Reputation due diligence in mergers and acquisitions
Reputation due diligence in mergers and acquisitions: what buyers find about a company online and how a seller builds an accurate, defensible record.
Reputation due diligence in mergers and acquisitions is the part of a buyer's or investor's review that asks what the market, courts, regulators, customers and the press already say about the target company, and whether that matches what the seller has put in the data room. The buyer is not judging whether the company is liked. It is checking whether the public record contains liabilities or contradictions that the price and the contract have not accounted for.
For a seller, that changes the job. You cannot edit a court docket, a regulator's notice or a year of customer ratings, and trying to do so in the middle of a process is the fastest way to lose a buyer's trust. What you can do is know the record before the buyer does, reconcile it with your own disclosures, add the context that an honest reading needs, and make sure the accurate material about the business is easy to find.
This guide is written for founders, owners, finance leads and advisers on the sell side, and for investors who want to know what a competent seller should be able to hand over. It is information, not legal advice; your counsel decides what you must disclose and how. Rules are described as the pages read for this guide state them.
- A buyer treats reputation as a source of inherited liability and of evidence about the business, and reads it next to financial, legal and operational review. Findings can change the price, the structure or the decision.
- The records that matter most in a transaction are litigation, regulatory matters, customer and employee feedback, and press. Most cannot be altered, so the seller's work is to know them, reconcile them with the data room and explain them.
- Prepare a single reputation file before the process starts. Disclosing an accurate adverse fact early, with context, is almost always cheaper than having a buyer discover it.
- Never hide a material fact, never buy or stage reviews, and never use pressure to remove criticism. Each one creates a worse problem than the one it was meant to solve.
What a buyer is really buying when it buys a reputation
A buyer acquires a company together with its history, so its reputation review is a search for inherited liability as much as for image. Two professional-services pages read for this guide say it in similar terms. KPMG Belgium writes that reputational due diligence belongs alongside financial, tax, legal and operational due diligence, and that its findings can lead to a new valuation, a restructuring or even reconsideration of the whole transaction. Kroll, in its guide to regulatory and reputational risk in M&A, describes successor liability: an acquirer can absorb the target's earlier regulatory violations, including bribery, money laundering and sanctions breaches, unless the regulator agrees otherwise before closing.
Related readBrand Ambassador Scandal: The First 24 HoursThat is why a reputation review in a transaction looks different from a personal search. According to Kroll, it covers how the market perceives the company, the background of executives and board members, ownership down to the ultimate beneficial owners and any ties to sanctioned or politically exposed persons, the compliance program, open litigation and investigations, third-party exposure and the regional geopolitical environment. KPMG adds the target's ethical culture and workforce, and its customer and supplier relationships. Kroll also states that the absence of a compliance program is an explicit red flag.
Most items on those lists are facts about conduct and records. Search results matter because they are how the buyer finds the facts, but the weight sits on what the sources prove.
Both firms sell diligence services, so treat the pages as descriptions of how buyers frame the work, not measurements.
The six places a buyer looks, and what each can prove
A buyer works from sources that can be cited in an investment memo. The order below reflects how this work is usually organized in our experience, not a published standard, and buyers vary with deal size and sector.
| Source | What the buyer reads | What it can prove | How a seller prepares |
|---|---|---|---|
| Court and regulator records | Open and closed cases, enforcement notices, licence status | Liabilities, conduct, patterns across years | A complete matter schedule that matches the public docket |
| Press and trade media | Coverage of the company, owners and executives | Allegations, events, how leadership responded | A timeline of each story with the facts and any correction on file |
| Review profiles | Ratings and themes on customer and employer platforms | Service quality, recurring failures, how complaints are handled | Genuine volume, consistent replies, no manipulation |
| Customer references | Calls with named customers and former customers | Whether contract value is stable and relationships are healthy | A reference list chosen openly, plus a view on churned accounts |
| Owned and corporate pages | Website, filings, leadership bios, policies | Whether the company describes itself consistently | One source of truth that matches the data room |
| Search and AI answers | What a search engine or assistant says about the company | Which facts a casual reader meets first, and any errors | A check of page one and assistant answers, with errors corrected at source |
The first two rows carry the most weight in a negotiation because they can change legal exposure. The last two rarely change a price alone, but a mismatch makes the buyer doubt the rest of the file.
Litigation and regulatory records: the part that cannot be edited
Court and regulator records are the part of the file the seller cannot shape, so the only useful preparation is completeness and consistency. The buyer will search them whether or not the seller mentions them, and what it finds is compared with the matters listed in the data room.
Related readEcommerce reputation management: what to fix firstIn the United States, federal court filings are searchable through PACER. The fee page on pacer.uscourts.gov states a charge of $0.10 per page, capped at $3 for documents such as dockets, motions and orders (the cap does not apply to search results or transcripts), and fees are waived if a user spends $30 or less in a calendar quarter. Assume a federal case will be found. State courts, company registers and regulators use their own systems, which this guide did not review.
A seller should build a matter schedule before the data room opens. For each matter it lists the court or authority, the parties, the nature of the claim, the date opened, the current status, the amount in issue, the insurance position and the person who can speak to it. Then compare it with a fresh search of public sources under every legal, former and trading name of the company. The two lists should match. Where they do not, the difference is either a matter you forgot or a record about a different company with a similar name. Resolve both before the buyer raises them.
What the law says about leaving things out
Disclosure duties depend on the deal, the country and the contract, and your counsel decides them. One rule is worth knowing in outline. The text of SEC Rule 10b-5, as published by Cornell's Legal Information Institute, makes it unlawful in connection with the purchase or sale of any security to make an untrue statement of a material fact, or to omit a material fact needed to keep the statements made from being misleading. A sale of shares is a sale of securities, so a seller who describes the business accurately but leaves out a material adverse fact can be exposed in a way that has nothing to do with search results. Asset sales and non-US deals raise different questions that this guide does not review. The eCFR text of the rule could not be read for this guide; the Cornell copy was.
Related readFounder reputation affects company: separate or alignAsking "will the buyer find it?" is the wrong test. Ask whether a reasonable buyer would treat the fact as material and whether your description stays accurate without it. If not, it goes in. Reputation work never extends to keeping an accurate material fact from the other side.
Kroll's page notes that the US Department of Justice and the SEC have given meaningful credit to companies that disclose misconduct up front, while adding that no formal grace period for self-reporting exists. A buyer who finds a problem alone prices the surprise as well as the problem.
Review profiles: what a buyer reads and what a seller must not touch
A buyer reads review profiles for patterns, not the star average: volume, recency, repeated themes, how the company replies, and differences by location, product line or period. Kroll's page calls third-party risks the primary source of reputational risk, and review platforms are where their public side often shows.
Customer reviews hint at revenue quality: churn, support load, disputes. Employer reviews hint at retention and management, which matter when the buyer is paying for a team.
The line a seller must not cross
The FTC's Consumer Reviews and Testimonials Rule went into effect on October 21, 2024, according to the FTC's staff question-and-answer page. The rule prohibits fake or false reviews and testimonials, including purchased ones where the business knew or should have known; compensation conditioned on a particular sentiment; insider reviews that do not clearly disclose the connection; and review suppression through groundless legal threats, intimidation or certain false accusations. The Q&A page adds that courts may impose civil penalties for knowing violations and that the guidance is not a safe harbor. Incentives are allowed only if nothing requires or implies a particular sentiment, and the page warns that asking only customers believed to be happy may itself raise problems under the FTC Act. A company may reply publicly to a negative review, but not with knowingly false accusations or threats.
Related readLayoffs and employer brand reputation: what stays publicGoogle's contribution policy goes the same way for its own platform. It prohibits fake engagement and paid reviews, reviews based on a conflict of interest such as current or former employment, and reviews posted in exchange for an incentive. It also says merchants may not discourage or prohibit negative reviews or selectively solicit positive reviews from customers.
For a seller the rules produce three consequences.
- Do not run a review drive aimed at the buyer's visit. A sudden jump in volume, in the same period as a sale process, is visible in the data and reads as manipulation even when every review is real.
- Do not ask staff, relatives or advisers to post. The Google policy lists employment relationships as a conflict, and the FTC page requires clear disclosure of insider connections.
- Do not threaten reviewers to take down criticism. The FTC page allows legal threats with a legitimate basis and bars unfounded or groundless ones, which in practice means counsel must be involved before anything is sent.
What is allowed is slower and more useful: reply in a consistent, factual voice, fix the cause of repeated complaints and record the date, and keep asking all customers for honest feedback. A recurring complaint followed by a visible fix reads as a well-run company.
Customer references and the data room: where the story is tested
Reference calls test whether the seller's narrative holds when someone else tells it. In many processes the buyer asks for customers to call, often adding names of its own, and may ask for lapsed customers too. It is where a mismatch between the data room and customer experience becomes obvious.
A seller can prepare honestly in three ways. First, offer a reference list that reflects the book of business, not only the happiest accounts, and know what each customer is likely to say about price, service failures and contract terms. Second, prepare a short, factual account of accounts lost in the last two or three years and why, because a buyer will find them. Third, brief your customers neutrally and in good time that a buyer may call, without scripting answers.
For reputation purposes the data room needs one addition: a reputation file, an index of the public record about the company with a status for each item, next to the legal schedule and in the same wording. It usually holds the matter schedule, regulatory correspondence and licences, a press timeline, a summary of review profiles with actions taken, the pages that describe the business, and a note on any false or outdated material found online. Counsel should settle access and redaction of personal data before anything is uploaded; this guide did not review the rules in each country.
Related readLegal Dispute and Brand Reputation: A Company PlaybookWhere company diligence meets person-level checks
Person-level checks travel with the company review. Each has its own preparation; this section only places them in a deal.
Formal searches on founders and directors match a named individual against records, sanctions lists and adverse media; the usual failure is a false match through a shared name, solved by giving the buyer's team identifying details early. The informal search is a reader typing the leaders' names into a search engine, so their public profiles should be accurate and consistent with the data room. AI assistants add a third layer: a buyer may ask an assistant to summarize the company, and the answer can be wrong or mix up two entities; the fix is to correct errors at the source, and the page on what AI assistants say about you explains the service. If the business is known mostly through its founder, the buyer will ask what happens when the founder leaves; moving the company's identity onto the institution, openly and over time, helps.
A preparation plan for the seller, in order
The order matters because later steps depend on earlier ones. With less than a few months, run the first three steps and the last.
- List every legal and trading nameCollect current, former and regional names of the company, its subsidiaries and brands, plus the names of directors and owners. These are the strings a buyer will search.
- Search the records yourselfSearch courts, regulators, company registers, press archives and review platforms for each name. Keep dated screenshots or exports so that you can show what was public on which day.
- Reconcile with the legal scheduleMatch every public matter to the disclosure schedule. Add missing items, and mark records that concern a different company with the evidence that they do.
- Write the context for each adverse itemOne short factual paragraph per matter: what happened, what the outcome was, what changed. No adjectives, no argument. Counsel reviews it before it is shared.
- Fix what is wrong at the sourceAsk publishers and platforms to correct genuinely inaccurate or outdated statements through their normal routes. Do not ask for removal of accurate reporting.
- Review the review profilesGroup complaints by theme, fix the cause where you can, and make replies consistent. Stop any activity that could be read as soliciting only favorable feedback.
- Align the owned pagesMake the website, leadership bios, policy pages and company profiles say the same thing as the data room. Date the pages that carry claims.
- Freeze and monitorOnce the process starts, keep a log of changes to public pages and watch for new coverage, so that you can answer questions about anything that appears mid-deal.
Step five is where sellers go wrong. Inaccurate, outdated or unlawful material can be corrected through the publisher, the platform or the courts. Accurate, lawful reporting about real conduct is not a target; a request to remove it normally fails and can become a second story.
A realistic timeline from six months out to closing
The timeline below is practitioner experience with sell-side preparation, not a measurement, and individual deals move faster or slower. The durations are usual ranges.
Related readNew company online reputation with no reviews| Phase | Usual window | What happens | Seller's output |
|---|---|---|---|
| Self-audit | Months 6 to 4 before launch | Records, press and reviews searched under every name | Draft reputation file and matter schedule |
| Correction | Months 4 to 2 before launch | Errors corrected at source, review themes fixed, owned pages aligned | Fewer mismatches, documented actions |
| Data room build | Final month before launch | Reputation file merged with the legal schedule and approved by counsel | One consistent set of statements |
| Buyer review | Weeks into the process | Buyer searches records, reads profiles, calls references | Fast, consistent answers to every question |
| Findings and negotiation | Late in the process | Adverse items discussed, price or terms adjusted if needed | Context already written, no surprises |
| Bring-down to closing | Until signing and closing | New coverage or filings between signing and closing checked | Updated file and a log of changes |
Corrections to inaccurate material take as long as the publisher, platform or court takes, which can be weeks, so they belong in the early phases and not in the data-room month. A buyer's adviser may also search before the first meeting.
A worked scenario: a software company with a mixed record
This is an invented scenario with generic parties; the facts are assumptions. The seller is a founder-owned business-to-business software company with about 80 staff. A strategic buyer has expressed interest and the owner plans to open a data room in about four months.
The seller runs the self-audit and finds four things. The public record shows a closed commercial dispute with a former supplier that is not in the draft legal schedule. A trade publication ran a story about a service outage two years ago, which is accurate. The employer review profile shows a score lower than the customer profile, with a repeated comment about turnover in one department. And a business directory lists the company under a former name with an address it left years ago.
The owner's first instinct is to ask the publication to take the outage story down. Counsel advises against it: the story is accurate and a removal request would add a conversation the buyer could notice. The company instead places a short dated factual note on its status page linking to the post-incident report. The dispute with the supplier is added to the schedule with its outcome. The directory entry is corrected through the directory's own process, since it is wrong. The employer reviews are answered in a consistent voice, and the company documents the management change it made in the department with high turnover.
Related readPartner and supplier due diligence on your companyThe buyer's adviser finds the supplier dispute, the outage story and the employer reviews, all already in the reputation file with context and dates, so its questions are about the future, not concealment. None of this assures a price; what the preparation changes is how much the buyer needs to guess.
What to avoid during a process
Some moves feel protective and do harm. Each has a named risk and a point at which it fails.
Hiding facts fails because the record is public and the omission can be the larger liability. Manipulating reviews fails because platforms and the FTC rule target it. Pressure on critics fails because the FTC page treats groundless threats as review suppression. Bulk editing fails because an unexplained change mid-process looks like concealment: correct what is wrong, date it and tell your adviser.
Your next step: build the file before anyone asks for it
Start with the self-audit, because it costs little and shows the gap between your story and the record while you still have time to act. Run steps one to three under every name the company has used and bring the results to your counsel and adviser before any process opens. Reputation Partners can give an independent read of search results, review profiles and AI answers, but the file itself must be built from facts your own team and advisers can confirm.
A private review of what is public about your company, set beside your draft disclosures, shows the mismatches a buyer's adviser would find first. It is a reading exercise, not a promise about outcomes, and it leaves legal decisions with your counsel. Start with the private audit.
Questions people ask
Does reputation due diligence replace legal or financial due diligence?
No. KPMG's page describes it as an addition to financial, tax, legal and operational review, feeding the same decisions: price, structure, contract protections or whether to proceed. The legal team owns litigation and disclosure questions; reputation work supplies the public-record view to compare against.
Related readRebrand reputation search results: what carries overCan a seller remove negative coverage before a sale?
Only where it is inaccurate, outdated or unlawful, and through the proper route: the publisher, the platform, a search engine request or a court. Accurate reporting about real events is normally not removable, and an attempt can draw attention to it. The seller's better move is to disclose the matter, add dated context on its own pages and show what changed since.
Are online reviews really checked in an acquisition?
They are read, mostly for patterns: volume, recency, repeated themes and how the company replies. A sudden burst of new reviews close to a sale process is itself a pattern. FTC and platform review rules apply during a process just as at any other time.
What if a public record about the company is wrong or about a different company?
Collect the evidence that it concerns another entity, such as a different registered number or address, and file it next to the record. Ask the source to correct or annotate it where it allows that, and tell the buyer's adviser early, because an unexplained false match can look like a hidden matter.
Should we tell the buyer about a small settled dispute?
Usually yes, as a one-line item with the outcome. Whether it is material is a question for your counsel, and the answer depends on the deal. SEC Rule 10b-5, for sales of securities, concerns omissions that make statements misleading, so a short accurate entry is lower risk than silence. Small items disclosed early rarely change anything.
How early should a seller start?
Several months before a process is the usual practice we see, because corrections depend on third parties and review themes take time to address. With only weeks, concentrate on the matter schedule, the reconciliation with public records and the context paragraphs, which you control and which carry the most weight.
