The Complete Guide to Business Acquisition Due Diligence

You've signed the LOI. Exclusivity is running. The seller has agreed to your price and structure. Now comes the part of the acquisition process that buyers either treat seriously or live to regret — the diligence period where you verify that the business you agreed to buy is actually what the seller represented it to be.

Most buyers know diligence matters. Most buyers also underestimate what it takes to do it well: which workstreams to prioritize, where sellers commonly obscure material information, when to engage specialists, and how to translate findings into deal terms that protect you at close. This guide covers the complete framework.

The Purpose of Diligence (Beyond "Verifying the Numbers")

Diligence serves two functions that buyers often conflate. The first is deal confirmation: verifying that the business you're buying matches what was represented in the offering materials. The second is deal intelligence: building the understanding of the business that you'll need to run it, identify the post-close risks, and prioritize your first 90 days.

The cost of thorough diligence — professional fees for attorneys, accountants, and specialists — runs roughly 3%–6% of deal value. For a $2M acquisition, that's $60K–$120K. The cost of closing on a bad deal is typically 10–50x that amount, and it comes due over years of operational struggle rather than as a clean invoice.

Findings fall into three categories:

• Deal-breakers: Material misrepresentation, undisclosed liabilities, or fundamental business problems that justify walking away
• Negotiating leverage: Issues that are real but manageable — used to reduce purchase price, add seller indemnification provisions, or require escrow holdbacks
• Operational intelligence: Information that doesn't change the deal but shapes how you run the business post-close

Running diligence with the mindset of "I'm looking for reasons to walk" is wrong. Running it with the mindset of "I'm trying to understand what I'm buying" is right. The walk decision usually makes itself.

Calibrating Diligence Scope to Deal Size

Diligence intensity should match deal complexity. A $600K service business acquisition doesn't warrant the same process as a $4M ecommerce brand acquisition.

Sub-$1M deals: Basic financial verification (three years of tax returns and P&Ls), a legal review of key contracts and corporate records, and targeted operational assessment. Professional fees typically run $5K–$20K. The goal is confirming the financial story holds and there are no lurking liabilities.

$1M–$5M deals: This is the range where scope decisions matter most. Financial diligence expands to include monthly revenue breakdowns, detailed add-back analysis, and often a Quality of Earnings report for deals above $2M. Legal review covers all material contracts. Operational diligence gets more systematic. Professional fees run $25K–$65K for well-organized processes.

$5M+ deals: Institutional-quality diligence. A full QoE is standard — often required by lenders. Legal diligence involves specialists (IP counsel, real estate, regulatory). Environmental assessments where relevant. Professional fees run $75K–$200K+.

For a granular topic-by-topic diligence checklist, see The Business Acquisition Due Diligence Checklist.

Financial Diligence: Where Most Issues Hide

Financial diligence isn't just confirming that the income statement matches the tax returns. It's developing an independent view of what the business actually earns after you've normalized for everything that doesn't reflect the ongoing business.

The Three-Year Foundation

Request and reconcile: three years of federal tax returns (business and personal), three years of profit and loss statements (monthly breakdown, not annual), bank statements for the same period, and general ledger access for at least the trailing 24 months. The comparison between reported P&Ls and filed tax returns is the first check — material unexplained discrepancies are a red flag.

Monthly breakdowns matter because they reveal seasonality patterns, revenue trends within years, and anomalies that annual figures smooth over. A business with $1.2M SDE annually that declined 35% in the most recent 6 months is not worth the same as one with flat or growing performance. Annual numbers hide what monthly numbers show.

The Add-Back Problem

In most small business acquisitions, the seller will present Seller's Discretionary Earnings (SDE) — net income restated to add back owner compensation, owner benefits, non-recurring expenses, and discretionary spending. SDE is the right metric for valuing owner-operated businesses under $5M. The problem is that add-backs are where sellers make the most optimistic assumptions.

Legitimate add-backs include: owner salary and draws in excess of market-rate replacement management, personal expenses running through the business P&L (owner's vehicle, phone, health insurance), one-time expenses that genuinely won't recur, and non-cash expenses like depreciation and amortization.

Aggressive add-backs include: "one-time" legal or consulting expenses that appear every year, revenue that hasn't materialized yet, expenses the buyer will actually incur in running the business, and inflated owner compensation that understates the real cost of replacement management.

A general threshold: add-backs exceeding 30% of reported net income warrant close scrutiny. That doesn't mean they're wrong, but they need to be individually documented and verified. For deals above $2M, a Quality of Earnings engagement — a third-party accountant's independent normalization of the financials — removes this ambiguity. QoE providers charge $15,000–$25,000 and typically find either confirmation or issues that justify negotiating the price. See Quality of Earnings Reports: When You Need One and Add-Backs: Legitimate vs. Aggressive.

Revenue Quality

Not all revenue is equal. Recurring revenue (subscriptions, maintenance contracts, retainers) is more valuable and more reliably projectible than project-based or one-time revenue. Diversified revenue across many customers is less risky than revenue concentrated in a handful.

Analyze revenue concentration by customer (if more than 25% of revenue comes from a single customer, that's a material underwriting risk), by channel (is the business dependent on a paid advertising channel that could be disrupted?), and by product or service (does one SKU or engagement type represent a disproportionate share of revenue?).

For digital businesses, verify traffic data directly — Google Analytics access, seller-side revenue dashboards, Shopify or Amazon seller data. Revenue represented in offering documents should be verifiable against platform-level data. See Customer Concentration Risk in Acquisitions.

Working Capital Analysis

Working capital dynamics determine what the business actually needs to operate — and they directly affect your financing. Monthly working capital analysis over 24 months shows seasonality, collection efficiency, and whether the agreed-upon working capital peg in the LOI reflects what the business actually requires to run. See Working Capital Adjustments at Close.

Legal Diligence: What the Contracts Actually Say

Most buyers without legal backgrounds underestimate how consequential contract diligence is. The legal workstream isn't primarily about identifying legal disputes — it's about understanding the obligations that transfer with the business.

Assignment and Change-of-Control Provisions

In an asset purchase, every material contract the seller has with customers, vendors, landlords, and employees needs to be reviewed for assignability. Many contracts require the counterparty's consent to assignment. Some automatically terminate on change of control. A critical customer contract that can't be assigned without consent is a deal risk that needs to be resolved before closing, not after.

The commercial lease is the most common issue here. Most commercial leases require landlord consent to assignment and include change-of-control provisions. If the location is material to the business, landlord consent is a closing condition. See Commercial Lease Assignment in Acquisitions.

Corporate Records and Licensing

Verify that the business entity is in good standing in all states where it operates, that all required business licenses and permits are current, and that there are no outstanding regulatory actions. For licensed industries — healthcare, childcare, financial services, food service — licensing transferability is often the central legal issue. A dental practice, a pharmacy, or a licensed contractor business has licensing requirements that may require new applications, temporary licenses, or waiting periods.

Litigation and Claims History

Request a comprehensive disclosure of all pending litigation, threatened claims, regulatory investigations, and insurance claims history. Pattern issues — recurring employment disputes, repeated customer complaints, ongoing regulatory friction — reveal operational problems that financial statements don't.

For sellers who represent "no pending litigation," get it in writing in the representations and warranties of the purchase agreement, with appropriate indemnification provisions and survival periods. Reps and warranties coverage on specific deal risks is worth the negotiation.

Material Contracts

Review the top 20% of customer contracts by revenue, all vendor agreements with material value or operational dependency, and any exclusivity or non-compete arrangements that affect the business's competitive position. Understand termination provisions — a customer who can terminate on 30-day notice is not the same credit quality as one with a two-year contract.

Operational Diligence: Can You Run This?

The question financial and legal diligence doesn't fully answer is whether the business can actually be operated by a buyer who isn't the current owner. Operational diligence is where you find out.

Key-Person Dependency

The most significant operational risk in small business acquisitions is the business that only works because of who currently runs it. Customer relationships held personally by the founder, technical knowledge that exists only in one employee's head, supplier relationships built on personal trust rather than contracts — these are real risks.

Assess: What happens to revenue if the seller leaves on day 90? Are there employees who would follow the seller to a new venture? Do the top three customers have relationships with the business or with the founder personally? Are there processes documented well enough for someone new to follow them?

This is also why transition services agreements and non-compete provisions matter. A seller who commits to 12 months of transition support, prohibits themselves from competing, and agrees to make seller-side introductions to key relationships reduces the key-person risk substantially. See Transition Services Agreements.

Staff and Compensation

Review the full employee roster, compensation structure, and any existing employment agreements or retention arrangements. Identify key employees beyond the founder — the people whose departure would disrupt operations or customer relationships. Plan retention proactively: retention bonuses structured around 12–18 months post-close have a real cost but also real value.

Supplier and Vendor Relationships

For product-based businesses, supplier dependency and pricing is a central operational consideration. Single-source suppliers create concentration risk — understand whether alternatives exist and at what cost. In 2026, with tariff uncertainty affecting imported goods, understanding where products are manufactured and what tariff exposure the business carries is especially relevant. See How Tariffs Are Reshaping Ecommerce Acquisitions in 2026.

Intellectual Property Diligence

For ecommerce, SaaS, digital agencies, and content businesses, intellectual property is often the majority of what you're actually buying. It deserves specific attention.

Trademarks: Is the brand name federally registered? If yes, who owns it — the business entity or the founder personally? A trademark registered in the founder's personal name doesn't automatically transfer with the business assets — it needs a specific assignment recorded with the USPTO. If the trademark isn't registered, what's the exposure?

Domains: Who controls the domain names — what registrar, under what login credentials? Domain transfer is mechanical but needs to be planned. Secondary domains (for SEO, brand protection, or geographic markets) are often overlooked.

Proprietary software and technology: For SaaS businesses, get access to the codebase and have an independent technical reviewer assess code quality, documentation, infrastructure costs, and technical debt. Inheriting a SaaS business running on undocumented legacy code with one person who understands it is a specific operational risk.

Content and customer data: For content businesses, verify ownership of published content (particularly for content that was commissioned or acquired). For all businesses, understand what customer data you're acquiring, whether that data can be transferred under current privacy policies and applicable law, and what the data is worth.

See IP Diligence in Ecommerce Acquisitions for a full IP diligence framework.

Industry-Specific Diligence Priorities

Category determines what matters most:

Amazon FBA: Platform account health, TOS compliance history, Brand Registry status, ASIN concentration, and the mechanics of the account transfer process. Amazon's account transfer process is documented but requires attention — a clean handoff needs planning.

SaaS: Churn rate and NRR are the central metrics. A business reporting 5% monthly churn loses more than half its customer base annually. Technical diligence (code quality, infrastructure, security) and customer contract review (terms, renewal rates, annual vs. monthly billing mix) are also central.

Home services, restaurants, healthcare: Licensing is the governing issue. Understand which licenses are required, which transfer automatically and which require new applications, and what the timeline for licensing approvals is. Deals where the buyer can't legally operate the business until licensing transfers need to account for that in the timeline and the closing structure.

Content and affiliate sites: SEO traffic trajectory is the central financial diligence issue. Verify traffic data directly through Google Analytics access and Search Console. Look for algorithm-update sensitivity in the historical traffic data. Understand affiliate program diversification and the terms of key affiliate relationships.

Translating Findings Into Deal Terms

Diligence findings are most useful when they're translated into concrete deal terms, not just noted.

A revenue decline discovered in diligence doesn't just matter in isolation — it justifies a lower purchase price, an earnout structure tied to revenue targets, or a larger seller indemnification holdback. Customer concentration that's worse than represented justifies a specific indemnification provision covering the loss of named customers within 12 months of close.

The representations and warranties section of the purchase agreement is where diligence findings become legal protections. Work with experienced acquisition counsel to ensure that the things you discovered in diligence — and the things you were told are fine but couldn't fully verify — are covered by specific reps with appropriate survival periods and indemnification provisions.

For larger transactions where R&W insurance makes sense, understand what the policy covers and what it excludes before relying on it as a substitute for thorough diligence. See Reps and Warranties Insurance.

For the discipline of knowing when findings are serious enough to walk: see When to Walk Away From an Acquisition.

Diligence Timeline Management

A 60–90 day exclusivity period sounds like a long time. It isn't, once you account for how long it takes to receive documents, how often sellers provide incomplete responses, and how much parallel processing is required.

Week 1–2: Submit comprehensive document requests immediately after LOI execution. Don't wait. Engage your acquisition attorney and flag the QoE decision for the accountant. Build your diligence tracking document.

Weeks 2–4: Initial financial review and first legal pass. Identify gaps in the document production — missing months, inconsistent data, absent contracts. Follow up on gaps before they become deadline problems. Engage the QoE provider if proceeding.

Weeks 3–6: Deep financial analysis, full legal review, operational assessment. Customer and supplier interviews (where appropriate). Specialist engagements running.

Weeks 6–8: Findings synthesis and negotiation preparation. Translate issues into specific term adjustments. Coordinate with lender — underwriting should be running in parallel. Prepare for definitive agreement negotiation.

Weeks 8–10: Final documentation, open issue resolution, lender coordination for closing. Closing conditions satisfied.

Delays from sellers in providing documents are the most common cause of exclusivity expiration. Build enough buffer to absorb two weeks of seller response lag and still complete your process.

Getting Help

Diligence done well requires a team: acquisition attorney, tax CPA, QoE accountant, and specialists for industry-specific issues. See Building Your Acquisition Deal Team for how to assemble these relationships before you need them.

Our team at eCommerce Lending coordinates financing parallel to the diligence process — lender underwriting, loan application preparation, and deal structure work that needs to happen on the same timeline. Getting prequalified before you identify a target means the financing workstream doesn't hold up the diligence workstream.

Start with a prequalification to understand your financing profile before your next LOI.