archetype.

Bain & Company. Sector depth: 5 (tech, consumer, healthcare, industrials). Primary-research speed: 4 (Bain Vector pool, 30-50 interviews in 3 weeks). Partner attention: 5 (partner sits the engagement for $1B+ deals). Report defensibility: 5 (board-ready, IC-ready). Best fit: $1B+ deals where the CDD report goes to the IC and the bank. Typical fee: $400K-1.2M. The CDD-Firm Vendor Lens flags Bain as the default for late-stage growth and large platform deals.

L.E.K. Consulting. Sector depth: 5 (industrials, life sciences, transport/logistics, education). Primary-research speed: 5 (L.E.K. has the deepest industrials primary-research bench). Partner attention: 4. Report defensibility: 5. Best fit: industrials, life sciences, transport, and any deal where backlog quality and re-compete risk dominate the commercial story. Typical fee: $300K-900K. The CDD-Firm Vendor Lens flags L.E.K. as the default for $200M-2B industrials and life sciences platforms.

OC&C Strategy Consultants. Sector depth: 5 (consumer, retail, media, leisure). Primary-research speed: 5 (OC&C runs the deepest consumer panels). Partner attention: 4. Report defensibility: 4. Best fit: consumer, retail, media, leisure, branded products. Typical fee: $250K-700K. The CDD-Firm Vendor Lens flags OC&C as the default for consumer / retail brands and DTC platforms.

McKinsey & Company. Sector depth: 5 (cross-sector but uneven on niche segments). Primary-research speed: 3 (slower than the boutiques on speed-to-deliver). Partner attention: 3 (partner attention varies by office). Report defensibility: 5 (the McKinsey logo carries weight with the IC). Best fit: cross-border carve-outs, sovereign-fund LPs, and deals where the CDD is part of a broader strategy engagement. Typical fee: $500K-1.5M.

In-house corp-dev plus outside expert network. Sector depth: variable. Primary-research speed: 5 (Tegus, AlphaSights, GLG — expert calls in 24-72 hours). Partner attention: not applicable (the head of corp-dev is the partner). Report defensibility: 3 (less defensible than a Bain logo when the deal is contested). Best fit: tuck-ins under $250M EV where speed matters more than report defensibility. Typical cost: $40K-150K (expert-network panel plus internal time). The CDD-Firm Vendor Lens flags this as the default for serial acquirers running 6-12+ tuck-ins per year.

The CDD-Firm Vendor Lens is the third leg of the proprietary stack: the 4-Quadrant Buyer Posture Map sets the workstream weight, the Customer Concentration Stress Test sets the floor on price, and the CDD-Firm Vendor Lens sets the vendor.

How do I run CDD on a SaaS target and what NRR signals matter?

SaaS CDD lives or dies on net revenue retention. The 2026 buy-side standard is to demand cohort tables back to inception, monthly NRR on a rolling 24-month basis, and a CSM-productivity table showing ARR managed per CSM and gross retention by CSM tier.

The signals that matter, ranked by buy-side weight:

Net revenue retention by cohort. NRR should be measured by quarterly or annual cohort, not aggregate. A target with 112% aggregate NRR but a declining cohort vintage line (recent cohorts retaining at lower rates than older ones) is showing acquisition mix shift — newer customers are smaller, lower-quality, or in worse segments. The 4-Quadrant Buyer Posture Map shifts toward "Repair Retention" the moment cohort vintage declines.

Logo retention vs net revenue retention. Logo retention measures customer count; NRR measures dollars. A SaaS target with 78% logo retention but 118% NRR is concentrated — a few big accounts are masking small-customer churn. Demand the customer concentration analysis (route to Frame B).

Expansion motion mechanics. Expansion comes from three places: seats, modules / SKUs, and usage. The 2026 buy-side playbook demands a decomposition of NRR into churn (negative), downsell (negative), and expansion split by seats / modules / usage. Klarna's September 2025 IPO disclosures re-set the standard on expansion-mix disclosure for fintech / consumer-credit platforms — buyers now expect equivalent disclosure on SaaS targets.

Concentration by vertical. A vertical SaaS target should show ARR by NAICS code or industry. If 40% of ARR sits in a single vertical and that vertical is in declining TAM (Quadrant 2 or 4), reprice. Vertical SaaS in expanding TAM verticals is the highest-value quadrant in 2026 — the 7.7× to 4.2× SaaS multiple compression spared none, but vertical SaaS with NRR ≥115% retained the lowest multiple decay.

CSM productivity and gross retention by CSM tier. ARR managed per CSM ranges from $1.2M (SMB) to $8M (enterprise). Gross retention by CSM tier surfaces operational risk — if the top CSM tier retains at 96% and the bottom retains at 78%, the buyer is underwriting a CSM-retention risk (route to ODD System 4).

For the broader SaaS data room and the seller-side document staging, see SaaS M&A data room 2026 for the file structure and the buyer-side review patterns.

How does CDD evaluate industrials and aerospace / defense backlog quality?

Industrials and aerospace / defense CDD inverts the SaaS playbook. The forecast lives in the backlog, not the recurring revenue line. Four tests dominate:

Book-to-bill ratio rolling 24 months. A book-to-bill above 1.0 means orders are coming in faster than they are being delivered — backlog is growing. Below 1.0 means backlog is shrinking. The 2026 buy-side playbook demands the book-to-bill curve by segment, not aggregate.

Cancellation rate by program. A target's $2B backlog with a 40% historical cancellation rate is functionally a $1.2B defensible backlog. Pull the cancellation rate by program and apply it to the named backlog before underwriting the forecast.

Re-compete exposure for government contracts. For defense and federal-civil targets, the re-compete schedule is the single most important variable. LPTA (Lowest Price Technically Acceptable) contracts re-compete on price every 3-5 years; IDIQ (Indefinite Delivery / Indefinite Quantity) contracts have task-order recompetes inside the master vehicle. A target with 60% LPTA exposure within 18 months has a brittle backlog. Re-compete loss rates run 20-35% on LPTA, 10-20% on IDIQ in 2025-2026.

Backlog-to-EBITDA conversion rate. The historical conversion rate of $1 of backlog to $X of EBITDA tells the buyer what the forecast really means. A target with $2B backlog converting at $0.08 of EBITDA per dollar of backlog yields $160M of forecastable EBITDA — not the unrealistic $200M+ the seller's model claims.

The Customer Concentration Stress Test adapts here: replace "top customer churn" with "top program cancellation" and "top three reprice 30%" with "top three programs re-compete and lose 25%."

What goes in the commercial data room and how should sell-side stage it?

The commercial data room follows the sell-side staging logic detailed in the due diligence data room checklist, with three commercial-specific tiers:

Tier 1 — teaser plus market sizing one-pager. Released pre-NDA. Includes: market size (TAM/SAM/SOM with sources), growth driver narrative, competitive landscape one-pager, top-line ARR or revenue history. No customer names, no cohort tables.

Tier 2 — post-NDA, pre-LOI. Released after NDA acceptance. Includes: cohort retention tables (logos redacted), top 25 customer revenue table with logos redacted as "Customer A, Customer B," win/loss summary, ARR by vertical, CSM productivity table. Gate via visitor groups so the buyer's CDD partner sees Tier 2 files but the buyer's internal corp-dev junior associate sees only Tier 1 plus the win/loss summary.

Tier 3 — post-LOI / IOI. Released after a signed indication. Includes: named top 25 customers with contract files, top 25 customer master service agreements, the reference call list, segment-level pricing tables, and the CSM productivity table by named CSM. Watermark every file with Peony's dynamic watermarks so the source of any leaked file is provable, and use screenshot protection plus leak protection for the top-25 customer files.

The sell-side should use page analytics to see which buyer's CDD partner spent 40 minutes on the cohort tables and which buyer's intern did the 5-minute drive-by. This tells the banker which buyer is doing real commercial diligence — a powerful signal for round-two seller selection.

For Q&A management between buyer's CDD partner and the sell-side team, use Smart Q&A to route commercial questions to the right answerer and maintain the audit trail.

Why Peony for CDD-grade data rooms. Peony Business at $40/admin/month bundles the full CDD workflow — NDA gates → visitor groups tiering → dynamic watermarks → page analytics → Smart Q&A → AI extraction — at a flat per-admin rate, not the per-room or per-deal-closure fees that legacy VDRs charge $25K-$100K per transaction. AI auto-indexing and Smart Q&A are built in on Business, not bolted on as a paid add-on the way Datasite, Intralinks, and Ideals price them. For a strategic acquirer running 6-12 tuck-ins per year, the Peony Pro ($20/admin/month) plus Business ladder replaces $150K-$1M of annualized VDR spend with a transparent flat rate that scales with the corp-dev team, not with the deal pipeline.

For the broader file structure and ordering, see the due diligence data room checklist. For the question library that drives Tier 2 and Tier 3 file requests, see the due diligence questionnaire.

How do I model pricing and retention upside in the 100-day plan?

The post-close commercial 100-day plan has three pricing levers and one retention lever — each one must be modeled with a defended floor case before close, not after.

Lever 1: Repricing Floor Rate (RFR) baseline lift. Across all customers below the median ARR-per-seat (or ARR-per-account for non-seat SaaS), implement a 6-12% baseline lift at next renewal. The lift is justified by competitive comps and shielded from churn risk by the price-elasticity test (run during CDD on the 4-Quadrant Buyer Posture Map). The 2025-2026 SaaS pricing literature — OpenView Partners' SaaS pricing surveys, Simon-Kucher pricing benchmarks — confirms 6-12% as the floor uplift range with negligible churn impact below 10%.

Lever 2: Packaging restructure to move 20-30% of customers up-tier. Re-package the product line to introduce a "growth" tier between current "standard" and "enterprise." 20-30% of customers self-migrate over 18 months. The 2025 SaaS playbook from a16z and Bessemer confirms this is the highest-leverage commercial 100-day move for vertical SaaS targets.

Lever 3: Value-based pricing on net-new logos. Move new-logo pricing from per-seat to value-based (per-transaction, per-workflow, per-outcome) for the top vertical. Expect 30-50% revenue uplift on net-new logos with no impact on the existing book.

Retention bonus pool sizing. Fund a retention bonus pool sized at 1.5-3.0% of acquired ARR, drawn from the escrow, to retain the top 10 sellers, top 10 CSMs, and top 5 product leaders for 18 months. The 2025-2026 retention-bonus literature (Heidrick & Struggles 2025 retention compensation study; the Anthropic / OpenAI / Microsoft retention-bonus disclosures that re-set the AI talent floor) confirms 1.5-3.0% as the floor; for AI-heavy commercial teams in 2026, the floor is 3-5%.

The 100-day commercial plan should be drafted in the final two weeks of diligence (not after close) and the retention bonus pool should be reserved in the SPA before sign. See the due diligence cost breakdown for the all-in cost framing including the retention-bonus reserve.

What are the most-cited commercial diligence repricing precedents I should know?

Ten deal anchors define the 2025-2026 commercial diligence repricing pattern. Each anchor cites a different pattern.

1. Twitter / X advertiser collapse — October 2022. Roughly half of Twitter's top 100 advertisers paused or sharply cut spend within weeks of the Musk acquisition (Media Matters tracking, November 2022). The canonical anchor for advertiser-concentration risk in consumer-platform deals. Fidelity's Blue Chip Growth Fund marked down its stake by 56% in November 2022 alone, and serial markdowns took the cumulative reset to roughly 71% by the January 2024 disclosure (implying a ~$12-13B mark against the $44B purchase). Lesson: when the top-100 customer pool can coordinate behavior, the Customer Concentration Stress Test must model coordinated loss, not random loss.

2. WeWork bankruptcy — November 2023. Real-estate occupancy concentration by single-tenant whales unwound under recession pressure. The canonical anchor for industrial / real-estate single-customer concentration. Lesson: long-dated contractual revenue is not durable if the underlying customer business model is fragile (route to ODD System 7 Risk for the operations stress).

3. Adobe-Figma walk — December 2023. $20B announced acquisition terminated under EU competition pressure. The canonical anchor for commercial-overlap-driven antitrust risk. Lesson: when commercial diligence shows >30% revenue overlap in a closely-watched segment, the antitrust workstream is the deal-pricing engine, not the legal sidebar.

4. Stability AI rescue — June 25, 2024. $80M recapitalization round led by an investor group (Greycroft, Coatue, Sound Ventures, Lightspeed, Sean Parker, Eric Schmidt, Prem Akkaraju) after the commercial reset of the prior management's enterprise sales pipeline; Sean Parker joined as Executive Chairman, Prem Akkaraju as CEO. The deal also forgave ~$100M of debt and released the company from ~$300M of cloud-infra obligations. The canonical anchor for AI / generative-platform commercial reset. Lesson: commercial diligence on AI targets must test the customer base under the AI diligence frame separately — commercial mechanics interact with AI-specific risk (model licensing, training data exposure).

5. Klarna IPO — September 2025. The September 2025 Klarna IPO disclosures re-set the consumer-credit retention-disclosure standard. Buyers now expect equivalent expansion-mix decomposition on SaaS targets. Lesson: regulatory and IPO disclosure events re-set the buy-side disclosure standard, even for private commercial diligence.

6. HSR threshold reset — February 17, 2026. The FTC reset the HSR notification threshold to $133.9M effective February 17, 2026 (FTC press release). Deals at $130-200M EV with high commercial overlap now route around HSR but still face state-level antitrust review. Lesson: the HSR threshold is not a commercial-overlap safe harbor.

7. SaaS multiple compression — Q3 2025 to March 2026. Median public SaaS EV/revenue compressed from 7.7× to 4.2× (Meritech, Jamin Ball public-comps trackers). A 45% multiple compression that flows through every CDD model. Lesson: rebase the comps every quarter — a CDD report priced off Q1 2025 comps will overpay 30-50% in Q1 2026.

8. Industrials backlog re-disclosure — 2025. The 2025 industrials earnings cycle saw backlog re-disclosure (book-to-bill by segment, cancellation rate, re-compete exposure) become the new standard for public-company industrial M&A. Lesson: industrial CDD must demand the four-test backlog stress (book-to-bill, cancellation, re-compete, conversion).

9. Fintech multiple compression — 2024-2025. Fintech EV/revenue across public comps trended materially lower across 2024-2025, with payment networks compressing harder than vertical-fintech software (per Aventis Advisors 2025 fintech tracker). Bain's Global PE Report 2026 names fintech among the most-compressed sectors. Lesson: sector-specific compression overlays on the SaaS-wide compression — CDD comps must be sector-rebased every quarter, not pulled from a broad-SaaS multiple table.

10. Retention-bonus floor — 2025-2026. The 2025-2026 retention-bonus literature converged on 1.5-3.0% of acquired ARR as the floor, with 3-5% for AI-heavy commercial teams. Heidrick & Struggles' 2025 study, the Anthropic / OpenAI / Microsoft AI retention disclosures, and the SaaS-talent compensation surveys all confirmed this band. Lesson: the retention-bonus reserve must be modeled in the SPA, not negotiated after close.

For deeper investor-side deal precedents and the precedent-tracking pattern across AI, IP, and operational diligence, see the investment due diligence checklist and the startup due diligence guide.

How do AI-assisted CDD tools change the workstream in 2026 and what's the audit-trail rule?

AI-assisted CDD accelerates three workstreams without replacing the analyst: contract clause extraction, win/loss interview synthesis, and cohort retention pattern matching.

Contract clause extraction. The top 25 customer master service agreements are the highest-value file set in the Tier 3 commercial data room. AI extraction pulls renewal dates, auto-renew terms, exit clauses, change-of-control provisions, MFN clauses, and pricing protections. The 2026 buy-side standard: every extracted clause must cite the source document, page, and line range. Use Peony's AI extraction for the source-cited extraction layer — buyer counsel will not accept a redacted AI summary without the citation.

Win/loss interview synthesis. AI synthesis converts 30-50 raw win/loss interview transcripts into a thematic pattern map in hours instead of days. The synthesis must surface dissenting evidence (the win/loss patterns that contradict the seller's narrative), not just the confirmatory pattern. Most AI synthesis tools default to confirmation bias — the CDD analyst's job is to force dissent.

Cohort retention pattern matching. AI pattern matching compares the target's cohort retention curves against industry benchmarks at the same growth stage and vertical. The 2026 pattern-matching benchmark sets include OpenView SaaS benchmarks, Meritech public SaaS comps, and Bessemer's vertical SaaS retention curves.

The audit-trail rule is non-negotiable: every AI-extracted claim in the CDD report must cite the source document, page, and line range. Buyer counsel reviews the CDD report at IC and will challenge any uncited AI claim. The AI due diligence 5-Layer Audit also tests the AI-target's own claims through this same source-cited lens — the audit-trail rule applies both to using AI in CDD and to diligencing AI inside the target.

For staging the AI-extracted artifacts in the data room with full source citation back to the underlying file, see auto-indexing and redaction on Peony — the redaction layer is the final pre-share gate for AI-extracted artifacts that may carry sensitive metadata.

What does it cost and what's the timeline for a typical CDD engagement?

The CDD-Firm Vendor Lens gives a fee range; the timeline matters as much as the fee. A Bain or L.E.K. engagement on a $300-800M EV target runs 5-7 weeks from kick-off to final deliverable. Typical milestones:

• Week 1: kick-off, hypothesis tree, interview list, primary-research panel build.
• Weeks 2-3: 30-50 customer / competitor / expert interviews, market sizing draft.
• Weeks 3-4: cohort and concentration analysis from the data room files.
• Weeks 4-5: synthesis, deliverable draft, IC pre-read.
• Weeks 5-6: final deliverable, partner-led IC presentation.

In-house corp-dev plus an expert-network panel can compress this to 2-3 weeks for tuck-ins, with the trade-off of report defensibility. For the all-in cost framing including data room hosting, expert-network fees, and in-house time, see the due diligence cost breakdown.

The 2025-2026 trend is toward parallel scoping: the CDD-Firm Vendor Lens is run by the deal partner in week 0 (before kick-off), the 4-Quadrant Buyer Posture Map is run in week 1 with the engagement team, and the Customer Concentration Stress Test is locked by week 3 — because the Stress Test result drives the rest of the workstream weight.

Related resources

• M&A due diligence process guide — the hub-canonical M&A workstream sequence and LOI-to-close timeline
• AI due diligence — the DD-Subtype sibling for AI-using targets and the 5-Layer AI Target Audit
• Operational due diligence — the eight operating systems including System 4 (Customer Operations) for ops-side customer concentration
• Due diligence questionnaire — the question library for buyer-side CDD requests in Tier 2 and Tier 3
• Due diligence data room checklist — the staging logic for the three-tier commercial data room
• Due diligence cost breakdown — the all-in cost framing including CDD-firm fees, expert-network costs, and retention reserves
• Investment due diligence checklist — the investor-side overlay for fund-of-fund and LP commercial diligence
• Startup due diligence guide — the seed-to-Series-C commercial diligence variant
• SaaS M&A data room 2026 — the SaaS-specific data room file structure and buyer-side review patterns
• Oil and gas JV due diligence data room — the heavy-industrials JV variant with backlog and partner-concentration stress

Frequently asked questions

What does commercial due diligence cover and how is it different from financial or operational DD?

Commercial due diligence (CDD) tests whether the target's revenue can be defended and grown under the buyer's ownership. It covers six workstreams: market sizing (TAM/SAM/SOM), customer decision drivers, competitive positioning, retention mechanics (NRR/GRR/churn cohorts), customer concentration stress testing, and GTM efficiency. Unlike financial DD (which audits the past P&L) or operational DD (which audits the production engine), CDD is forward-looking and tests whether the forecast survives the customer base, the market, and the competition.

How does the CDD 4-Quadrant Buyer Posture Map work?

The CDD 4-Quadrant Buyer Posture Map plots TAM growth (x-axis, declining vs expanding) against Net Revenue Retention (y-axis, leaking vs compounding). It produces four buyer postures: "Compound and Hold" (expanding TAM, NRR ≥115%), "Re-Underwrite Pricing" (declining TAM, NRR ≥115%), "Repair Retention" (expanding TAM, NRR below 105%), and "Walk or Reprice 25-40%" (declining TAM, NRR below 105%). The quadrant tells the buyer whether to pay the premium, demand a discount, or walk.

What is the Customer Concentration Stress Test and when does a deal break under it?

The Customer Concentration Stress Test models revenue-at-risk under three loss scenarios: (1) top customer churn at renewal, (2) top three customers reprice down 30%, (3) top decile churns over 24 months. Each scenario produces a Repricing Floor Rate (RFR) — the EBITDA multiple haircut the buyer should apply. A deal breaks when stressed EBITDA falls below 2.5× the buyer's debt service or when RFR exceeds 35% of the headline price.

Which CDD firm should I hire — Bain, L.E.K., OC&C, McKinsey, or run it in-house?

The CDD-Firm Vendor Lens scores five vendor archetypes across four axes: sector depth, primary-research speed, partner attention, and report defensibility. Bain wins on partner attention for $1B+ deals. L.E.K. wins on industrials and life sciences sector depth. OC&C wins on consumer / retail. McKinsey wins on cross-border carve-outs. In-house corp-dev plus a $40-150K outside expert network wins for tuck-ins under $250M EV where speed matters more than report defensibility.

How do I run CDD on a SaaS target and what NRR signals matter?

For SaaS targets, CDD focuses on net revenue retention by cohort, logo retention by cohort, expansion motion mechanics (seats, modules, usage), and concentration-by-vertical. Buyers should demand cohort tables back to inception, monthly NRR rolling 24 months, and a CSM productivity table (ARR managed per CSM, gross retention by CSM tier). NRR below 105% on a growth target is a Repair Retention or Walk-or-Reprice signal under the 4-Quadrant Map.

How does CDD evaluate industrials and aerospace / defense backlog quality?

Backlog quality CDD tests four dimensions: (1) book-to-bill ratio rolling 24 months, (2) cancellation rate by program, (3) re-compete exposure for government contracts (LPTA vs IDIQ), and (4) backlog-to-EBITDA conversion rate. A target with a $2B backlog but a 40% historical cancellation rate and 60% LPTA re-compete exposure within 18 months is functionally a $700M defensible backlog. Stress test it before underwriting the forecast.

What goes in the commercial data room and how should sell-side stage it?

The sell-side commercial data room should stage in three tiers: Tier 1 (teaser plus market sizing one-pager), Tier 2 post-NDA (cohort retention tables, top 25 customer revenue table with logos redacted, win/loss summary), Tier 3 post-LOI (named top 25 customers, contract files, reference call list). Use Peony's visitor groups to gate the three tiers and page analytics to see which buyer's CDD partner spent 40 minutes on the cohort tables versus the 5-minute drive-by.

How do I model pricing and retention upside in the 100-day plan?

The post-close commercial 100-day plan has three pricing levers: (1) Repricing Floor Rate (RFR) baseline lift across all customers below the median ARR-per-seat, (2) packaging restructure to move 20-30% of customers to a higher tier, (3) retention bonus pool sized at 1.5-3.0% of acquired ARR funded by escrow to retain top 10 sellers and CSMs for 18 months. Each lever should be modeled with a defended floor case before close.

What are the most-cited commercial diligence repricing precedents I should know?

Ten deal anchors define current CDD repricing patterns: Twitter / X 2022 (advertiser concentration collapse, 56% Fidelity markdown in Q4 2022 escalating to ~71% cumulative reset by January 2024), WeWork November 2023 bankruptcy (occupancy concentration), Adobe-Figma December 2023 walk ($20B → termination), Stability AI June 2024 recap ($80M round, Sean Parker as Executive Chairman, Prem Akkaraju as CEO), Klarna September 2025 IPO (retention re-disclosure), HSR February 2026 threshold reset to $133.9M, SaaS multiple compression Q3 2025-March 2026, industrials backlog re-disclosure pattern 2025, fintech compression 2025, and the 2025-2026 retention-bonus literature consensus around 1.5-3.0% of acquired ARR.

How do AI-assisted CDD tools change the workstream in 2026 and what's the audit-trail rule?

AI-assisted CDD tools accelerate three workstreams: contract clause extraction from the top 25 customer master agreements, win/loss interview synthesis from raw transcripts, and cohort retention pattern matching against industry benchmarks. The audit-trail rule: every AI-extracted claim in the CDD report must cite the source document, page, and line range — buyer counsel will not accept a redacted AI summary without the underlying citation. Use Peony's AI extraction for the source-cited extraction layer.