IPO Due Diligence Checklist: The 2026 Issuer's Playbook

Most IPO due diligence checklists are written for the wrong audience. The consumer-facing versions (think retail investor explainers) skip the legal stakes entirely. The practitioner versions are paywalled and written for underwriters' counsel, not for the CFO, general counsel, or ESG officer who actually has to gather, organize, and verify the documents.

This is the issuer's internal playbook: what your team must prepare, why each track matters legally, what underwriters will scrutinize hardest, and how the 2023-2026 regulatory additions have materially expanded the ipo due diligence checklist.

Key takeaway: IPO due diligence is not a formality. Section 11 of the Securities Act of 1933 imposes personal liability on directors, signatories, and underwriters for material misstatements or omissions in the registration statement. The due diligence defense requires a "reasonable investigation", and courts have consistently held that independent verification, not reliance on management representations, is the standard.

What Is IPO Due Diligence and Why Does Section 11 Drive Everything?

IPO due diligence is the structured investigative process through which underwriters, legal counsel, and the issuing company verify the accuracy and completeness of all material information before the S-1 registration statement is declared effective by the SEC.

The legal engine behind the entire process is Section 11 of the Securities Act of 1933. If the registration statement contains a material misstatement or omission, every signatory, director, and underwriter faces civil liability, unless they can prove they conducted a reasonable investigation and had reasonable grounds to believe the statements were true. That is the due diligence defense, and it is why underwriters conduct independent document review, management interviews, and third-party verification rather than simply accepting the company's representations.

For the issuer's internal team, the practical implication is this: you are not just preparing documents for your own benefit. You are building the evidentiary record that your underwriters, auditors, and counsel will rely on to establish their defense. Gaps in your preparation become gaps in their defense.

For context on how the S-1 registration statement itself is structured, see our Form S-1 practitioner walkthrough.

How Long Does IPO Due Diligence Take?

Plan for 8-16 weeks of active due diligence, but the preparation work that makes due diligence possible takes far longer.

Deloitte's IPO readiness framework recommends starting IPO preparation 18-24 months before the target IPO date for large accelerated filers, and 12-18 months for Emerging Growth Companies (EGCs). The companies that consistently miss their IPO windows are the ones that treat due diligence as something that happens in the six months before filing.

Here is the sequenced timeline your team should follow:

18-24 Months Out (Large Accelerated Filers) / 12-18 Months Out (EGCs)

• Engage a PCAOB-registered auditor and begin the re-audit of historical financials in the format required by SEC Regulation S-X. This is the single most common IPO delay: private companies whose historical audits were conducted by non-PCAOB-registered firms must start over.
• Assess whether the company qualifies as an EGC (annual gross revenues below $1.235 billion). EGC status allows confidential draft S-1 submission and reduces the financial statement history requirement to two years (vs. three for large accelerated filers).
• Conduct an internal controls assessment. SOX 404 compliance kicks in post-IPO, but internal control weaknesses discovered during due diligence are far cheaper to remediate before filing than after.
• Begin ESG data collection. If the company has never tracked Scope 1 and 2 GHG emissions, board diversity metrics, or supply chain labor practices, starting now is not early.

12 Months Out

• Establish the virtual data room (VDR). Common platforms include Datasite, Intralinks, and Donnelley Financial Solutions (DFIN). Organize the VDR to mirror the structure of the due diligence request list (DDRL) that underwriters' counsel will send. Access controls should be tiered by sensitivity from day one.
• Complete a full cap table audit. Every outstanding equity instrument, options, warrants, convertible notes, RSUs, must be accurately reflected, with 409A valuations current and defensible.
• Identify all material contracts under Item 601 of Regulation S-K and flag any change-of-control provisions that the IPO could trigger. A supplier agreement or license that terminates automatically on a change of control is a potential deal-breaker that must be identified and renegotiated before the S-1 is filed.
• Select underwriters and securities counsel. For guidance on that process, see our IPO underwriter selection walkthrough.

6 Months Out

• Receive and respond to the underwriters' due diligence request list (DDRL). This is the formal start of the due diligence process. The DDRL will cover all eight tracks described below.
• Confirm that financial statements meet the staleness rule: the SEC's Financial Reporting Manual requires that financial statements included in an S-1 be no more than 135 days old at the time of effectiveness. This creates a hard timing constraint on IPO scheduling.
• Begin drafting S-1 disclosures in parallel with due diligence. The 2020 Regulation S-K amendments (effective February 2021) require risk factors to be organized by category, with a summary section if the risk factors exceed 15 pages.

90 Days Out

• File the draft S-1 (confidentially if EGC-eligible) with the SEC.
• Prepare auditors to deliver the comfort letter (PCAOB AS 6101) at closing. This "negative assurance" letter confirms that nothing has come to the auditors' attention suggesting material misstatements in the financial statements. Companies that have not engaged their auditors early on comfort letter requirements frequently discover at the last minute that the auditors cannot deliver.
• Ensure all parties who will be required to sign lock-up agreements (standard 180-day post-IPO restriction) have been identified and that no existing shareholder agreements conflict with the lock-up obligation.

The Eight Due Diligence Tracks: What to Prepare

Underwriters' counsel organizes the DDRL into major tracks. Here is what each track requires from the issuer's internal team, and where the legal stakes are highest.

Track 1: Corporate and Organizational

This covers the company's legal existence, governance structure, and capitalization. Prepare:

• Certificate of incorporation and all amendments, bylaws, and board resolutions
• Complete capitalization table with all equity classes, options, warrants, and convertible instruments
• Organizational chart showing all subsidiaries and their ownership percentages
• Shareholder agreements, voting agreements, and investor rights agreements (flag any anti-dilution provisions, drag-along rights, or rights of first refusal that the IPO will affect)
• Minutes of all board and committee meetings for the past three to five years

Legal stake: SEC Regulation S-K Item 201 requires accurate disclosure of the company's equity structure. Errors in the cap table have caused S-1 amendments and delayed IPOs.

Track 2: Financial Statements and Accounting

This is where most IPO delays originate. PwC's 2024 IPO Guide identifies the five most common financial due diligence failures:

1. Financial statements not in SEC Regulation S-X format
2. Internal controls not documented to SOX readiness standards
3. Related party transactions not fully identified and disclosed
4. Equity compensation accounting errors under ASC 718
5. Revenue recognition not compliant with ASC 606

For the financial statement requirements in detail, see our IPO financial statement requirements walkthrough.

Prepare:

• PCAOB-audited financial statements for the required period (two years for EGCs, three years for large accelerated filers)
• Interim unaudited financial statements (no more than 135 days old at effectiveness)
• Documentation of all accounting policy choices, especially revenue recognition under ASC 606 and stock compensation under ASC 718
• 409A valuation reports supporting all option exercise prices
• A schedule of all related party transactions, with assessment of whether each was conducted on arm's-length terms

Warning: Private companies frequently grant stock options at exercise prices that do not reflect fair market value, or use incorrect valuation models. Remediating ASC 718 errors can require restatement of historical financial statements, which adds months to the IPO timeline.

Track 3: Material Contracts

Item 601 of Regulation S-K requires material contracts to be filed as S-1 exhibits. "Material" includes contracts not made in the ordinary course of business, contracts on which the business is substantially dependent, and contracts for the acquisition or sale of property exceeding 15% of total assets.

Prepare:

• All customer contracts representing more than 10% of revenue
• All supplier and vendor agreements with significant dependencies
• All licensing agreements (in and out)
• All debt instruments, credit facilities, and guarantees
• All partnership and joint venture agreements
• A change-of-control analysis for every material contract

The change-of-control issue is consistently underestimated. An IPO constitutes a change of control under many standard contract definitions. A key customer contract or software license that terminates automatically on a change of control must be identified and renegotiated before the S-1 is filed, not discovered during SEC review.

Track 4: Intellectual Property

Prepare:

• Complete IP inventory: all patents (granted and pending), trademarks, copyrights, and trade secrets
• Assignment agreements confirming the company (not individual founders or former employees) owns all IP
• Freedom-to-operate analysis for core products
• All IP licenses, in and out, with term and exclusivity details
• Open-source software inventory and compliance documentation
• Any pending or threatened IP litigation

IP ownership gaps are a frequent source of S-1 risk factor disclosures and can affect valuation. The assignment issue is particularly common at founder-led companies where IP was developed before the company was formally incorporated.

Track 5: Litigation and Regulatory Matters

SEC Regulation S-K Item 103 requires disclosure of material pending legal proceedings. Prepare:

• Complete litigation history: all pending, threatened, and settled claims (civil, criminal, arbitration, regulatory)
• All regulatory correspondence, investigations, and enforcement actions
• Environmental compliance documentation
• EEOC charges and employment litigation
• Any pending tax disputes or assessments

Underwriters look back further than most companies expect. Settled litigation from five or more years ago may still require disclosure if it is material to understanding the company's risk profile.

Track 6: Tax

Prepare:

• Federal, state, and local income tax returns for the past three to five years
• All tax assessments, audits, and correspondence with tax authorities
• Transfer pricing documentation (for companies with international operations)
• IRC Section 409A compliance documentation for all deferred compensation arrangements
• R&D tax credit documentation

IRC Section 409A violations in deferred compensation arrangements are a common and costly finding. Penalties include immediate income inclusion, a 20% excise tax, and interest, and they must be disclosed in the S-1.

Track 7: Employees and Benefits

Prepare:

• Employment agreements for all C-suite and key personnel
• Non-compete and non-solicitation agreements
• Equity compensation plan documents (stock option plans, RSU plans) with 409A valuations
• ERISA compliance documentation for all benefit plans
• Collective bargaining agreements (if applicable)
• A list of all parties who will be required to sign lock-up agreements

Regulation S-K Item 402 requires detailed executive compensation disclosure. EGCs receive a partial accommodation here: they may provide scaled executive compensation disclosure rather than the full proxy-level disclosure required of large accelerated filers.

Track 8: Cybersecurity, Data Privacy, and ESG

This track did not exist in its current form five years ago. Three regulatory developments have made it mandatory:

Cybersecurity: The SEC's cybersecurity disclosure rules (effective December 2023 for large accelerated filers) require the S-1 to include robust cybersecurity risk factor disclosures and governance disclosures. Prepare:

• SOC 2 audit reports
• Penetration testing results and remediation documentation
• Incident response plan
• Board-level cybersecurity governance documentation (who on the board has cybersecurity expertise, what oversight processes exist)
• Data privacy compliance documentation: GDPR (for EU operations), CCPA/CPRA, and the 20-plus US state privacy laws now in effect as of 2026

ESG: As EY's 2025 IPO Readiness Guide notes, ESG due diligence has become a de facto requirement for companies targeting institutional investors, even where not yet mandated by SEC rules. Underwriters are including ESG data requests in their DDRLs. Prepare:

• Scope 1 and Scope 2 GHG emissions data (at minimum)
• Board diversity metrics
• Supply chain labor practice documentation
• Data privacy governance policies

On climate disclosure specifically: the SEC's climate rule (finalized March 2024) remains stayed pending litigation as of 2026. But the SEC has confirmed that existing MD&A requirements already require disclosure of material climate-related risks. If climate risk is material to your business, it must be disclosed under current rules regardless of the new rule's status. For the IFRS S2 parallel, see our IFRS S2 disclosure checklist.

EGC vs. Large Accelerated Filer: What Changes in Scope

Your filer category materially affects the scope and timeline of due diligence.

For a detailed breakdown of EGC accommodations and the 2026 proposed changes to filer categories, see our SEC EGC accommodations guide.

What the SEC Will Flag: Pre-Empting Comment Letters

After the S-1 is filed publicly, the SEC's Division of Corporation Finance has 30 days to issue its initial comment letter. KPMG's 2025 IPO Insights identifies the five most frequent comment targets:

1. MD&A disclosures, particularly forward-looking statements and non-GAAP measures presented without adequate reconciliation
2. Risk factor specificity, the SEC pushes back hard on generic risk factors that could apply to any company in any industry
3. Revenue recognition policies, ASC 606 application, performance obligation identification, and disaggregation disclosures
4. Related party transaction disclosures, Item 404 of Regulation S-K requires disclosure of any transaction exceeding $120,000 in which a related person has a material interest
5. Cybersecurity risk disclosures, the SEC expects specificity about actual risks and governance, not boilerplate

The SEC's Division of Corporation Finance publishes sample comment letters on EDGAR. Reading recent S-1 comment letters in your industry is one of the highest-value preparation activities your team can do before filing.

For a deeper look at non-GAAP comment letter patterns, see our SEC comment letter trends guide.

The Comfort Letter: What Your Auditors Must Deliver

At IPO closing, your auditors must deliver a comfort letter to the underwriters under PCAOB AS 6101. This letter provides "negative assurance", the auditors confirm that nothing has come to their attention that would cause them to believe the financial statements contain material misstatements.

The comfort letter process has specific requirements that many pre-IPO companies discover too late:

• The auditors must be PCAOB-registered and must have completed a PCAOB-standard audit of the financial statements included in the S-1
• The letter covers a "bring-down" period from the audit date to a date close to closing, auditors will need access to interim financial data and management representations for this period
• The letter cannot cover information that the auditors have not independently verified

Engage your auditors on comfort letter requirements at the start of the process, not 30 days before closing.

The Five Mistakes That Delay IPOs

Based on the PwC IPO Guide (2024) and the pattern of SEC comment letters, these are the due diligence failures that most reliably push IPO timelines:

1. Starting financial statement preparation too late. Companies that begin PCAOB audit preparation six months before their target date almost always slip. The audit of two or three years of historical financials, in Regulation S-X format, takes longer than expected.
2. Undiscovered ASC 718 errors. Incorrect 409A valuations or option accounting require restatement of historical financials. Restatement adds months.
3. Unidentified related party transactions. The $120,000 threshold under Item 404 catches transactions that companies do not think of as "related party", loans to founders, below-market leases from investor-affiliated entities, consulting agreements with board members' family members.
4. Change-of-control provisions in material contracts. Discovered during underwriters' legal review, these require renegotiation under time pressure, which gives counterparties leverage.
5. ESG and cybersecurity data gaps. Companies that have never tracked GHG emissions or documented board-level cybersecurity governance face a credibility gap with institutional investors and a disclosure gap with the SEC.

FAQ

What documents are included in an IPO due diligence checklist? The eight core tracks are: corporate and organizational documents, financial statements and accounting records, material contracts, intellectual property, litigation and regulatory matters, tax records, employee and benefits documentation, and cybersecurity/ESG materials. Each track has specific document requirements tied to SEC disclosure rules.

How far back do underwriters look at financials? For large accelerated filers, three years of PCAOB-audited financials are required under Regulation S-X. For EGCs, two years. For litigation, tax, and employment matters, underwriters typically look back five years or more.

What is the difference between issuer due diligence and underwriter due diligence? The issuer's team prepares and organizes documents, conducts internal audits, and populates the data room. Underwriters and their counsel independently verify material facts through document review, management interviews, and third-party confirmation. Underwriters cannot rely solely on issuer representations, that is the legal requirement under Section 11 and SEC Staff Legal Bulletin No. 7.

What are the "Four P's" of due diligence? The Four P's framework (People, Performance, Process, and Projections) is a general due diligence heuristic sometimes used in M&A contexts. In an IPO context, it maps roughly to: management background checks (People), historical financial performance (Performance), internal controls and operations (Process), and forward-looking financial projections used in the roadshow (Projections). The SEC-mandated due diligence tracks are more granular than this framework suggests.

What happens if IPO due diligence is inadequate? Inadequate due diligence that results in material misstatements or omissions in the S-1 exposes directors, signatories, and underwriters to civil liability under Section 11 of the Securities Act of 1933. Post-IPO, it can trigger securities class action litigation, SEC enforcement action, and reputational damage that affects the company's ability to access capital markets.

How does the SEC's cybersecurity rule affect IPO due diligence? The SEC's cybersecurity disclosure rules (effective December 2023 for large accelerated filers, June 2024 for smaller reporting companies) require the S-1 to include cybersecurity risk management, strategy, and governance disclosures. Due diligence must now include a dedicated cybersecurity track covering SOC 2 reports, incident response plans, board governance, and compliance with the 20-plus US state data privacy laws now in effect.

For the going-public path decision that precedes all of this, see our direct listing vs. IPO vs. SPAC comparison. Once the S-1 is filed and the SEC review is complete, the next phase is the roadshow, covered in our IPO roadshow process walkthrough.