Most acquisition advice treats the due diligence process like a document scavenger hunt. Request the financial statements, read the contracts, ask the seller whether anything is wrong, then move toward closing. That approach feels orderly, but it fails in the places that matter most. A seller's records can be incomplete, inconsistent, or shaped by years of owner-managed shortcuts. Your job isn't to admire the paperwork. It's to verify whether the business can produce the cash flow, retain its customers, transfer its assets, and survive under new ownership.

The historical record shows how demanding this work has become. A 2013 Bayes Business School and Intralinks study found an average diligence period of 124 days, a median of 101 days, an average of 34,426 pages uploaded to the virtual data room, and 152 unique users accessing the information during review. A later Bayes update reported that the average duration had risen to 203 days for deals completed between 2013 and 2022, a 64% increase over the earlier benchmark. (Intralinks and Bayes Business School study)

The implication for an SMB buyer is straightforward. Diligence isn't a passive review before the deal begins. It's the mechanism that tells you what you're buying, what price the evidence supports, and which risks belong in the purchase agreement rather than in your personal balance sheet.

Table of Contents

• The Reality of SMB Due Diligence
  • Ask binary questions first
• Financial and Commercial Verification
  • Rebuild earnings from the ground up
  • Test the revenue that supports the valuation
• Legal, Operational, and Technology Reviews
  • Confirm what transfers at closing
  • Treat technology as operating infrastructure
• Identifying Deal-Killers and Red Flags
  • Investigate the evidence, not the explanation
• Structuring the Deal Based on Findings
• Your Actionable Due Diligence Checklist
  • Financial workstream
  • Legal and commercial workstreams
  • Operational and technology workstreams

The Reality of SMB Due Diligence

First-time buyers often assume that a well-organized seller has a clean business and a disorganized seller has a risky one. That shortcut is unreliable. Small companies routinely mix personal and business expenses, book revenue differently from their tax returns, rely on spreadsheets outside the accounting system, and carry important knowledge in the owner's head. Messy records may be fixable. Polished records may still conceal a customer loss, an unassignable contract, or earnings that won't survive the owner's exit.

The right question isn't, “Did the seller provide every requested file?” It's, “Can I independently verify the facts that determine value and survival?” That shift turns diligence into a verification system. You compare claims against bank activity, tax filings, customer contracts, payroll records, operating systems, and direct conversations with the people who make the business work.

Practical rule: Don't pay for a forecast until you've verified the historical cash generation that supports it.

The stakes are unusually high because transaction failure is common. A CFA Institute summary cites a 70% to 90% failure rate for M&A deals and identifies flawed due diligence as a common cause. Bain's global M&A research also reported that almost 60% of executives attributed deal failure to poor diligence that missed critical issues. (CFA Institute summary of M&A due diligence research)

Those figures don't mean every imperfect file should kill a deal. They do mean that optimism is an expensive diligence strategy. Buyers need to classify findings by consequence, not by how annoying the paperwork is.

Ask binary questions first

The highest-value questions often have yes-or-no answers:

• Can the core customer contracts be assigned at closing?
• Can a major customer terminate after receiving notice of the sale?
• Are debt covenants triggered by the transaction or a change of control?
• Does the reported EBITDA reconcile to cash and recurring operating activity?
• Does the seller own the software, brand assets, domain names, and other core IP?
• Can key employees continue operating the business without the seller?

These questions matter more than reading every page in sequence. The purpose of a virtual data room isn't to reward the buyer who opens the most files. It's to expose facts that change valuation, financing, closing conditions, or the decision to proceed. Buyers researching buying an existing business the pros and can use that broader context to balance the benefits of acquiring operating history against the risks that diligence must uncover.

A skeptical practitioner also knows when to stop. If the seller refuses access to primary evidence, changes explanations repeatedly, or treats basic verification as an insult, the behavior itself becomes deal information. Trust matters after closing, but trust isn't a substitute for proof before it.

Financial and Commercial Verification

Seller-prepared profit and loss statements establish a starting point. They do not establish maintainable earnings. In an owner-operated SMB, reported EBITDA may contain legitimate add-backs, personal expenses, unusual repairs, differences in owner compensation, or costs the buyer will still carry after closing. Rebuild the earnings story from primary records, then test whether it matches how the business sells, delivers, collects, and retains customers.

Start with a period-by-period reconciliation. Collect operating bank statements, tax filings, merchant processor reports, accounts receivable aging, payroll records, and the general ledger. Compare revenue and expense categories across each source. Identical formatting is unnecessary. Material differences need specific explanations, supporting documents, and a clear conclusion about normalized earnings.

Rebuild earnings from the ground up

Use a sequence that forces each adjustment back to evidence:

1. Trace revenue to cash. Match reported sales with deposits, merchant settlements, invoices, refunds, chargebacks, and deferred revenue. Revenue growth without matching deposits, customer activity, or receivables requires investigation.

2. Test the add-backs. For every adjustment, ask whether it is nonrecurring, personally attributable to the seller, and removable after closing. If the seller says a cost will disappear, identify who performs the related work now and what will replace it.

3. Compare tax filings. Tax returns may follow different accounting rules, but unexplained gaps between taxable income, management accounts, and bank activity require a written bridge. “The accountant handles it” is not a bridge.

4. Validate working capital. Examine inventory records, payable timing, receivable collectability, deposits, refunds, and seasonal cash requirements. A profitable company can still create an immediate cash squeeze if normal working capital was understated.

A financial due diligence checklist for acquisitions helps organize requests, but it cannot interpret contradictions. Assign one deal-team owner to reconcile the records and document the reasoning behind every adjustment.

Test the revenue that supports the valuation

Aggregate revenue can hide customer-level weakness. Review the largest accounts individually through contracts, invoices, payment history, renewal behavior, service complaints, and account-manager notes. Establish each customer's share of revenue, pricing protection, renewal terms, and dependence on the seller's personal relationship.

Customer concentration deserves special attention in smaller businesses. Diligence guidance from Nstar Finance notes that one client can represent more than 20% of revenue, increasing exposure to a customer decision or default. (SMB M&A due diligence guidance from Nstar Finance) If that customer could leave, reduce volume, renegotiate pricing, or create a covenant issue, model the exposure directly. A broad sensitivity table can conceal the specific account that drives the risk.

Finding	Verification question	Likely response
Revenue spike	Is the increase supported by contracts, deposits, and delivery records?	Recast earnings or investigate timing
Large add-back	Will the cost disappear without replacement?	Remove or discount the add-back
Customer concentration	Can the account terminate or reduce spend after closing?	Use a holdback, earn-out, or lower valuation
Receivables growth	Are invoices collectible under normal payment behavior?	Adjust working capital and cash assumptions

Commercial verification should end in a cash-flow view that a lender, operator, and buyer can all follow. If earnings depend on optimistic collections, retention, or add-backs, the finding affects price and deal structure. It may require a holdback, earn-out, working-capital adjustment, or a decision not to proceed.

Legal, Operational, and Technology Reviews

Financial diligence tells you whether the historical economics are credible. Legal, operational, and technology diligence tells you whether those economics can continue after the ownership transition. At this stage, many buyers discover that the business's most valuable asset isn't fully transferable, documented, secured, or resilient.

Confirm what transfers at closing

Review every material customer, supplier, lease, licensing, distribution, franchise, and financing agreement for assignment and change-of-control language. Then connect each contract to the asset or revenue stream it supports. A contract that appears valuable on paper may require consent, expire soon, permit termination, or impose obligations that weren't included in the seller's summary.

The same discipline applies to assets and people. Confirm ownership and transferability of trademarks, domain names, software code, customer data rights, equipment, permits, and licenses. Check whether key employees have written agreements, restrictive covenants, confidentiality obligations, and compensation arrangements that the buyer can maintain.

Operational diligence should expose dependence on informal workarounds. Map order flow, billing, fulfillment, quality control, vendor relationships, customer support, and management reporting. If one employee alone knows how to run a critical process, you haven't acquired a system. You've acquired a continuity risk.

Use legal standards for business acquisitions as a reference point, but tailor the review to the target's actual contracts, jurisdiction, workforce, and regulatory exposure. An automated document review tool can help surface clauses and organize large document sets, but it shouldn't replace counsel's judgment on enforceability, liability, or transaction-specific drafting.

Treat technology as operating infrastructure

Technology diligence is no longer a specialist review that happens after finance and legal. In a 2026 M&A due diligence study, 47% of respondents identified technology diligence as their main priority over the previous 12 months, while 51% called it the most burdensome part of the review. The same study found that 84% expect cybersecurity scrutiny to increase over the next 12 to 24 months. (SRS Acquiom 2026 M&A due diligence study)

A credible technology review should answer practical questions:

• System ownership: Who owns the code, accounts, licenses, domains, data, and integrations?
• Architecture: Can the current stack support the business without immediate replacement?
• Security: How are access, backups, incident response, vendor risk, and employee offboarding managed?
• Technical debt: Which systems are fragile, unsupported, undocumented, or dependent on one contractor?
• Data flows: Where does customer and employee data go, and which vendors can access it?
• AI use: Which tools, models, automations, and datasets are used in sales, support, operations, or decision-making?

AI governance deserves its own inventory. Ask who approved each use case, what information enters the system, whether outputs are reviewed, whether the vendor retains prompts or data, and what happens when the tool produces an inaccurate, biased, or confidential result. Buyers are increasingly asking for AI inventories, AI risk assessments, and specific representations and warranties. A standard technology schedule that only lists software subscriptions won't answer those questions.

This video provides another visual way to think about the distinct diligence workstreams and their interaction:

The practical trade-off is speed versus certainty. A buyer shouldn't perform an enterprise-scale audit on every small target, but skipping technology and cyber review can turn a quick closing into an expensive transition. Scope the work according to dependency. If the company relies on software, data, automation, or online customer acquisition, technology belongs near the front of the diligence queue.

Identifying Deal-Killers and Red Flags

A target does not become unacceptable because every process is imperfect. The buyer's job is to separate deal-killers, valuation adjusters, and post-close projects. That classification prevents two expensive errors: abandoning a fixable administrative problem, or excusing a structural risk because the buyer wants the deal to work.

Consider a service company reporting strong adjusted earnings. Bank activity broadly supports the deposits, yet several large customers have no signed agreements. The seller says the relationships are longstanding and “everyone understands the arrangement.” That may be manageable if customers confirm continuity and the purchase agreement protects the buyer. It becomes a valuation problem when the relationships depend on the departing owner, can end without notice, or cannot be verified independently.

Change one fact and the conclusion changes. If the seller records revenue before the customer accepts delivery, the issue is not merely an accounting preference. Test the reversals, collectability, tax treatment, and effect on sustainable earnings. A line item can require an adjustment or stop the transaction, depending on intent, scale, and the seller's willingness to correct it openly.

Investigate the evidence, not the explanation

In a live issues register, these findings recur most often, and each one demands primary verification. (SMB M&A due diligence guidance from Nstar Finance)

• Litigation: Search available records, obtain counsel's matter-by-matter schedule, inspect insurance notices, and compare disclosures with correspondence and legal invoices.
• Tax exposure: Obtain filings, notices, payment histories, sales-tax and payroll-tax records, and communications with tax authorities. Establish whether any liability belongs to the pre-close period and how payment will be secured.
• Revenue quality: Match invoices with delivery, acceptance, collections, refunds, and customer confirmations. Check for end-of-period spikes and credits issued after reporting dates.
• Employee stability: Compare payroll trends, departures, open roles, complaints, and compensation promises. A low payroll figure may reflect underpaid employees who will not remain after closing.
• Vendor dependence: Identify suppliers with no practical substitute, unusual payment terms, personal relationships, or ownership links to the seller.
• Technology control: Verify who owns critical code, automation, accounts, customer data, and AI-generated work product. A business can appear operationally sound while access depends on one employee, an unassignable account, or a vendor whose terms permit data reuse.

The modern red flag is often a mismatch between what management says a system does and what the records show. Test automated pricing, lead handling, customer support, and decision rules against actual outputs. Look for missing approval trails, unexplained changes, confidential data entering external tools, and results no one can reproduce. These findings can affect ownership, privacy, customer commitments, and the buyer's ability to operate after closing.

A hidden tax balance may be addressed through a purchase-price adjustment, escrow, indemnity, or special covenant. Fraud, fabricated customers, unowned core intellectual property, or technology that cannot be transferred usually require a much harder response. The practical test is whether the buyer can identify the risk, quantify the downside, and enforce protection after closing.

A fixable flaw has a clear owner, a credible remedy, and a cost you can carry. A deal-killer removes one of those three conditions.

Seller confidence is not corroboration. Request the underlying record, speak with the relevant counterparty where appropriate, and record the answer in a closing issues list. If the explanation changes when evidence arrives, treat that change as a risk signal, not a minor communication problem.

Structuring the Deal Based on Findings

Diligence findings should change the deal, not merely populate a report. If a customer relationship is valuable but uncertain, keep part of the consideration contingent on retained revenue or completed milestones. If the seller's earnings depend on a transition that hasn't been demonstrated, use seller financing or an earn-out to keep the seller economically connected to the outcome.

The structure should match the risk:

• Seller financing can create repayment influence when the buyer needs the seller to support transition, preserve relationships, or stand behind representations.
• An earn-out can bridge a valuation gap when future performance is measurable and the metrics can't be manipulated by either party.
• A holdback or escrow can reserve funds for identified liabilities, tax exposure, indemnity claims, or unresolved customer issues.
• A purchase-price adjustment can address working capital, debt, inventory quality, or earnings normalization that can be measured at closing.

These tools aren't interchangeable. An earn-out is a poor remedy for a risk the buyer can't observe or control. A broad indemnity is weak protection when the seller has no remaining assets or repayment capacity. A holdback should have clear release conditions, claim procedures, survival periods, and access to evidence.

Technology findings require equally specific drafting. If the target uses AI, the representations should address identified systems, data use, ownership, vendor terms, compliance practices, security incidents, and undisclosed automated decision-making. If the codebase depends on a contractor, make source-code delivery, credentials, documentation, and transition support closing conditions rather than informal promises.

The cleanest negotiation language connects each protection to a documented finding. “We discovered that the top account can terminate on a change of control, so part of the consideration will remain contingent on retention” is stronger than demanding a generic discount. Diligence creates negotiating power when the buyer can explain the risk, its likely consequence, and the term that directly mitigates it.

Your Actionable Due Diligence Checklist

Run the process from a live issues register, not from a folder of downloaded documents. Give every request an owner, status, date received, source, reviewer, open question, and consequence for price or closing. Mark evidence as verified, contradicted, incomplete, or awaiting third-party confirmation.

Financial workstream

• Verify bank statements: Reconcile deposits, withdrawals, transfers, merchant settlements, and unusual transactions to the reported accounts.
• Rebuild EBITDA: Test every add-back against invoices, payroll, tax records, and the post-close operating plan.
• Test revenue quality: Trace major accounts through contracts, billing, delivery, collections, refunds, and renewal evidence.
• Review working capital: Confirm inventory existence and condition, receivable collectability, payable timing, deposits, and normal cash requirements.

Legal and commercial workstreams

• Review contracts: Identify assignment rights, change-of-control provisions, termination rights, renewal dates, exclusivity, and liability caps.
• Confirm ownership: Verify IP, domains, software, equipment, permits, licenses, and customer data rights.
• Investigate liabilities: Obtain litigation, tax, debt, lien, insurance, employee, and regulatory information from primary records.
• Validate customers and vendors: Determine concentration, dependency, pricing stability, replacement options, and post-close continuity.

Operational and technology workstreams

• Map critical processes: Document how sales, delivery, billing, support, purchasing, and reporting operate without the seller.
• Review people risk: Identify key employees, undocumented responsibilities, compensation commitments, retention concerns, and transition dependencies.
• Inventory technology: List systems, integrations, administrators, vendors, licenses, code repositories, data stores, and renewal obligations.
• Test cyber and AI controls: Review access management, backups, incident history, vendor exposure, AI use cases, data flows, human review, and ownership of outputs.

Before signing, convert unresolved findings into explicit closing conditions, purchase-price adjustments, covenants, escrows, indemnities, or post-close projects. A business acquisition due diligence checklist framework can give your team a repeatable structure, but the final decision must come from verified facts and a clear downside analysis.

The purpose of this process isn't to produce a perfect file. It's to know which facts are proven, which risks are priced, which protections are enforceable, and which unanswered questions make the acquisition unacceptable.

---

Dealmaker Wealth Society provides acquisition training, mentorship, deal-structuring guidance, playbooks, and peer support for people buying and growing small businesses. Visit Dealmaker Wealth Society to access practical resources for evaluating active deals, organizing diligence, negotiating terms, and planning the transition after closing.