Sell-side technical due diligence: preparing a target for sale

Sell-side technical due diligence is the buyer's review run by the seller, before the sale process starts, so that every finding a buyer would make is either fixed or disclosed by the time a buyer looks. The concept comes from financial diligence, where a seller commissions an independent report on the business and shares it with bidders. PwC's UK transaction services page describes it plainly: "When a company is up for sale, or selling off one of its parts, it needs to show an in-depth report on its financial health to potential buyers. This is called vendor due diligence." The technical version does the same for the code, the team, the infrastructure and the licences.

Reveneau runs sell-side reviews to the same template and the same scope as its buy-side reviews, and delivers two documents rather than one: the internal findings list with a repair plan, which the seller keeps, and the buyer-facing report, which discloses what remains open. The reason for two documents is that a sell-side report a buyer can trust has to say what was found and not fixed, and a seller needs a private version to decide what to fix first.

This page is written for the fund, board or owner preparing a company for exit. The founder's own page, preparing for a sale, covers the same work from inside the company. The pillar guide covers the review itself.

Why run technical due diligence on your own company before a sale?

Run it because the buyer will, and a finding the buyer makes costs more than the same finding made six months earlier. On the buyer's clock a finding becomes a price reduction, a warranty, an escrow or a walk. On the seller's clock the same finding becomes a repair with a receipt.

The financial version of the argument is well established. PwC's page lists among the benefits of vendor due diligence that it can "remove the necessity for a buyer to have substantial access to do their own due diligence work" and provide "early identification of value critical issues, providing the option to regroup and fix outside the glare of publicity". KPMG Luxembourg's sell-side guide (2025-05-15) recommends a pre-emptive vendor review because it "demonstrates transparency, creates a third-party validation" and "can help streamline the buyer's due diligence process", and advises gathering documents "well in advance of any buyer requests". Both are firms describing a service they sell, and both describe the mechanism correctly.

The technical version has an extra reason. Several of the findings that most often move a technology deal take months to repair: a single engineer who holds the core system, an open source component whose licence reaches the proprietary code, a cloud account in a founder's name, a certification named in the deck with no current report behind it. None of those can be fixed in the two weeks between a buyer's request and its report. They can be fixed in six months.

When should the sell-side review start?

The sell-side review should start six to twelve months before the company goes to market, which is the timing MEV states on its diligence page (updated 2026-08-05): "Sellers should run a pre-deal audit six to twelve months before going to market." That is one firm's advice, and the arithmetic behind it is simple: the review takes two to four weeks, the repair plan takes a month to agree, and the repairs that matter take a quarter or two.

Work backwards from the process start. Four to six weeks for the review itself, using the scope for the buyout column on scope by stage, because a buyer will use that column. Two weeks to turn the findings into a repair plan with owners and dates. Then the repairs, in severity order, with the long ones (key-person dependencies, licence replacements, account transfers) started first. Finally, a short re-check before the room opens, so the buyer-facing report describes the company as it is on the day the process starts.

A review started three months before market still helps, because disclosure is cheaper than discovery even when repair is impossible. A review started after the first buyer's request is a buy-side review with a different invoice address.

What does the sell-side review cover?

The sell-side review covers the same scope a buyer's review will, because the point is to pre-empt it, and for an exit that means the buyout scope: the five assessment areas plus open source, cloud cost, contractual commitments and account ownership.

Area	What the seller finds	What the seller can fix in six months
Team and key-person risk	Systems with a single owner; attrition in the last two years	Documentation, pairing and a second owner per critical system; retention terms for the people who matter
Code and tests	Untested critical paths; dead repositories production depends on	Tests on the paths a buyer will read first; archive or document the dormant code
Architecture and reliability	An undocumented system; an incident log that does not exist	A current diagram; an incident log kept from now on, with the past reconstructed from what can be found
Security and compliance	A stale penetration test; a certification without a current report; production access nobody has reviewed	A fresh test with remediation; renew or withdraw the claim; prune the access list
Open source and IP	Copyleft components with no approval record; missing notices; contractor code without assignment	Replace or isolate the components; add the notices; collect the assignments
Cloud and cost	Waste; commitments expiring during a likely ownership change; production in a personal account	Remove the waste; align commitment end dates with the process; transfer the accounts to the company
Commitments	Features promised to customers in writing and not built	Build them, renegotiate them, or list them for disclosure

Morgan Lewis's note of 2026-06-05 on open source in M&A diligence says the plain thing about the fifth row: "OSS scans often discover inconsistencies and issues that need to be remedied prior to the closing." A seller who runs the scan a year early remedies them before the price is set instead of before closing. Open source licence due diligence covers what the scan finds and what each finding costs.

What does the seller hand to buyers?

The seller hands buyers a report in the shape of the template, with three differences from the internal version: the fixed items appear as closed findings with the date and the evidence of the fix, the open items appear as disclosed findings with a cost, and the unverified list is replaced by a statement of what the reviewer had access to, which for a sell-side review should be everything.

Closed findings are the most valuable content in the document. A buyer who reads "the payments service had no automated tests in March; a suite covering the settlement path was added in May and runs on every merge" has been shown a repair and the process that produced it. Open findings with a cost are the second most valuable, because they set the buyer's expectation before the buyer's own reviewer sets it for them, and a disclosed problem is negotiated differently from a discovered one.

The report goes in the data room alongside the artefacts it cites, organised as the engineering data room page describes from the buyer's side. Every finding in the report should point at an artefact in the room, because a buyer's reviewer will check, and a sell-side report that survives the check is worth its cost many times over in process speed.

Does a buyer still run its own review?

Yes, a buyer still runs its own review, and a seller should expect and welcome it, because the sell-side report is worth exactly as much as its honesty about what is still open. PwC's own description of vendor due diligence includes reducing the buyer's need for substantial access, and in financial work a well-regarded vendor report does shorten the buyer's process. In technical work the buyer's reviewer will still open the repositories, still interview the engineers, and still read the invoices, and a sell-side report that matches what they find shortens the process. One that does not lengthens it and damages every other claim the seller has made.

Two habits protect the seller. First, commission the review from a firm that will not also be pitching the buyer, and say so in the report. Second, disclose everything the review found that was not fixed, at the severity the reviewer gave it. A buyer who finds a High finding the seller's report rated Medium will re-rate the whole document.

For the fund preparing an exit, the sell-side review is also the last chance to fix the things that a buyer would otherwise fix on its own account, out of the price. Technical debt across a portfolio covers how to run the same review on every holding well before any of them goes to market, which is when it is cheapest. And if the review is to be run for you, the investor page describes the engagement.