The Due Diligence Checklist for Buying a Business

You signed the LOI, the seller seems honest, the numbers in the listing looked great. Now comes the part that actually decides whether this deal makes you money or ruins you: due diligence. This is the due diligence checklist for buying a business — grouped by what to verify, what you're actually looking for, and the red flag that should make you slow down or walk.

Here's the stat that should set the tone. Roughly 31% of M&A deals that fail trace it back to inadequate due diligence — second only to overpaying. And about 55% of businesses that enter due diligence never reach closing. That's not a tragedy — that's the system working. Diligence is supposed to kill bad deals before they kill you.

Most people think due diligence is one big scary thing. It's not. It's 5 separate jobs, and you can run them in parallel. Financial, legal, customers, operations, and the owner. I'll walk each one in order — what to pull, what you're actually checking for, and the thing that should make you nervous.

One note before we start: this isn't a replacement for a CPA, an attorney, and a deal advisor. It's the map so you know what they should be doing and you don't get a $10k bill for asking the wrong questions.

1. Financial due diligence

This is the one that matters most, cause every other piece of the deal — the price, the loan, your downside — runs off these numbers. The whole game here is proving the cash flow is real and recurring, not a story the seller's accountant told for the listing.

What to pull and verify:

• Tax returns vs. the P&L (3+ years). Lay the business tax returns next to the internal profit-and-loss statements, line by line. They should tell the same story. When the P&L the broker handed you is rosier than what the seller told the IRS, you've found your first problem — and people don't usually overpay their taxes for fun.
• Bank statements. Tie the deposits in the actual bank statements back to the revenue on the books for at least a few sample months. Books can be edited. Bank deposits are a lot harder to fake. This is how you catch revenue that exists on paper and nowhere else.
• AR and AP aging. Pull the accounts-receivable and accounts-payable aging reports. A receivables report stacked with 90-plus-day balances means customers aren't paying — the revenue was booked but the cash never showed. On the payables side, a pile of overdue bills is debt you may be inheriting.
• The add-backs. The seller will adjust earnings up with add-backs — the owner's car, personal travel, a salary above market, one-time expenses — to get to SDE or adjusted EBITDA. Make them defend every single one. A legitimate add-back is the owner's $90k salary when a manager costs $60k. A garbage add-back is calling a real, recurring expense "one-time" three years running.
• Working capital. Figure out the normal level of working capital the business needs to run — the receivables, inventory, and payables it carries month to month. Then agree on a working-capital peg in the purchase agreement, usually off a trailing 12-month average. Without one, a seller can strip the business of cash before close — collect the receivables early, delay the payables — and hand you an empty tank you have to refill out of pocket on day 1.
• A quality of earnings report. For anything north of a small deal, get a quality of earnings (QoE) report. A CPA rebuilds the real, cash-backed earnings from source documents instead of taking the seller's word for it. For a sub-$5M business that typically runs $5,000 to $15,000, and on an SBA deal you can roll that cost into the loan. Skipping it is how people overpay — QoE-surfaced findings are the single biggest cause of broken deals at about 25%.

The red flag: the seller can't produce clean financials, or the bank statements don't tie to the books. About 25% of failed deals collapse on exactly this — a business that can't hand you accurate financial statements. If the numbers don't reconcile, nothing else on this list matters yet.

2. Legal due diligence

Financials tell you what the business earns. Legal diligence tells you whether you actually get to keep earning it after the deal closes — or whether the things that make the business work walk out the door with the seller's signature.

What to review:

• The purchase agreement and the lease. Read the asset or stock purchase agreement with an attorney — what you're buying, what liabilities transfer, the reps and warranties. Then read the real-estate lease, cause that's where deals quietly die. Almost every commercial lease has an anti-assignment clause, and the landlord's consent is often required to transfer it. Landlord consents can take 60 to 90 days, and a landlord who sees the sale coming will use the ask to renegotiate your rent up.
• Contracts and change-of-control clauses. Pull the major customer and vendor contracts and hunt for change-of-control and anti-assignment language. Plenty of contracts say they can't be assigned to a new owner without consent — and some treat a change of ownership as an assignment even in a stock deal. A contract that evaporates the day you take over isn't an asset you're paying for.
• Licenses and permits. Confirm every license, permit, and certification the business runs on, and confirm it transfers to you. Some don't — they're tied to the owner personally and you have to re-apply, sometimes with a waiting period where you legally can't operate.
• Litigation. Ask for every pending, threatened, and recently settled lawsuit, plus any regulatory actions. Old litigation tells you how the business handles disputes. Active litigation you didn't know about can become your problem the second you own the entity.
• IP and ownership. Verify who actually owns the trademarks, domain names, code, customer lists, and brand. The classic trap: the website, the social accounts, or the core software is registered to the seller personally, or to a contractor who built it and was never assigned the rights. If the brand isn't legally the company's, you're buying less than you think.

The red flag: a key contract, the lease, or a license requires consent to transfer and the seller hasn't gotten it. Don't accept "it'll be fine." Make consent for the deal-critical ones a condition of closing, in writing.

3. Customer and revenue due diligence

The financials prove the revenue happened. This step proves it'll happen again next year — after the only person the customers know stops answering the phone.

What to dig into:

• Customer concentration. Get revenue broken out by customer and find out how much rides on the top one and the top five. This is one of the most important numbers in the whole deal. Under 10% from any single customer is healthy; once one customer is past 20-30% it's a real risk, and lenders and PE buyers start passing. When your top five are more than half the revenue, you're one bad lunch from a very different business.
• Churn and retention. Pull the customer list from a few years back and see how many are still around. A business that has to win a brand-new customer for every one it loses is on a treadmill, and you'll be the one running it. Steady repeat customers are the thing you're actually paying a multiple for.
• Contract terms. Find out whether the revenue is locked into contracts or just shows up out of habit and goodwill. Month-to-month and handshake revenue can leave the day the founder does. Real contracts with term and renewal language are far more durable — assuming they survive the change-of-control check above.
• Pipeline. Look at the quotes out, the deals in progress, the backlog. This tells you whether next quarter is already half-booked or whether the well is about to run dry the moment you take over.

The red flag: one customer is 30%-plus of revenue, or you can't tell why customers actually stay. Concentration like that doesn't always kill a deal — but it should re-price it, restructure the terms (a holdback or escrow — earnouts aren't allowed on SBA 7(a) loans), or send you back to the seller with hard questions.

4. Operations due diligence

This is the part people skip because it isn't on a spreadsheet, and it's where the surprises live. You're checking whether the machine keeps running when you're the one holding it.

What to examine:

• Suppliers and vendors. Map who supplies the business and on what terms. Single-source suppliers, sweetheart pricing the seller got from a buddy, or a vendor who's also a friend of the family are all risks. If the business depends on one supplier and that relationship is personal to the seller, your costs can change the day you take over.
• Key-person risk. Figure out who actually makes the business run besides the owner. Sometimes it's one technician, one salesperson, one ops manager who holds it all together. Key-person dependency is one of the most underestimated deal killers — and if that person leaves right after you buy, you bought a different business than the one you diligence'd.
• Employees and comp. Review the roster, tenure, pay rates, and whether anyone's underpaid relative to the market. Underpaid long-tenured staff are a hidden cost — you'll have to raise pay to keep them or eat the turnover. Check for any verbal promises the seller made that you'd be expected to honor.
• Systems and SOPs. Find out whether the business runs on documented processes or entirely inside the owner's head. Written SOPs, real software, organized records — that's a business you can step into. Everything living in one person's memory means the operating manual walks out the door at close, and you rebuild it the hard way.

The red flag: the business has no documented processes and runs on a couple of irreplaceable people. That's not necessarily a no — but it means your transition has to be longer and your purchase price should reflect the risk.

5. The owner and the transition

This is the one that quietly decides whether you got a good deal. A business that runs without the owner is worth a lot more than the same numbers tied to a person who's about to leave. You're not just buying cash flow — you're buying how dependent that cash flow is on someone who won't be there.

What to assess:

• How dependent the business is on the seller. Be honest about it. Does the owner hold the key relationships, do the selling, make every real decision? Owner-dependent businesses get penalized hard — independent lower-middle-market companies with real management trade at meaningfully higher multiples than identical businesses that depend on the founder. The more the business is the seller, the more risk you're absorbing.
• Training and handoff. Nail down the transition before close — how long the seller stays, how many hours, what they actually teach you, who they introduce you to. A real handoff isn't a two-week courtesy. For an owner-heavy business it's months, and it should be written into the deal, not left to goodwill.
• Non-compete. Get a non-compete from the seller, with real teeth — scope, geography, and a long enough term. You do not want the person who built every customer relationship opening a competitor down the street six months after cashing your check.

The red flag: the business is the seller, and the seller wants out fast with a short transition and no non-compete. That combination is how a profitable-looking acquisition becomes a business that quietly falls apart the quarter after you take over.

How to actually run this

Don't run these 5 in sequence — run them in parallel and start with financial, cause if the numbers don't hold up, you can stop before you spend money on lawyers and a QoE. The order to spend in: verify the financials yourself first, then bring in the QoE and the attorney for legal once you're convinced the cash flow is real.

And give it time. The data is clear that rushed diligence is bad diligence — deals that run 90-plus days of diligence close successfully far more often than the ones crammed into 45. The whole point of this process is to find the reason not to buy. If you go in trying to confirm you should buy, you'll find a way to talk yourself past every red flag on this page.

Two things this checklist sits on top of: knowing how to read the seller's pitch before diligence even starts, and knowing what the business is worth once it's done. Those are their own jobs — how to read a CIM covers the first, and how to value a small business covers the second. Diligence is the bridge between them: you read the story, you verify it's true, then you price what's actually there. It's one stage in the full path to buying a business.

The buyers who do well aren't the ones with the cleanest checklist. They're the ones willing to walk when the financials don't reconcile or the whole business is one person. Half the deals that hit diligence don't close, and that's a feature. Most of those were deals that should've died. Your job is to find out fast whether yours is one of them.

DealStratum helps you find and source a business to buy — on-market and off. It's not a broker, a lender, or a financial advisor. Nothing here is investment, legal, or financial advice — run your diligence with a qualified CPA, attorney, and deal advisor.

Sources

• Acquisition Stars — M&A failure rate (inadequate diligence at 31%)
• DueDilio — business sale failure rate (diligence drop-off, QoE-surfaced findings, 90-day data)
• EBIT Community — Quality of Earnings reports for small business acquisitions (cost)
• Morgan & Westfield — Net Working Capital in M&A (the peg)
• Miller Thomson — lease consent in corporate due diligence
• CT Acquisitions — contract assignability in a business sale
• Acquisition Stars — due diligence red flags (customer concentration thresholds)
• Acquidex — key person risk
• Big Talk About Small Business — owner dependency and exit multiples