BlogBuying a BusinessDue Diligence Checklist

    Business Acquisition Due Diligence Checklist (2026)

    Due diligence is where good deals get confirmed and bad deals get caught. This business due diligence checklist covers the four workstreams every buyer should run, the documents to request, and the red flags that should stop a deal cold.

    Buyer Guide
    4 Diligence Workstreams
    14 min read
    Updated July 2026
    Legend Atty
    Legend Atty · Founder, BridgeBook
    50+ transactions · $100,000,000+ facilitated·Published July 3, 2026

    What Due Diligence Is Actually For

    30-90 days

    Typical Diligence Window

    3 years

    Financial History to Request

    4

    Core Workstreams

    100+

    Items on a Thorough List

    Due diligence has one job: prove that the business you agreed to buy in the letter of intent is the business that actually exists. You are testing the seller's numbers and story, not taking them on faith.

    It is not about finding a perfect business. Every small business has flaws. Diligence tells you which flaws are priced in, which ones justify renegotiation, and which ones mean you should walk.

    When buying a business, due diligence starts after you sign an LOI and typically runs 30 to 90 days. The LOI should state the diligence period explicitly and let you exit without penalty if findings do not check out.

    Run four workstreams in parallel: financial, operational, legal, and customer. Buyers who only check the financials routinely miss the problems that actually kill businesses, like a lease that cannot be assigned or one customer holding half the revenue.

    Sequence matters. Verify the earnings first, because if the profit is not real, nothing else on this checklist is worth your time.

    New to the process? Start with our step-by-step guide on how to buy a business, then come back here when you are ready to open the books.

    The Financial Due Diligence Checklist

    Financial due diligence for a small business answers one question: is the profit real, and will it survive the ownership change? Work through these five areas in order.

    1. Profit & Loss Quality

    • Request 36 months of monthly P&L statements, not just annual summaries. Monthly detail exposes seasonality, one-time spikes, and quiet declines that annual numbers hide.
    • Confirm whether the books are cash basis or accrual. Cash-basis books can make a declining business look stable for months.
    • Check gross margin stability month over month. A margin that drifts down 2 to 3 points per year usually means pricing pressure or rising input costs the seller has not mentioned.
    • Separate recurring revenue and expenses from one-time items in both directions: a one-time contract inflates earnings, a one-time lawsuit expense understates them.
    • Ask who prepares the books. Owner-kept books need more verification than books maintained by an outside bookkeeper or CPA.

    2. Add-Backs and Seller's Discretionary Earnings

    • Demand documentation for every add-back. "Owner's discretionary travel: $18,000" should come with the actual credit card statements, not a spreadsheet line.
    • Verify the owner salary add-back against what it will really cost to replace the owner. If the owner works 60 hours a week and the add-back assumes a $50,000 manager, the earnings are overstated.
    • Look for family members on payroll. Adding back a spouse's salary is only valid if the spouse does no real work; if they run the back office, you are hiring their replacement.
    • Check related-party rent. If the seller owns the building and charges the business below-market rent, your post-close rent will be higher and earnings lower.
    • Reject "growth adjustments" and projected synergies as add-backs. You are buying the business as it performs today.

    3. Revenue Verification

    • Tie reported revenue to 12 to 24 months of bank statements. Deposits should reconcile to the P&L within a small margin; large unexplained gaps are a serious problem.
    • Pull merchant processor and POS reports directly where possible. These are harder to manipulate than exported spreadsheets.
    • Match the P&L to the filed tax returns. If the seller tells you the business earns more than the returns show "because of cash sales," you cannot verify that revenue and should not pay for it.
    • Sample real invoices and match them to payments received. Ten random invoices per quarter is a reasonable sample for a small business.
    • Watch for revenue pulled forward: unusually aggressive Q4 billing, prepaid annual deals booked as current revenue, or channel stuffing right before the listing date.

    4. Accounts Receivable and Accounts Payable

    • Get AR and AP aging reports as of the most recent month-end. Receivables over 90 days old are often uncollectible and should be excluded from working capital.
    • Check for disputed invoices and credit memos. A pattern of credits to one customer can signal quality problems or an informal discount the P&L does not show.
    • Review deferred revenue and customer deposits. If customers have prepaid for work not yet delivered, you inherit that obligation; make sure the purchase agreement accounts for it.
    • Confirm payment terms both ways. A business that collects in 60 days and pays suppliers in 15 will eat more of your cash than the P&L suggests.

    5. Taxes

    • Collect 3 years of federal business tax returns and compare them line by line to the P&Ls you were given.
    • Verify payroll tax filings (Form 941) are current. Unpaid payroll taxes create personal liability and can follow the business assets.
    • Confirm sales tax registration and remittance in every state where the business has customers. Uncollected sales tax is a common hidden liability in e-commerce deals.
    • Review 1099 contractor relationships. Workers treated as contractors who function as employees are a misclassification liability you may inherit.
    • Ask directly, in writing, whether there are open audits, notices, or payment plans with the IRS or any state agency.

    Is the asking price actually fair?

    Run the target's revenue and earnings through BridgeBook's free valuation calculator to see a typical market range before you negotiate. Takes about 5 minutes.

    The Operational Due Diligence Checklist

    The financials tell you what the business earned. Operational diligence tells you whether it can keep earning it without the current owner in the building.

    SOPs and Owner Dependence

    • Are core processes documented, or do they live in the owner's head?
    • Which decisions does the owner personally make every week?
    • Do customers, suppliers, or referral sources deal only with the owner?
    • Could the business run for two weeks with the owner unreachable?

    Key Staff

    • Org chart with roles, tenure, and full compensation including bonuses.
    • Which 2 or 3 people would hurt most if they quit the week after closing?
    • Employment agreements, non-competes, and whether they survive the sale.
    • Turnover rate over the past 24 months versus industry norms.

    Suppliers

    • Top 10 suppliers by spend, with contract terms and price history.
    • Any supplier over 30% of COGS deserves its own risk review.
    • Do supplier agreements or pricing tiers transfer to a new owner?
    • Are there realistic alternatives if the top supplier raises prices 20%?

    Systems and Equipment

    • Full software stack: what runs the business, who owns the accounts, and whether licenses transfer.
    • Who owns the data: customer lists, email lists, ad accounts, analytics history.
    • Equipment list with age, condition, maintenance logs, and replacement cost.
    • Deferred maintenance is a hidden price increase; get quotes before closing, not after.

    The Customer Due Diligence Checklist

    Customers are the asset you are actually buying. Three things determine whether they stay after the sale: concentration, retention, and what holds them to the business.

    Concentration

    Request revenue by customer for the past 3 years. As a rule of thumb most buyers and lenders use: a single customer above 20% of revenue is a risk to price around, above 35% it should reshape the deal structure (earnout or holdback tied to that customer staying), and above 50% with no contract, most buyers should pass.

    • Top 10 customers by revenue, each of the past 3 years, so you can see accounts growing or shrinking.
    • For each major account: contract status, renewal date, and who owns the relationship.
    • Whether any large customer is aware of the sale and how they are likely to react.

    Churn and Retention

    • For recurring-revenue businesses: monthly churn rate, cohort retention, and net revenue retention if available.
    • For transactional businesses: repeat purchase rate and the share of revenue from customers acquired more than a year ago.
    • Compare customer acquisition cost trends over 24 months; rising CAC with flat prices quietly erodes future margins.
    • Read the reviews: Google, industry platforms, and BBB complaints, looking for patterns rather than one-off complaints.

    Contracts and Stickiness

    For each significant customer relationship, determine what actually keeps them: a signed contract with time remaining, switching costs, or a personal friendship with the seller. Contracts with auto-renewal and assignability clauses are the strongest. Relationships that exist because the owner coaches the customer's kid's baseball team are the weakest, and they are more common than sellers admit. Structure transition support and, where concentration is high, contingent payments around exactly these relationships.

    Red Flags That Should Stop a Deal

    Most diligence findings are negotiating points. These are not. If you hit one of these and the seller cannot fully resolve it, the correct move is to walk away, no matter how much time you have invested.

    • Revenue that cannot be verified: If the P&L does not reconcile to bank deposits and tax returns, you are being asked to pay for earnings that may not exist. "Cash sales the books don't show" is a request to buy fiction.
    • Refusal to provide tax returns: There is no legitimate reason a serious seller withholds returns from a buyer under NDA with a signed LOI. None.
    • Undisclosed litigation or tax liens: The problem is not just the liability, it is the disclosure failure. If the seller hid this, assume there is more.
    • A single customer over 50% of revenue with no contract: You are not buying a business, you are buying one relationship that belongs to someone else.
    • A pre-sale revenue spike with no operational explanation: Revenue that jumps 30% in the twelve months before listing, without new products, staff, or marketing spend to explain it, is frequently manufactured or pulled forward.
    • A critical license or lease that cannot transfer: If the thing the business needs to legally operate does not convey, there is no deal to close, only a hope.
    • Books rebuilt without source documents: Recast financials are normal; recast financials the seller cannot support with bank statements, invoices, and receipts are not.
    • Pressure to shorten or skip diligence: Honest sellers with clean books want you to verify everything, because verification is what gets them full price. Pressure to close fast is information.

    How Sellers and Brokers Organize a Data Room

    Knowing how the sell side stages information helps you ask for the right things at the right time, and tells you a lot about how well the deal has been prepared.

    Staged Disclosure

    Brokered deals release information in stages. First you see a blind profile: industry, region, revenue, and earnings, with no identifying details. After you sign an NDA and show proof of funds, you receive the confidential information memorandum (CIM) with the business name and full story. The data room itself, with source documents, usually opens after your LOI is accepted. BridgeBook's marketplace works this way: listings are NDA-gated, and qualified buyers get access once they are verified.

    The Standard Folder Structure

    A well-organized data room is indexed into numbered folders. Expect something close to this:

    • 01 Financials: monthly P&Ls, balance sheets, bank statements, AR/AP agings, add-back schedule with support
    • 02 Tax: federal and state returns, payroll filings, sales tax registrations and remittance history
    • 03 Legal: entity documents, material contracts, lease, licenses and permits, litigation disclosures
    • 04 Operations: SOPs, supplier agreements, equipment lists, software inventory, insurance policies
    • 05 HR: org chart, roster with compensation, employment agreements, benefits summary, handbook
    • 06 Customers: revenue by account, contract copies, churn or retention data, pipeline if relevant

    The Q&A Process

    Most brokered deals run questions through the broker rather than directly to the seller, both to keep the sale confidential from staff and customers and to keep answers consistent and documented. Submit questions in writing, in batches, and keep a log of every answer: those written responses become the basis for the representations and warranties in your purchase agreement. A data room that is indexed, complete, and answered promptly is itself a diligence finding, it tells you the seller prepared properly. A data room that dribbles out documents one email at a time tells you something too.

    Frequently Asked Questions

    How long does due diligence take when buying a business?

    Most small business deals allow 30 to 90 days of due diligence after the letter of intent is signed. Simple asset purchases under $1,000,000 often finish in 30 to 45 days. Larger or licensed businesses (healthcare, government contracting, multi-location) commonly need 60 to 90 days, and SBA lender underwriting frequently runs in parallel and sets the real timeline.

    What documents should I request during due diligence?

    At minimum: 3 years of monthly profit and loss statements and balance sheets, 3 years of business tax returns, 12 to 24 months of bank and merchant processor statements, AR and AP aging reports, customer revenue by account, all material contracts and the lease, licenses and permits, an employee roster with compensation, and documentation supporting every add-back the seller claims.

    What are the biggest red flags in business due diligence?

    The deal-stoppers are revenue that cannot be tied to bank deposits or tax returns, a seller who refuses to share tax returns, undisclosed litigation or tax liens, a single customer over roughly 50% of revenue with no contract, and a sudden revenue spike right before the sale that has no operational explanation. Any one of these justifies walking away or repricing the deal.

    Do I need an accountant and attorney for small business due diligence?

    Yes. A CPA experienced in financial due diligence for small business acquisitions verifies earnings quality, add-backs, and tax exposure, and an attorney reviews contracts, liens, and the purchase agreement. On a typical deal under $5,000,000 this professional help usually costs a fraction of one percent of the purchase price and regularly pays for itself in renegotiated terms or avoided mistakes.

    What happens if I find problems during due diligence?

    You have four options: renegotiate the price, restructure the deal (for example, shift more of the price to an earnout or holdback escrow), require the seller to fix the issue before closing, or walk away. A well-drafted letter of intent makes diligence findings a valid reason to exit without penalty, which is why you should never sign an LOI that locks you in before diligence is complete.

    Ready to Put This Checklist to Work?

    Browse NDA-gated listings on the BridgeBook marketplace, or book a free 45-minute consultation to talk through a deal you are evaluating.