Six Weeks to Credible: A Data Diligence Rehearsal for UK Mid-Market Boards

Data diligence has a familiar failure mode. A UK mid-market company enters an investment, acquisition or vendor review, and the data room fills with spreadsheets, screenshots, policy PDFs and dashboard exports. There is plenty to read. There is very little to verify. The buyer asks a simple question — how do you know this number is right? — and the room goes quiet.

The problem is not a shortage of documents. It is a shortage of evidence. A diligence rehearsal should therefore be treated as a governance exercise, not a filing exercise. The aim is to make the business legible: which metrics matter, where they come from, who can change them, how long data is kept and which risks would genuinely affect the deal. Six weeks is enough to do that properly, provided the work is scoped around the questions a buyer will ask rather than the documents a team already has.

Week one: agree the questions the deal will ask

Start with the board sponsor, the finance lead, the data owner and legal counsel. List the ten metrics most likely to drive valuation, working capital, customer retention or integration cost. For each one, name a business owner and a technical custodian. Separate reported metrics from operational metrics. A revenue figure in the board pack and a transaction count in the order system may describe the same activity, but they rarely behave identically.

The output of week one is not a data dictionary. It is a short, ranked question set. Which numbers would a buyer test first? Which would they struggle to reconcile? Which are produced by a spreadsheet that one person understands? That list becomes the rehearsal plan.

Week two: turn definitions into a custody map

For every priority metric, produce a one-page definition. It should state the formula, inclusions and exclusions, the system of record, the transformation steps, the approval route and the owner. Version control matters. A definition that changed in 2026 without a note is a diligence finding waiting to happen.

This is also where UK group structures need care. A subsidiary may report a metric using a group definition that does not match its local invoicing or CRM process. That is not necessarily a problem, but it must be explained. The same applies to acquired businesses that still run parallel systems. A custody map shows where responsibility sits and where it is contested. Contested custody is a risk; hidden custody is a bigger one.

Week three: assemble lineage evidence that can be read

Lineage that stops at a dashboard is decoration. For each priority metric, trace the path from source record to reported output. The evidence pack should include a source extract, the transformation logic, a reconciliation to the reported figure and a note of known breaks. Buyers do not expect perfection. They expect to see where the joins are weak, how tolerances are set and what happens when reconciliation fails.

Avoid dumping screenshots without context. A screenshot proves that a screen existed on a particular day. A reconciliation proves that two systems can be made to agree within a stated tolerance. Where manual adjustments are material, list them, quantify them and name the approver. In a mid-market business, manual intervention is often legitimate. Undocumented manual intervention is the issue.

Week four: test access logs and control evidence

Access is one of the few data topics that moves quickly from technical review to board concern. Prepare evidence on who can access priority systems, how joiners, movers and leavers are handled, which accounts are privileged and where service accounts sit. Check the obvious gaps: shared logins, departed contractors, excessive administrator rights and exported datasets sitting outside the managed environment.

Under UK GDPR, accountability expectations do not disappear because a deal is in progress. The rehearsal should show that access is reviewed, exceptions are recorded and remediation is owned. Do not overclaim. A clean narrative that collapses under one follow-up question is worse than an honest exception log with dates and owners.

Week five: make retention decisions explicit

Retention is often left as a policy statement. In diligence, it becomes a cost and risk question. Set out retention by data class: customer records, transaction data, HR data, marketing data, support tickets and backups. Identify legal holds, regulatory obligations and contractual commitments. Show what is deleted, when and by what mechanism. If the answer is that nothing is deleted because deletion is difficult, say so and quantify the exposure.

Third-party processors belong in this week as well. A buyer will want to know which suppliers touch priority data, where it is held and whether retention terms are consistent. Retention is not a housekeeping topic. It is a deal risk when it is undefined.

Week six: rehearse the board pack and the awkward questions

Run a 90-minute dry session with someone outside the core team. Ask them to play the buyer. The board pack should not be a catalogue of systems. It should state the five data risks that genuinely affect the transaction, each with a business consequence: revenue leakage, delayed integration, compliance exposure or remediation cost. 'Poor data quality' is not a risk statement. 'Customer master data requires £X and two quarters to reconcile before billing can be consolidated' is.

Board-ready checklist

• A one-page register of priority metrics, owners and definitions.
• A lineage evidence pack with reconciliations and known breaks.
• An access review covering joiners, leavers, privileged accounts and exports.
• A retention schedule by data class, with deletion evidence and legal holds.
• A risk register with quantified business impact and named owners.
• A remediation estimate for the top three issues, including cost and timing.
• An index of orphan spreadsheets that remain business-critical.
• A data room index that maps questions to evidence, not folders to files.
• A Q&A log from the dry run, with agreed answers and accountable owners.
• A board summary that separates known issues from unknowns.

A buyer is not purchasing a perfect data estate. They are purchasing confidence that the estate is understood. The six-week rehearsal is not about polishing spreadsheets for presentation. It is about making the business credible when someone asks how the numbers are made, who can change them and what happens when they disagree. That is the data that closes a deal — or at least stops it stalling on an avoidable question.