What Is a Due Diligence Questionnaire (DDQ)? Types, Sections & Best Practices

Many institutional transactions and counterparty reviews use a due diligence questionnaire to structure the information-gathering process. In an M&A acquisition, fund commitment, or vendor engagement, a DDQ may be used to collect and evaluate information before a transaction or relationship proceeds.

Problems arise when teams use a questionnaire designed for a different type of review. A private equity DDQ may be inappropriate for vendor diligence, while a full M&A due diligence questionnaire may be disproportionate for an early-stage financing. In both cases, a poorly calibrated questionnaire can create unnecessary work and slow the review.

A due diligence questionnaire is a structured set of written questions used by a buyer, investor, procurement team, or other reviewing party to collect facts, explanations, and supporting evidence from a counterparty.

This guide covers five common DDQ types, the core sections that appear across questionnaires, and how to calibrate the process to the transaction or review at hand, whether you’re issuing the DDQ or responding to it.

Key Takeaways

• A due diligence questionnaire typically requests written answers and supporting evidence, while a checklist primarily identifies documents or information to provide.
• Five common DDQ categories covered here are M&A, LP-to-GP/private equity, vendor, hedge fund, and VC-to-startup questionnaires. Each differs in scope, sender, receiver, and level of detail.
• ILPA and AIMA publish widely used standardized DDQ frameworks for private markets and alternative investment managers.
• Questionnaire depth should reflect the transaction size, risk profile, and stage of review. A targeted red-flag review should be materially narrower than a full-scope DDQ.
• A DDQ and a virtual data room can operate as a coordinated workflow: answers that rely on documentary evidence can link directly to the relevant supporting materials.

What Is a Due Diligence Questionnaire?

A due diligence questionnaire is a structured set of written questions sent by a buyer, investor, procurement team, or other reviewing party to a counterparty. Its purpose is to collect facts, explanations, and supporting evidence before committing capital, signing a contract, or completing a transaction.

Three distinctions are particularly important.

• A DDQ typically asks for written responses and, where relevant, supporting evidence. A checklist primarily identifies documents or information to provide. For example, “Provide your audited financial statements for the last three years” is a document request. “Describe any material changes to your revenue recognition policy and explain their financial impact” is a DDQ question.
• A DDQ is not a request for proposal. An RFP is generally used to solicit and compare proposals from potential vendors or service providers. A DDQ is primarily an information-gathering and risk-assessment tool.
• A DDQ supports the diligence process but does not replace independent verification. Self-reported responses may need to be corroborated through documents, third-party sources, specialist review, or other diligence procedures.

In practice, a due diligence questionnaire consists of due diligence questions organized by relevant workstreams, such as legal, financial, operational, and technology, rather than an unstructured list of requests.

DDQ vs. Due Diligence Checklist: Key Difference

The distinction between a DDQ and a checklist is important because the two serve related but different purposes.

A checklist might state: “Provide your audited financial statements for the last three years.” A due diligence questionnaire might ask: “Describe any material changes to your revenue recognition policy and explain their financial impact.” The first primarily requests evidence; the second requires explanation and may also require supporting documentation.

In practice, teams often use both together. A checklist helps populate a data room, such as Ideals VDR, with the required documents, while the DDQ provides context and explanations to help reviewers interpret the evidence.

Without a DDQ, reviewers may receive documents without sufficient context. Without a checklist or structured document request, responses may lack supporting evidence. This is the practical distinction between the keyword and the due diligence questionnaire checklist: the two tools complement each other, but they are not interchangeable.

The Five Main Types of Due Diligence Questionnaires

The following are five common DDQ categories. Their scope varies depending on the transaction, regulatory environment, risk profile, and parties involved.

M&A Due Diligence Questionnaire

An M&A questionnaire is generally sent by an acquirer, its advisers, or another reviewing party to the target during the diligence process. Timing varies: detailed diligence may begin before or after an LOI, depending on the structure of the transaction.

• It can cover corporate organization, financial matters, material contracts, intellectual property, regulatory compliance, litigation, employment, tax, cybersecurity, and other relevant workstreams.
• An M&A due diligence questionnaire prepared for a complex transaction may be extensive, but the appropriate scope depends on transaction size, industry, risk, and deal stage.
• Smaller or preliminary transactions generally benefit from a more focused questionnaire rather than an unnecessary volume of questions.

LP-to-GP / Private Equity Due Diligence Questionnaire

This type of DDQ is used by prospective limited partners, such as pension funds, endowments, insurers, sovereign investors, and family offices, when evaluating a fund manager before committing.     

• The ILPA Due Diligence Questionnaire 2.0 is a widely used standardized framework for LP diligence of private market managers. ILPA states that the current DDQ was last comprehensively updated in 2021.
• A private equity due diligence questionnaire can cover fund strategy, investment process, team and track record, governance, ESG considerations, operations, service providers, cybersecurity, and alignment of interests.
• ILPA updated its DDQ alongside a separate Diversity Metrics Template and expanded the questionnaire’s ESG and DEI-related content.

Vendor Due Diligence Questionnaire

A vendor due diligence questionnaire is used by organizations evaluating technology vendors, service providers, outsourcing partners, and other third parties.

• It commonly addresses information security, data protection, operational resilience, regulatory compliance, business continuity, financial stability, and relevant assurance reports or certifications such as SOC 2 reports and ISO/IEC 27001 certification.
• Vendor diligence may recur during onboarding, periodic reassessments, material changes, or contract renewals, depending on the organization’s third-party risk management framework.
• Vendors that answer questionnaires frequently can benefit from maintaining a controlled response library supported by current evidence.

Hedge Fund Due Diligence Questionnaire

Institutional investors use this type of questionnaire when evaluating hedge funds and other alternative investment managers before allocating capital.

• AIMA’s Illustrative Questionnaire for the Due Diligence of Investment Managers is a widely used industry-standard framework. Its 2025 edition retains a modular structure and includes updated strategy-specific modules, including a Private Markets module.
• A hedge fund due diligence questionnaire may address investment strategy, governance, performance, risk management, liquidity, leverage, counterparties, compliance, valuation, service providers, and operational infrastructure.
• The modular format allows investors and managers to use the sections relevant to the strategy and structure being reviewed.

VC Investor-to-Startup DDQ

Venture investors may send founders a DDQ as part of an institutional financing process.

• It is generally narrower than a full-scope M&A DDQ and often focuses on corporate structure, capitalization, intellectual property ownership, material contracts, financial information, key personnel, compliance, and business assumptions.
• Supporting documents are frequently maintained in the startup’s fundraising data room.
• This DDQ due diligence workflow allows investors to review written responses alongside the underlying corporate and transaction documents.

Core Sections of a Due Diligence Questionnaire

The emphasis varies by DDQ type. An M&A questionnaire may place greater weight on financial, legal, tax, and operational matters, while a vendor questionnaire may place greater emphasis on cybersecurity, privacy, resilience, and third-party risk.

Below are example due diligence questions organized by workstream.

Company Background & Ownership

• What is the entity’s legal name and corporate structure?
• Who are its ultimate beneficial owners, where relevant?
• What subsidiaries and controlled affiliates form part of the group?
• Who are the key principals, executives, or controlling persons?

Financial Review

• What are the historical revenue, EBITDA, margin, and cash-flow trends?
• What accounting and revenue recognition policies are applied?
• What outstanding debt, contingent liabilities, or material off-balance-sheet obligations exist?
• Did the most recent external audit result in a modified audit opinion, or did the auditor separately report any material internal-control deficiencies?

Legal & Compliance

• Which material contracts contain change-of-control, assignment, termination, or consent provisions?
• Is there any pending, threatened, or material historical litigation?
• Which regulatory licenses, permits, or authorizations does the entity hold?
• What anti-bribery and anti-corruption controls are in place, including controls relevant to the FCPA, UK Bribery Act, or other applicable regimes?

Operational & IT

• What are the key operational dependencies and critical third parties?
• What cybersecurity controls, assurance reports, certifications, and risk-management frameworks are in place?
• Is there a documented and tested business continuity or disaster-recovery plan?
• Which ERP and other critical systems are in use, and what would be required for integration or migration?

Human Resources & Governance

• What does the organizational structure look like, and who are the key personnel?
• What equity, incentive, and compensation plans exist?
• Is there any material employment litigation or other workforce-related exposure?
• How is the board structured, and which governance policies and approval processes are documented?

ESG & Regulatory Risk

• Which sustainability or ESG reporting frameworks, policies, or metrics does the entity use, if any?
• Are there material environmental liabilities or compliance exposures?
• What supply-chain labor and human-rights controls apply?
• If the entity falls within the relevant scope, how prepared is it for applicable CSRD/ESRS reporting requirements or sustainability-information requests from investors and other counterparties?

CSRD applies only to companies within its statutory scope, while SFDR primarily imposes sustainability-related disclosure requirements on financial market participants and financial advisers rather than operating companies generally.

Best Practices for Issuing a DDQ

These practices help keep the questionnaire proportionate, clear, and easier to administer.

• Calibrate depth to the transaction. Adjust the questionnaire to the deal stage, size, risk profile, sector, and purpose of the review.
• Organize questions by workstream. Grouping related legal, financial, operational, and technology questions makes ownership and review easier.
• Set clear deadlines and response requirements. Specify timing, responsible parties, and the expected response format before circulation.
• Identify evidence requirements. Make clear which questions require supporting documentation and which require only a narrative response.
• Maintain version control. Establish a baseline version and document subsequent changes rather than making untracked edits after circulation.
• Plan the follow-up process. Determine how clarification questions and supplemental document requests will be handled before responses begin to arrive.

Best Practices for Responding to a DDQ

The responding party needs to balance speed with accuracy, consistency, and appropriate evidence.

• Read each question carefully and answer the specific issue being raised. Vague or internally inconsistent responses often generate additional follow-up.
• Assign each workstream to the appropriate subject-matter expert.
• Link responses that rely on evidence to the relevant document or folder in the data room.
• Maintain a controlled master response set with clear version history.
• Identify genuinely uncertain or incomplete responses rather than filling gaps with unsupported assumptions.

Managing the DDQ Workflow with a Virtual Data Room

A due diligence questionnaire and a virtual data room serve different functions, but they can operate as one coordinated workflow.

The DDQ structures the questions and responses, while the VDR provides a controlled environment for supporting documents, follow-up questions, access management, and activity tracking.

Depending on the platform, VDR features that can support the DDQ process include:

• Document linking. Supporting documents can be linked directly to relevant questions or responses, making it easier for reviewers to verify the evidence behind an answer without searching through multiple folders.
• Q&A workflows. Follow-up questions can be managed within a structured Q&A environment rather than through separate email threads. This keeps questions, responses, and related documents connected within the same workflow.
• Expert assignment. Questions can be routed to designated subject-matter experts, helping financial, legal, HR, IT, and other teams respond in the areas for which they are responsible.
• Granular document permissions. Administrators can control which user groups can access particular documents or folders. This is especially useful in competitive processes where different bidders or investor groups may require different levels of access.
• Question and activity history. The platform can retain a record of questions, responses, and related activity, making it easier to reconstruct how a particular issue was addressed during diligence.
• Activity and permissions reporting. Administrators can review project activity and access settings to understand how information has been shared and whether the appropriate users have access to relevant materials.

For example, if a buyer identifies an inconsistency in a financial response, the follow-up question can be routed to the appropriate expert, linked to the supporting document, and retained with the response history. When the same exchange takes place across separate inboxes, reconstructing who answered the question, what evidence supported the response, and when the information was provided can be considerably more difficult.

Common DDQ Mistakes to Avoid

• Using the wrong questionnaire for the review. A hedge fund manager DDQ is not designed for M&A diligence, while a comprehensive acquisition questionnaire may be disproportionate for a routine vendor review.
• Treating every question as equally important. Prioritization should reflect materiality and risk, with areas such as litigation, intellectual property, regulatory compliance, cybersecurity, and financial exposure receiving attention appropriate to the transaction.
• Relying exclusively on self-reported responses. Beneficial ownership, sanctions exposure, corporate status, and other material matters may require independent verification in addition to responses to the questionnaire.
• Ignoring incomplete or evasive responses. A materially incomplete answer may warrant clarification, supporting evidence, or escalation rather than being treated as resolved.

Conclusion

A due diligence questionnaire is more than an administrative document. Properly structured, it creates a consistent record of the questions asked, the responses provided, and the evidence supporting those responses.

Effective DDQ management requires three things: selecting the right type of questionnaire, calibrating its depth to the transaction and risk profile, and maintaining a controlled process for responses, evidence, and follow-up questions.

Used this way, a due diligence questionnaire template can reduce unnecessary back-and-forth and create a clearer diligence record. A structured virtual data room such as Ideals VDR can support that process by keeping documents, permissions, activity records, and follow-up Q&A within a controlled environment.