Having been through due diligence with several top VC funds (Softbank Vision Fund and others) I would say that due diligence generally focusses in on a few key areas which are crucial to the upside and risk factors in the specific business. For example, is the financial model broadly accurate (ie there’s nothing in the finances that would cause the investment hypothesis not to work out), if they’re a software or saas company, do they own their software or are they exposed to IP litigation risks etc[1], what’s the cyber risk like, etc. Then they will deep dive on anything that gives them a spidey sense tingle during that first phase. It’s not a general seal of approval of all the controls in the company, they know for a startup you’re building the plane while you’re trying to fly it, they don’t expect perfection they just want the plane not to crash into the mountain before they hit their exit.

On that basis, the FTX thing is kind of baffling because the financial controls would seem to be core to the thesis. Having read some of the things sequoia said about their original meetings with SBF it seems they were dazzled by him personally and allowed their greed to overcome basic prudence.

[1] So for example for SVF I had to go through all the transitive dependencies of all our software (which for JS and python is generally a lot), check the licenses and actually track down authors of a few packages in the node ecosystem and ask the authors to explicitly license their software so we knew we had a right to “depend” on it.