The M&A Risk Checklist: 12 Items to Check Before a Medical Device Acquisition

← Back to All Insights

Strategic acquirers run rigorous financial, commercial, legal and IP diligence. The items below sit between those workstreams, in the clinical, regulatory, quality and operational record of a medical device company, and they are easy to under-weight before close. This is a checklist of questions, not a verdict on any deal.

If they are not examined earlier, many of them surface during integration, after price and terms are set.

1. Predicate Strategy Vulnerability

If the target's lead product was cleared via 510(k), examine the predicate chain back at least two generations. Predicate creep accumulates regulatory fragility that does not appear on the surface. A weak predicate chain can draw FDA requests for additional information on the next submission and delay post-close product launches.

2. CAPA and Recall History Depth

Public recall data only tells you what FDA forced into the public record. Open CAPAs, customer complaints under investigation, and field corrections that have not yet been classified as recalls all live in the quality system. Get full access to the Quality Management System data—not summaries—or treat the exposure as unknown.

3. Reimbursement Coverage Stability

Coverage today is not coverage tomorrow. Examine the LCDs (Local Coverage Determinations) underlying the target's revenue, the NCDs (National Coverage Determinations) being reconsidered, and any pending CMS Hospital Outpatient Prospective Payment System rule changes. For a product priced close to its payment rate, a modest payment change can compress gross margin quickly.

4. Post-Approval Study Obligations

FDA can require post-approval studies (PAS) as a condition of PMA, HDE or PDP approval, and those commitments stay with the product when it changes hands. They can be expensive and slow to complete, and they are easy to miss in a data room. Check FDA's Post-Approval Studies database and pull the FDA correspondence file before signing.

5. Quality System Scalability

A QMS that worked at 2,000 units per month may not pass FDA inspection at 20,000 units per month. Examine the QMS sophistication relative to the target's growth plan. A common gap: quality infrastructure designed for clearance, not for the scale the deal model assumes.

6. Manufacturing Single Points of Failure

Sole-source components, single-site sterilization, or one-supplier raw materials are common in medical devices and may not surface in CIM materials. Audit the bill of materials for parts with only one validated supplier. Each one is an integration risk, and qualifying a backup supplier can take many months.

7. Clinical Trial Sites and Investigator Stability

If the target has active clinical trials, examine the investigator agreements, the site contracts, and the data ownership clauses. Investigator turnover or site closures after close can slow enrollment, and they may not be visible in deal materials.

8. Cybersecurity Posture

Section 524B of the FD&C Act, added by the Consolidated Appropriations Act, 2023, sets cybersecurity requirements for “cyber devices” in premarket submissions made on or after March 29, 2023, including a software bill of materials (SBOM) and a plan to monitor and address postmarket vulnerabilities. Examine the target's SBOM, penetration test history and vulnerability disclosure response time. Those postmarket obligations continue after close, at the new owner's cost.

9. Intellectual Property Freedom-to-Operate

Standard IP diligence covers what the target owns. Freedom-to-operate analyzes what they could be sued over. Growth-stage device companies can carry freedom-to-operate gaps their counsel judged low-probability. After close, the acquirer owns the litigation risk.

10. Key Personnel Retention Obligations

Identify the 3-5 people whose departure would materially impair the business. Examine their existing comp, equity vesting, and any non-compete enforceability under the relevant state law (California voids most employee non-competes, but Business and Professions Code §16601 allows sellers of a business, its goodwill or their entire ownership interest to agree not to compete; confirm with counsel). Build retention into the deal, not after.

11. Customer Concentration and Switching Cost

What looks like a strong customer base may be 3 hospital systems that account for 60% of revenue, each with annual contracts. Examine churn cohorts, win/loss data, and customer satisfaction scores by segment. Concentrated revenue is concentrated execution risk.

12. Regulatory Submission Pipeline Status

Pre-submission packages, in-progress 510(k) filings and pending De Novo requests each carry regulatory risk. Compare every active submission with FDA's public decision history for similar devices: product code, predicates and review times. This is where the deal model's pipeline assumptions get tested.

None of these items decides whether a deal should close. Each is a place where the record can differ from the deal model, and each is worth examining before price and terms are set.