Due diligence is the systematic process of confirming that the business is what the seller says it is. Done well, it surfaces the real risks before you sign a purchase agreement. Done poorly, it leaves you owning surprises.
What due diligence covers
Diligence spans four pillars: financial, operational, legal, and commercial. Each is its own workstream with its own professional support. Skip any of them and you are guessing about a major part of the business.
Financial diligence
The goal of financial diligence is to confirm earnings are real, recurring, and transferable. You verify tax returns against P&Ls, review the trailing 36 months of bank statements, examine customer concentration, and trace any seller add-backs to source documents. For deals above ~$1M, hire a CPA to perform a Quality of Earnings (QoE) report — it is the single most valuable diligence document you will produce.
- 3 years of tax returns reconciled to P&L and bank statements
- Monthly revenue and gross margin trends
- Customer concentration (any customer > 10% is a flag)
- Add-back analysis: which are legitimate, which inflate earnings
- Working capital normalization
- Accounts receivable aging and collectibility
Operational diligence
Operational diligence answers: does this business run without the owner? You map key employees, customer relationships, vendor dependencies, systems, and processes. The deeper the owner is embedded in day-to-day operations, the longer your transition needs to be — and the more risk you are taking on.
Legal diligence
An attorney reviews contracts (customer, vendor, lease), licenses, permits, IP ownership, employment agreements, pending or threatened litigation, and any encumbrances on the assets you're buying. Asset sales avoid most legacy liabilities; stock sales inherit everything. Know which you're doing.
Commercial diligence
Commercial diligence asks: is the market healthy and is this business positioned to win in it? Competitor analysis, customer interviews (with seller consent and post-LOI), and industry research belong here. For larger deals, hire an outside firm; for main-street deals, a thoughtful buyer can do this themselves.
Red flags that should make you walk
Some findings are deal-killers, not negotiation points. Falsified financials, undisclosed material litigation, key customer departures during diligence, missing licenses required to operate, and owners who refuse to answer reasonable questions should end the conversation — not start a price negotiation.
Checklist
- 3 years of tax returns + interim YTD
- Bank statements covering trailing 36 months
- Customer list with revenue concentration
- All material contracts (top customers, top vendors, lease)
- Employee roster with roles, tenure, comp, and key-person flags
- Equipment list with condition and ownership status
- QoE report (deals $1M+)
- Legal review of contracts and corporate records
- Insurance review (existing coverage and gaps)
Frequently asked
30–90 days is typical, depending on deal size and complexity. Larger or more complex deals can run longer.
On deals above roughly $1M, yes. A CPA-prepared QoE is the most reliable way to confirm earnings are real and transferable.
In an asset sale, you buy specific assets and avoid most legacy liabilities. In a stock sale, you buy the entity and inherit everything — assets and liabilities. Most small-business deals are asset sales.
On very small deals (under $250K), some buyers do. On anything larger, professional help pays for itself many times over.