Why your whole business needs to be investor-ready right now

Back in 1990, I co-founded an accounting software business called Exchequer. Over the following fifteen years, we built it into something genuinely valuable – valuable enough that a large acquirer came knocking in 2005. That process taught me a lesson I have never forgotten:

The moment you start a business is the moment you should start preparing it for outside investment or sale.

I know how that sounds when you are in the early years, focused on survival and then growth. The idea of building a data room feels like it belongs to a version of the business that does not exist yet. The truth is that the decisions you make in those early days – the share options granted on a handshake, the contractor never put on a proper agreement, the board minute that mentions something awkward in passing – these are the things that come back to find you at the worst possible moment.

At iplicit, we have been through this process several times. We know how to run it well. What follows is an honest account of what a modern investment process actually looks like – and what it means for any founder or leader who is tempted to treat investor-readiness as something they can sort out when the time comes.

The data room has changed beyond recognition

When people talk about due diligence, there is still a tendency to imagine something manageable. A folder of documents, a week of legal review, a few meetings. That world is long gone.

Physical data rooms used to impose a natural constraint. You could only fit so much paper in a room, and lawyers could only read so much in a few days. The modern data room is a secure digital platform with effectively no limit on what can be requested – easily ten times the size of anything typical fifteen years ago, covering every corner of the business in a level of detail that simply was not possible before.

What compounds this is that you are not dealing with one set of questions from one party. You have the investor's own team doing commercial due diligence, their lawyers with a legal information request list that grows as they find things to follow up on, their financial advisers running a parallel process and technology specialists going through your codebase and infrastructure. Now put two or three competing investors into that picture, each with their own set of advisers. The management teams that handle it without losing their minds are the ones who spent years building the foundations.

What they will actually ask you

On the legal side, questions will cover commercial relationships and customer contracts in detail – terms, start dates, renewal dates, termination provisions, liability caps. Your corporate structure going back through historical transactions and share movements. Every employment contract, bonus plan, consultant agreement and IR35 assessment. Insurance policies, litigation history and regulator correspondence going back five years.

Data protection alone typically generates more than a dozen questions: GDPR compliance, sub-processor agreements, marketing consent, penetration testing, any data breach history. Artificial intelligence has become a specific area of scrutiny – expect to describe every AI technology you own, develop or use, and how it is deployed.

The lawyers will read every board minute going back years. Anything mentioned without being properly closed off generates a follow-up. A passing reference to a security incident will come back as a request for the full incident report, risk assessment, regulator correspondence and confirmation of resolution. You cannot assume anything will go unread.

Financial due diligence is a different exercise again. Expect monthly trial balances by entity and cost centre; complete billings by customer going back years; recurring revenue and retention at individual customer level, reconciled to reported figures; churn with reason codes; deferred revenue waterfalls. Cash-to-revenue and cash-to-expense reconciliations, month by month. Monthly productivity for every quota-bearing sales representative going back three years – including people who have already left.

The thing that is most likely to catch you out

Most founders think about investor-readiness in terms of financial metrics: ARR, gross margin, revenue growth. That is necessary, but it is not where the surprises come from.

What catches businesses out is the layer underneath – the early decisions made when investment was the last thing on anyone's mind. Shares issued on the basis of a conversation. Options granted without paperwork being completed. A co-founder who leaves with equity unresolved. A contractor who builds something important and moves on without assigning the IP. These things feel fine when the business is small and everyone trusts each other. They feel very different when a law firm is asking you to account for every share movement with documentation, years later.

Intellectual property is the other area that surprises people. Every developer who has written material code for your business needs to have signed an IP assignment. The contractor from 2019, the co-founder who left early on – if those agreements do not exist or cannot be found, you have a problem that is genuinely difficult to fix retrospectively.

Making it a whole business discipline

Investor-readiness is not a finance function problem, though there is a tendency to treat it as one.

Your head of engineering needs to understand that open-source licence decisions will be scrutinised by specialists. Your head of sales needs to know that every deviation from standard contract terms must be documented in a signed deed of variation and filed. Your head of people needs employment records, contractor classifications and IR35 assessments to be complete and current.

Board minutes must be written with the awareness that they will one day be read carefully by people you have not met. Not sanitised – investors are suspicious of minutes that are too clean – but complete.

It is also worth being clear about what technology can and cannot do here. Good financial systems help enormously with the data side of due diligence. But no software files your board minutes, tracks your IP assignments or maintains your cap table history. That is organisational discipline – knowing what you have, where it lives and being able to put your hands on it under pressure. That cannot be delegated to a system. It has to be a habit.

Consider an audit before you need one

Even if you are not yet at the scale where a statutory audit is required, it is worth commissioning an internal due diligence review. Not because anything is wrong but precisely because there is not yet anything forcing the question.

A structured review will surface documentation gaps, incomplete IP assignments, board records that need strengthening and financial data that cannot be reconstructed at the granularity an investor will require. Addressing those things in a calm, planned way is incomparably better than discovering them mid-process. 

Start now, not when it matters

The steps are not complicated. They just require consistency over years.

• Build a governance repository now: corporate documents, employment and contractor agreements, customer contracts and deeds of variation, IP assignments, board minutes, shareholder consents, insurance policies, data protection documentation, incident logs, cap table history.
• Maintain financial data at the granularity an investor will want – monthly revenue by customer, headcount by function, sales productivity by person, churn with reason codes.
• Revisit your early history. Find the gaps in share movements, option grants and contractor arrangements while you have time to address them properly.
• Commission an internal due diligence audit before the pressure is on. The cost of doing it in advance is a fraction of the cost – in time, stress and deal risk – of discovering problems mid-process.

One final thought

Every business has complexity in its history, and experienced investors understand that. What they cannot work with is uncertainty – and uncertainty is what you create when you cannot answer questions cleanly, consistently and quickly.

Businesses don't need perfect histories to respond well to due diligence. They need complete documentation, well-maintained records and the organisational discipline to know where everything is.

We have been through this process multiple times. The lesson is always the same: the answer is to have started earlier. The good news is that for anyone reading this, earlier is right now.