Turning the diligence report into the first-year plan

A diligence report becomes a first-year plan when every finding in it has been turned into a task with an owner, a date, a cost and a measure of done, and the tasks have been sequenced by their risk to the investment case. Nothing else about the conversion is hard. What goes wrong is that the report is filed as a record of the deal and the findings are rediscovered a year later as incidents.

This page assumes the report exists and is readable. If it does not, the diligence guide's page on report structure and template describes what a usable report contains, and the technical due diligence guide describes how the review that produces it is run.

What does a diligence finding look like as a plan item?

A finding becomes a plan item when four fields are filled in. The table shows the conversion for the five finding types that appear in most reports.

Finding in the report	Owner	Cost (engineer-weeks)	Measure of done
Shared production credentials, no two-factor authentication on admin accounts	Engineering lead	1 to 2	Every production credential rotated; two-factor enforced on every admin account; access log reviewed by the operating partner
Backups exist, restore never tested	Engineering lead	1	A restore into a clean environment completed and timed, with the date recorded
One engineer holds the deployment process and the infrastructure knowledge	CEO with engineering lead	2 to 4	A second person has deployed to production unaided; the runbook is written and used for that deployment
GPL-licensed dependency in a proprietary product	Engineering lead with counsel	1 to 6 depending on the dependency	The dependency replaced or the licence obligation met, confirmed by a re-run of the licence scan
No automated tests on the billing module	Engineering lead	4 to 8	An evaluation suite written from the billing specification, passing, and run on every change

The cost column is filled in by the engineering lead, since the plan needs the company's estimate rather than the reviewer's. The measure column is the part most often skipped, and it is the one the board reads.

Reveneau asks for exactly this table when it takes on a first-year plan for a portfolio company, and writes an evaluation suite for each row before changing code, because the evaluation is the measure of done and the fund can run it without reading the code. The pillar guide to technology after the deal describes where the plan sits among the four phases of post-deal work.

How should the findings be sequenced?

Sequence by risk to the investment case, and ignore the severity labels in the report for the first pass. A reviewer labels severity by technical judgement. An operating partner sequences by what could lose the company, cost the company its next customer, or block the growth the deal needs.

That produces three tiers, in a fixed order:

1. Findings that can lose the company. Production access, untested backups, a single person who holds the keys, and licence exposure that could force a product off the market. These are first regardless of the severity label, and the 100-day workstream closes or dates them inside the first 30 days.
2. Findings that block the investment case. If the value creation plan needs the product to serve ten times the customers, the architecture findings about scaling go here. If it needs an add-on integrated, the data model findings go here. The diligence guide's page on assessing architecture and scalability explains what those findings usually say.
3. Everything else. Code quality, documentation, test coverage outside the critical modules, and the long tail of minor findings. These are real and they are scheduled, and they do not go ahead of tier one or two.

The reason for the fixed order is the arithmetic of the hold. Bain & Company's press release of 23 February 2026 for its Global Private Equity Report says holding periods at exit for buyout funds now sit at seven years, and that a typical deal needs 10 to 12 percent average annual EBITDA growth to generate the same 2.5x return that once needed 5 percent. The first-year plan has to leave room for the builds that produce that growth. A findings backlog that consumes the entire first year has been sequenced by the reviewer's labels rather than by the deal.

How much of the first year should the findings take?

The findings should take the share of the year that the tier-one and tier-two items cost, and no more. Tier three is scheduled across the hold at a fixed share of capacity.

The mechanism is a capacity split. Decide what share of each quarter's engineering capacity goes to the findings backlog and what share goes to the builds in the value creation plan, write it down, and report against it. A common failure is a plan that allocates all capacity to the builds and treats the findings as something the team does in spare time, which is time that does not exist. The opposite failure allocates the whole team to remediation and produces a cleaner codebase with no new revenue.

Stripe's Developer Coefficient survey of September 2018, which surveyed developers and executives across six countries, measured a mean developer week of 41.1 hours, with 17.3 hours going to maintenance work such as debugging and refactoring and 13.5 of those attributed to technical debt. A team with an unaddressed findings backlog is already paying that share of the week; the plan makes the payment visible and directs it.

Who owns each item, and what does the board see?

Each item is owned by one named person, and the board sees the plan as a table with a status per row.

Ownership by role fails because roles change and nobody is accountable for a row assigned to "engineering". Ownership by name means the row has a person who reports on it. When the person leaves, the row is reassigned on the day they leave, which is also the moment the key-person findings from the report become live again.

The board view is the same table with two columns added: status (done, on track, late) and the measure of done, so a director can ask "show me" on any row. The quarterly report format carries the same table forward with the four delivery measures beside it.

BCG's survey of 100 senior private equity investors, published 7 January 2026, found that 82 percent of firms track return on investment from digital initiatives and only 11 percent explicitly link digital progress to exit narratives. A findings table that is scored at day 0 and re-scored at each year end, with the same method, is the link. At exit, the buyer's diligence will produce its own report, and the difference between the two is the story.

What if the report is missing or too thin to use?

If the report is missing or thin, run a short review before writing the plan, and scope it to the four tier-one questions.

Some deals close on a diligence report that is a page of bullets, and some venture rounds close on none. The plan still needs the findings, and a two-week review focused on production access, backups, key-person risk and licence exposure produces them. The diligence guide's checklist is the question list, and the full method is described in how to run technical due diligence. The scope by stage page says how deep the review needs to go for the size of the company.

Running the review after closing is late, and it is far better than running the first year on assumptions. The thing to avoid is the plan that says "assess the codebase" as its first item, which delays every real decision by a quarter.

What does a finished first-year plan contain?

A finished first-year plan contains five things, and the operating partner can check each one in a minute:

• Every finding from the report as one row, with owner, date, cost and measure of done.
• The rows sequenced in three tiers, with tier one closed or dated inside the first 30 days.
• A capacity split per quarter between the findings backlog and the value creation builds, written down.
• A score at day 0, by the same method the fund will use at each year end and at exit.
• The first quarterly report drafted from the table, in the format every later report will use.

A plan with those five parts is a plan a board can hold a company to. If you want it written and delivered rather than described, building with investors and their portfolio companies is how we take that on: a fixed scope from the table above, an evaluation suite per row before the code, and a small team because the code is written by AI, with the saving passed into the price.