Edge Rewrite
everything Source code View original
// HTMLRewriter · presentation

This page was redesigned at the edge.

Cloudflare fetched the original article and streamed it through HTMLRewriter to apply an entirely new visual system without rebuilding the source page.

// request.cf · coarse context

A page that knows where it met you.

Only coarse request metadata is shown. This demo does not display or persist visitor IP addresses.

Country
US
Cloudflare location
CMH
Connection
HTTP/2
Language
Not provided

Ray ID: a24068ff6a65eddd

Jump to content

Due diligence

From Wikipedia, the free encyclopedia
(Redirected from Due care)

Due diligence is the investigation or exercise of care that a reasonable business or person is normally expected to take before entering into an agreement or contract with another party or an act with a certain standard of care.

Due diligence can be a legal obligation, but the term more commonly applies to voluntary investigations. It may also offer a defence against legal action. A common example of due diligence is the process through which a potential acquirer evaluates a target company or its assets in advance of a merger or acquisition.[1] The theory behind due diligence holds that performing this type of investigation contributes significantly to informed decision making by enhancing the amount and quality of information available to decision makers and by ensuring that this information is systematically used to deliberate on the decision at hand and all its costs, benefits, and risks.[2]

Development of the term

[edit]

The term "due diligence" can be read as "required carefulness" or "reasonable care" in general usage, and has been used in the literal sense of "requisite effort" since at least the mid-fifteenth century.[3] It became a specialized legal term and later a common business term due to the United States' Securities Act of 1933, where the process is called "reasonable investigation". Under Section 11b3, a person could avoid liability for an untrue statement of a material fact if they had, "after reasonable investigation, reasonable ground to believe and did believe, at the time", the truth of the statement.[4] The defense at Section 11, referred to later in legal usage as the "due diligence" defense, could be used by broker-dealers when accused of inadequate disclosure to investors of material information with respect to the purchase of securities. In legal and business use, the term was soon used for the process itself instead of how it was to be performed, so that the original expressions such as "exercise due diligence in investigating" and "investigation carried out with due diligence" were soon shortened to "due diligence investigation" and finally "due diligence".

As long as broker-dealers exercised "due diligence" (required carefulness) in their investigation into the company whose equity they were selling, and as long as they disclosed to the investor what they found, they would not be found liable for non-disclosure of information that was not discovered in the process of that investigation.

The broker-dealer community institutionalized, as a standard practice, the conducting of due diligence investigations of any stock offerings in which they involved themselves. Originally the term was limited to public offerings of equity investments, but over time it has become associated with investigations of private mergers and acquisitions (M&A) as well.

Examples

[edit]

Business transactions and corporate finance

[edit]

Due diligence takes different forms depending on its purpose:

  1. The examination of a potential target for merger, acquisition, privatization, or similar corporate finance transaction normally by a buyer. (This can include self due diligence or "reverse due diligence", i.e. an assessment of a company, usually by a third party on behalf of the company, prior to taking the company to market.)
  2. A reasonable investigation focusing on material future matters.
  3. An examination being achieved by asking certain key questions, including, how do we buy, how do we structure an acquisition, and how much do we pay?
  4. An investigation of current practices of process and policies.
  5. An examination aiming to make an acquisition decision via the principles of valuation and shareholder value analysis.[5]

A due diligence process can be divided into nine distinct areas:[5]

  1. Compatibility audit.
  2. Financial audit.[6][7]
  3. Macro-environment audit.[6][7]
  4. Legal/environmental audit.[6][7][8]
  5. Marketing audit.[6][7]
  6. Production audit.[6][7]
  7. Management audit.[6][7]
  8. Information systems audit.[6][7]
  9. Reconciliation audit.

It is essential that the concepts of valuations (shareholder value analysis) be considered in a due diligence process. This is in order to reduce the number of failed mergers and acquisitions.[5]

In this regard, two new audit areas have been incorporated into the Due Diligence framework:[5]

  • the Compatibility Audit which deals with the strategic components of the transaction and in particular the need to add shareholder value and
  • the Reconciliation audit, which links/consolidates other audit areas together via a formal valuation in order to test whether shareholder value will be added.[5]

The relevant areas of concern may include the financial, legal, labor, tax, IT, environment and market/commercial situation of the company. Other areas include intellectual property, real and personal property, insurance and liability coverage, debt instrument review, employee benefits (including the Affordable Care Act) and labor matters, immigration, and international transactions.[9][10][11] Areas of focus in due diligence continue to develop with cybersecurity emerging as an area of concern for business acquirers.[12] Risk is a key factor in determining 'duty of care'.[13] Regulations require 'reasonable security' in cybersecurity programs, and litigators examine whether 'due care' was practiced. Due diligence findings impact a number of aspects of the transaction including the purchase price, the representations and warranties negotiated in the transaction agreement, and the indemnification provided by the sellers.

Due Diligence has emerged as a separate profession for accounting and auditing experts and is typically referred to as Transaction Services.[further explanation needed]

Legislation

[edit]

With the number and size of penalties increasing, the United States' Foreign Corrupt Practices Act (FCPA) has caused many U.S. institutions to look into how they evaluate all of their relationships overseas. The lack of a due diligence of a company's agents, vendors, and suppliers, as well as merger and acquisition partners in foreign countries could lead to doing business with an organization linked to a foreign official or state owned enterprises and their executives. This link could be perceived as leading to the bribing of the foreign officials and as a result lead to noncompliance with the FCPA. Due diligence in regard to FCPA compliance is required in two aspects:

  1. Initial due diligence – this step is necessary in evaluating what risk is involved in doing business with an entity prior to establishing a relationship and assesses risk at that point in time.
  2. Ongoing due diligence – this is the process of periodically evaluating each relationship overseas to find links between current business relationships overseas and ties to a foreign official or illicit activities linked to corruption. This process will be performed indefinitely as long as a relationship exists, and usually involves comparing the companies and executives to a database of foreign officials. This process should be performed on all relationships regardless of location[14].

In the M&A context, buyers can use the due diligence phase to integrate a target into their internal FCPA controls, focusing initial efforts on necessary revisions to the target's business activities with a high-risk of corruption.[15]

While financial institutions are among the most aggressive in defining FCPA best practices, manufacturing, retailing and energy industries are highly active in managing FCPA compliance programs.

In the United Kingdom, the Bribery Act 2010 requires companies using an "adequate procedures" defence to a charge of bribery to have undertaken due diligence on their business partners. Due diligence is described as "knowing exactly who you are dealing with". Official guidance suggests that "ask[ing] a few questions and do[ing] a few checks" can help to protect an organisation from taking on untrustworthy partners.[16]

Human rights

[edit]

Passed on May 25, 2011, the OECD member countries agreed to revise their guidelines promoting tougher standards of corporate behavior, including human rights. As part of this new definition, they utilized a new aspect of due diligence that requires a corporation to investigate third party partners for potential abuse of human rights.

The OECD Guidelines for Multinational Enterprises (a government-backed international agreement that provides guidance on responsible business conduct) state that multinational enterprises will "Seek ways to prevent or mitigate adverse human rights impacts that are directly linked to their business operations, products or services by a business relationship, even if they do not contribute to those impacts".[17]

The term 'due diligence' was originally put forward in this context by UN Special Representative for Human Rights and Business John Ruggie, who used it as an umbrella to cover the steps and processes by which a company understands, monitors and mitigates its human rights impacts. Human Rights Impact Assessment is a component of this.

The UN formalized guidelines for Human Rights Due Diligence on June 16, 2011, with the endorsement of Ruggie's Guiding Principles for Business and Human Rights.[18]

Civil litigation

[edit]

Due diligence in civil procedure is the idea that reasonable investigation is necessary before certain kinds of relief are requested. For example, duly diligent efforts to locate and/or serve a party with civil process is frequently a requirement for a party seeking to use means other than personal service to obtain jurisdiction over a party. Similarly, in areas of the law such as bankruptcy, an attorney representing someone filing a bankruptcy petition must engage in due diligence to determine that the representations made in the bankruptcy petition are factually accurate. Due diligence is also generally prerequisite to a request for relief in states where civil litigants are permitted to conduct pre-litigation discovery of facts necessary to determine whether or not a party has a factual basis for a cause of action.

In civil actions seeking a foreclosure or seizure of property, a party requesting this relief is frequently required to engage in due diligence to determine who may claim an interest in the property by reviewing public records concerning the property and sometimes by a physical inspection of the property that would reveal a possible interest in the property of a tenant or other person.

Due diligence is also a concept found in the civil litigation concept of a statute of limitations. Frequently, a statute of limitations begins to run against a plaintiff when that plaintiff knew or should have known had that plaintiff investigated the matter with due diligence that the plaintiff had a claim against a defendant. In this context, the term "due diligence" determines the scope of a party's constructive knowledge, upon receiving notice of facts sufficient to constitute "inquiry notice" that alerts a would-be plaintiff that further investigation might reveal a cause of action.

Criminal law

[edit]

In criminal law, due diligence is the only available defense to a crime that is one of strict liability (i.e., a crime that only requires an actus reus and no mens rea). Once a criminal offence is proven, the defendant must prove on balance that they did everything possible to prevent the act from happening. It is not enough that they met the normal standard of care in their industry – they must show that they took every reasonable precaution.

The term "due diligence" is also used in criminal law to describe the scope of the duty of a prosecutor to make efforts to turn over potentially exculpatory evidence to (accused) criminal defendants.[citation needed]

In criminal law, "due diligence" also identifies the standard a prosecuting entity must satisfy in pursuing an action against a defendant, especially with regard to the provision of the Federal and State Constitutional and statutory right to a speedy trial or to have a warrant or detainer served in an action. In cases where a defendant is in any type of custodial situation where their freedom is constrained, it is solely the prosecuting entity's duty to ensure the provision of such rights and present the citizen before the court with jurisdiction. This also applies where the respective judicial system and/or prosecuting entity has current address or contact information on the named party and said party has made no attempt to evade notice of the prosecution of the action.[19]

Due diligence defence

[edit]

In the United Kingdom, "proper use of a due diligence system" may be used as a defence against a charge of breach of regulations: for example, under the Timber and Timber Products (Placing on the Market) Regulations 2013[20] and the Environmental Protection (Microbeads) (England) Regulations 2017,[21] businesses may be able to defend a charge of non-compliance with regulations if they can show that they have undertaken supplier due diligence to a necessary standard. References to "due diligence" and the maintenance of a "due diligence system" in the regulation concerning timber are drawn from the European Union's Regulation 995/2010, which covers the legal obligations of "operators who place timber and timber products on the market".[20]

Cyber due diligence in international law

[edit]

Cyber due diligence refers to the application, in the context of information and communications technology (ICT) operations, of the long-standing international law principle that a State must not knowingly allow its territory to be used for acts contrary to the rights of other States.[22] The principle has become one of the most actively contested questions in the emerging field of international cyber law, as States, tribunals, and scholars debate whether it constitutes a binding rule of customary international law, a general principle, or merely a non-binding norm of responsible State behavior.[23]

[edit]

The doctrinal starting point for cyber due diligence is the International Court of Justice's 1949 judgment in the Corfu Channel case, which held that every State has an obligation not to knowingly allow its territory to be used for acts contrary to the rights of other States.[22] This principle was translated into the cyber context by Rule 6 of the Tallinn Manual 2.0, an influential non-binding restatement of international law prepared by an international group of experts convened by the NATO Cooperative Cyber Defence Centre of Excellence. Rule 6 provides that a State must exercise due diligence in not allowing its territory, or cyber infrastructure under its governmental control, to be used for cyber operations that affect the rights of, and produce serious adverse consequences for, other States.[24] The accompanying commentary leaves open several contested questions, including the precise harm threshold required to trigger the obligation and whether a State's knowledge of the harmful activity must be actual or may be constructive.[24]

Scholars remain divided on the legal character of the obligation. According to some journalists, due diligence should be perceived as a separate concept that may impose legal obligations in the cyber field. The concept is compared with the one introduced in the International Law Commission’s Draft Articles on Prevention of Transboundary Harm from Hazardous Activities of 2001 whereby the State that causes harmful actions has to utilize all necessary measures to avert the risks that may appear for other nations.[25] Others argue that this reading overstates the current state of the law. According to a study released in the International & Comparative Law Quarterly in 2024, due diligence obligations have a foundation in certain primary rules, and they do not represent a universal source of obligations on behalf of nations. The majority of States in the UN regard cyber due diligence as being voluntary and thus not binding, rather than as a customary rule.[26] A competing view, advanced by Antonio Coco and Talita de Souza Dias, reframes the debate by moving away from an "all-or-nothing" search for a single, self-standing rule of cyber due diligence. Instead, they argue that a patchwork of separate protective obligations already applies by default in cyberspace, converging on a flexible standard of diligent conduct that requires States to take reasonable steps to prevent, halt, or redress a range of cyber-enabled harms.[23]

State practice

[edit]

Since the publication of Tallinn Manual 2.0, a growing number of States have issued formal position papers on the application of international law to cyberspace, several of which address due diligence directly. Germany's 2021 position paper cites the International Court of Justice's Corfu Channel judgment for the proposition that States are under an obligation not to knowingly allow their territory to be used for acts contrary to the rights of other States, and applies this rule to cyber operations conducted by both State and non-State actors from within a State's territory.[27][28] Germany joined a list of States that had already expressed a similar view, including Australia, Finland, France, Israel, the Netherlands, New Zealand, the United Kingdom, and the United States.[29]

The Netherlands has taken a particularly explicit position, stating in a 2019 letter to its parliament that it regards due diligence as "an obligation in its own right," the violation of which may constitute an internationally wrongful act.[30] The Dutch government has further clarified that the principle applies regardless of whether the underlying cyber activity is carried out by a State or a non-State actor, and that a victim State may invoke the principle to request that a territorial State take reasonable measures to address the activity.[31]

The United Kingdom's 2022 position paper similarly affirms that due diligence applies in cyberspace, drawing on the same Corfu Channel principle and emphasizing that a State's obligation arises when it has effective control over the territory from which the operation originates.[32] According to the updated 2024 position of France, it has reiterated that due diligence requires states to take “all feasible steps” to stop ongoing malicious cyber activity, but has pointed out that this liability does not entail an obligation to monitor all private communications.[33]

Other States have taken a more cautious line. Argentina and Israel, for example, have indicated that they do not regard due diligence, at least as applied to cyberspace, as having yet achieved the status of a binding rule of customary international law, treating it instead as an aspirational or policy standard.[29] This separation between states regarding their stance on due diligence has a negative influence on international negotiations, including within the UN Working Group on Cyber Security and the UN Governmental Experts Group.[29]

A related point of convergence among several position papers is the consequence of a breach. Several States have taken the view that a territorial State's failure to comply with its due diligence obligations may open the door to countermeasures by the injured State against the territorial State, which may in practice involve actions that impact non-State actors operating from within that territory.[34][31] This is considered practically significant because countermeasures are otherwise generally understood to be impermissible in response to hostile cyber operations by non-State actors unless those operations can be attributed to a State.

The Netherlands, France, and the United States have also each indicated that the applicability of due diligence, and the measures it requires, must be assessed on a case-by-case basis, taking into account factors such as the severity of the harm caused, whether the operation is military in nature, and whether it is attributable to a State.[29] This case-specific approach reflects the broader characterization of due diligence as an obligation of conduct—calibrated to what is feasible in the circumstances, rather than a fixed or uniform standard of compliance.[35]

Additional States have since articulated their own positions, reflecting the same divide between proponents and skeptics of the rule's binding character. Canada has stated that the 2015 consensus reached within the UN Group of Governmental Experts on voluntary, non-binding norms of responsible State behaviour does not preclude recognition of a binding customary rule of due diligence, while noting that it continues to study the matter.[35] China has linked the question of due diligence to its broader emphasis on the principle of sovereignty in cyberspace.[35] Colombia, Costa Rica, and Cuba have each issued national position papers since 2023 that engage with due diligence to varying degrees of specificity, contributing to a growing body of Latin American and Caribbean State practice on the subject.[35] Regional organisations have also weighed in: the African Union's Peace and Security Council adopted a Common African Position in January 2024 addressing the application of international law, including due diligence, to the use of ICTs, and the Council of the European Union issued a Declaration on a Common Understanding of International Law in Cyberspace in November 2024 that likewise addresses the principle.[35]

Overall, while some States have claimed that cyber due diligence is customary, its specific features are still debated due to the lack of a universally accepted definition of this notion and difficulties in proving responsibility for certain cyber incidents.

Institutional developments, 2024–2025

[edit]

Cyber due diligence has featured prominently in multilateral institutional processes. Within the United Nations Open-Ended Working Group on security of and in the use of ICTs (2021–2025), State responsibility and due diligence remained listed among the topics on which States sought further convergence under international law.[36] The Working Group concluded its five-year mandate in July 2025 with a consensus final report recommending the creation of a permanent successor body, the Global Mechanism on developments in the field of ICTs, to continue negotiations on responsible State behaviour, including the ongoing debate over due diligence.[36] Separately, in 2025 the International Law Commission added "due diligence in international law" to its programme of work as a distinct topic, a development that commentators have suggested may help bridge the parallel discussions taking place in cyber-diplomatic and international legal forums.[25]


See also

[edit]

References

[edit]
  1. ↑ Hoskisson, Robert E.; Hitt, Michael A.; Ireland, R. Duane (2004). Competing for Advantage. Mason, OH: South-Western/Thomson Learning. p. 251. ISBN 0-324-27158-1.
  2. ↑ Chapman, C. E. (2006). Conducting Due Diligence. Practicing Law Institute, New York, NY.
  3. ↑ 'Due Diligence' Merriam-Webster entry
  4. ↑ Securities Act of 1933 Section 11(b)(3), accessed 11 July 2023
  5. 1 2 3 4 5 Gillman, Luis (2010). Due Diligence, a Strategic and Financial Approach (2nd ed.). Durban: LexisNexis. ISBN 978-0-409-04699-1.
  6. 1 2 3 4 5 6 7 Harvey, M. G.; Lusch, R. F. (1995). "Expanding the Nature and Scope of Due Diligence". Journal of Business Venturing. 10 (1): 5–21. doi:10.1016/0883-9026(94)00020-U.
  7. 1 2 3 4 5 6 7 Kroener, P. H.; Kroener, M. H. (1991). "Towards more successful Mergers and Acquisitions". International Journal of Technology Management. 6 (1/2): 33–40. doi:10.1504/IJTM.1991.025872 (inactive July 12, 2025).{{cite journal}}: CS1 maint: DOI inactive as of July 2025 (link)
  8. ↑ Scott Feeley, Michael; Potash, Aron. "The Oft-Overlooked Importance of Air Emission Credits in M&A". Transaction Advisors. ISSN 2329-9134. Archived from the original on January 5, 2019. Retrieved July 21, 2015.
  9. ↑ Truax, Margret. "M&A Transactions: Affordable Care Act Due Diligence Considerations". Transaction Advisors. ISSN 2329-9134. Archived from the original on December 23, 2017. Retrieved May 23, 2016.
  10. ↑ Gary M. Lawrence, Due Diligence in Business Transactions, (Law Journal Press 1994, updated as needed). ISBN 978-1-58852-066-1.
  11. ↑ Tanenbaum, William. "Avoiding IP Business Risks in Corporate Transactions". Transaction Advisors. ISSN 2329-9134. Archived from the original on December 22, 2017. Retrieved July 23, 2015.
  12. ↑ Cunard, Jeffrey; Pastore, James; Ford, Christopher. "Cybersecurity: Evaluating Transactional Risk". Transaction Advisors. ISSN 2329-9134. Archived from the original on December 23, 2017. Retrieved July 21, 2015.
  13. ↑ "Duty of Care Risk Analysis Standard". DoCRA. 2022.
  14. ↑ "FCPA Definition - Foreign Corrupt Practices Act". Archived from the original on August 30, 2010. Retrieved 2010-01-07. WorldCompliance.com
  15. ↑ Brooks, Robin; Stacey, Oliver; Jarman, Daniel. "Tackling Corruption and Regulatory Risk in M&A Transactions". Transaction Advisors. ISSN 2329-9134. Archived from the original on October 18, 2015. Retrieved July 21, 2015.
  16. ↑ Ministry of Justice, The Bribery Act 2010: Quick Start Guide, accessed 24 December 2023
  17. ↑ Archived September 4, 2011, at the Wayback Machine
  18. ↑ "Report of the Special Representative of the Secretary-General on the issue of human rights and transnational corporations and other business enterprises, John Ruggie" (PDF). Human Rights Council. Retrieved May 21, 2021.
  19. ↑ Hawaii Revised Statues 353-66.5 and 604-7.2
  20. 1 2 Timber and Timber Products (Placing on the Market) Regulations 2013, SI 233/2013
  21. ↑ Environmental Protection (Microbeads) (England) Regulations 2017, SI 1312/2017
  22. 1 2 Corfu Channel (United Kingdom v. Albania), Judgment, ICJ Reports 1949, p. 4, at 22.https://www.acerislaw.com/wp-content/uploads/2023/12/Corfu-Channel-case.pdf
  23. 1 2 Coco, Antonio; de Souza Dias, Talita, "Cyber Due Diligence: A Patchwork of Protective Obligations in International Law", European Journal of International Law, Vol. 32, No. 3 (August 2021), pp. 771–806.https://doi.org/10.1093/ejil/chab056
  24. 1 2 Schmitt, Michael N. (ed.), Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations (2nd edn, Cambridge University Press, 2017), Rule 6.
  25. 1 2 United Nations Institute for Disarmament Research (UNIDIR), "Due Diligence in Early Practice, the International Law Commission Agenda and Cyberspace" (2026).
  26. ↑ Kenny, Jack, "Cyber Operations and the Status of Due Diligence Obligations in International Law", International & Comparative Law Quarterly, Vol. 73, No. 1 (January 2024), pp. 135–176. https://doi.org/10.1017/S0020589323000489
  27. ↑ Federal Government of Germany, "On the Application of International Law in Cyberspace", Position Paper (March 2021).
  28. ↑ Schmitt, Michael N., "Germany's Positions on International Law in Cyberspace, Part I", Just Security (2021).
  29. 1 2 3 4 Official Compendium of Voluntary National Contributions on the Subject of How International Law Applies to the Use of ICTs by States, UNODA, A/76/136 (August 2021).
  30. ↑ Dutch Ministry of Foreign Affairs, "Letter to the Parliament on the International Legal Order in Cyberspace" (5 July 2019).
  31. 1 2 CCDCOE, "National Position of the Netherlands (2019)", International Cyber Law: Interactive Toolkit.
  32. ↑ United Kingdom, "Position Paper on the Application of International Law to Cyberspace" (2022).
  33. ↑ French Ministry for Europe and Foreign Affairs, "French Position on the Application of International Law to Cyberspace" (2024).
  34. ↑ Schmitt, Michael N., "The Netherlands Releases a Tour de Force on International Law in Cyberspace: Analysis", Just Security (2019).
  35. 1 2 3 4 5 CCDCOE, "Due Diligence", International Cyber Law: Interactive Toolkit.
  36. 1 2 United Nations, Final report of the Open-ended Working Group on Security of and in the Use of Information and Communications Technologies 2021–2025, A/AC.292/2025/L.1 (11 July 2025).
Retrieved from "https://en.wikipedia.org/w/index.php?title=Due_diligence&oldid=1366489443"