TL;DR: Due diligence is the 45-to-60-day window between signing an LOI and closing. According to the Stanford Graduate School of Business 2024 Search Fund Study, operators who run disciplined due diligence close better deals and spend less time fixing problems after the wire. This checklist covers the six areas that matter most for a lower-middle-market acquisition.
Most deals that go sideways were not surprises. The signals were there during due diligence. The buyer either did not look, did not know what to look for, or looked and decided to ignore the data.
EOD doctrine applies here: identify the threat before you neutralize it. The acquisition checklist is not a formality. It is the systematic threat-identification process that lets you close with confidence or walk away with your capital intact.
Here is how to run it.
The six tracks of acquisition due diligence
Treat each track as a parallel workstream, not a sequential list. Run financial and legal simultaneously. Bring your lender in on Day 1, not Day 30. Operators who run diligence as a project with milestones close faster and discover more than operators who work through items as documents arrive.
1. Financial due diligence
This is the foundation. Start by reconciling three years of federal tax returns against three years of P&L statements. They should tell the same story. When they do not, investigate. When the internal P&L shows significantly higher profit than the tax return, you need to understand every dollar of that gap before you price the deal.
Request these documents from Day 1:
- Three years of federal and state income tax returns
- Three years of accrual-basis P&L statements and balance sheets
- Monthly revenue reports for the last 24 months
- Accounts receivable and payable aging schedules
- The seller's complete add-back schedule with documentation for every line item
Every add-back needs a receipt, a payroll record, or a bank statement. Undocumented add-backs that you accept in the LOI become disputes during SBA lender underwriting when documentation cannot be produced.
Watch for: revenue growing on the P&L but flat on the tax return, large one-time expenses that appear under different line items every year, and cash deposits that do not show up in reported revenue. These are not always fraud. Sometimes they are sloppy bookkeeping. You need to know which before you close.
2. Customer due diligence
Not all revenue is equal. The gap between recurring contracted revenue and one-time project revenue can shift a valuation multiple by 1 to 2 turns. Customer due diligence tells you what you are actually buying.
Request a customer revenue schedule showing the top 25 customers by revenue for each of the last three years. Look for:
- Any single customer representing more than 20% of total revenue. This is a concentration risk that banks will price into financing terms and acquirers should price into the purchase price.
- Customers whose spend has declined year-over-year. These are early churn signals.
- Contracts that expire within 12 months of your projected close date.
- Customers who are personal relationships of the seller, not institutional relationships of the business. Personal-relationship revenue does not always survive a transition.
The customer concentration question is where many first-time buyers get hurt. A business with $2M in EBITDA but 35% of revenue concentrated in one account is not worth 5x. It is worth 5x minus a meaningful risk discount, or it requires a contractual earn-out tied to that customer's retention post-close.
3. Legal due diligence
Legal diligence is not about finding lawsuits. Most clean small businesses have no active litigation. It is about finding structural problems that could prevent the deal from closing or create liability you inherit post-close.
The highest-risk items:
- Change-of-control clauses. Key customer contracts, vendor agreements, and leases sometimes have provisions that allow the counterparty to terminate upon a sale. If the business's primary lease has a change-of-control clause and the landlord has leverage, that clause can kill a deal at the finish line.
- IP ownership. Software, trade secrets, and proprietary processes should be owned by the entity being acquired, not by the founder personally. Confirm this before closing.
- License transferability. Regulated industries require licenses that may need to be re-applied for under new ownership. Know the timeline before you sign an LOI.
- Pending or threatened litigation. Ask the question in writing. Request representations that no material litigation exists or is threatened.
4. Operational due diligence
The central question in operational diligence is simple: does this business run without the owner?
Businesses that depend entirely on the seller's relationships, technical knowledge, or daily presence are worth less than the financial statements suggest. Businesses with documented processes, trained teams, and institutional customer relationships can command full multiples because the acquirer is not buying a job.
Assess:
- Standard operating procedures and whether they are documented
- Team tenure and compensation versus market rates
- Physical asset condition: equipment, fleet, facilities
- Technology and software: confirm these are owned by the business, not the seller personally
- Vendor relationships and any single-source dependencies
Walk the floor. Meet the key employees. Ask the general manager what happens on the seller's vacation. The answers will tell you more than the documents will.
5. Human resources due diligence
Review employment agreements, non-compete agreements for key personnel, compensation structures, and any open workers' compensation claims. Understand the payroll tax history. Payroll tax liabilities from a prior owner can become your problem depending on how the deal is structured.
If the deal includes an asset purchase, this is less acute. If it is a stock purchase, payroll liabilities, 401(k) compliance issues, and potential wage-and-hour claims transfer with the entity. Review the HR history with your attorney before deciding on deal structure. The SBA's guidance on buying a business covers the entity structure decision in practical terms.
6. Working capital diligence
Working capital is the amount of cash the business needs to operate day-to-day. Most buyers negotiate a working capital target in the purchase agreement. If the seller closes with less working capital than the agreed target, the purchase price adjusts down. If more, the price adjusts up.
Define working capital clearly before closing. Common disputes arise from different calculations of accounts receivable quality, inventory valuation, and what counts as current versus non-current items. Build your working capital analysis from actual 12-month trailing data, not from a single month's snapshot.
See the related article on working capital pegs in acquisitions for a detailed walkthrough of how to set and defend a peg target.
How long does this take?
A standard lower-middle-market acquisition runs 45 to 60 days from LOI to close. Deals with SBA financing typically run 60 to 90 days because the lender adds its own diligence layer. Deals with environmental concerns, licensing complexity, or contentious purchase agreement negotiations run longer.
Set milestones. Financial review complete by Day 14. Legal review by Day 30. Management interviews by Day 35. All advisor reports by Day 42. Purchase agreement draft by Day 50. Missing milestones without renegotiating the exclusivity period is how deals die or close badly.
What kills deals in diligence
Four things end more deals than anything else:
- Financial discrepancies between the CIM and the actual tax returns that cannot be explained
- Customer concentration above 30% without contractual protection
- Owner dependency so severe the business cannot function after a 90-day transition
- Title or licensing issues that cannot be resolved before close
None of these should surprise an operator who ran the process right. If they surface late, it is because someone did not look hard enough early.
The EOD mindset: identify the threat early, clear the path, or walk away. Due diligence is not about finding reasons to kill deals. It is about finding facts. Let the facts drive the decision.
Frequently Asked Questions
How long does acquisition due diligence typically take for a small business?
Most lower-middle-market acquisitions run 45 to 60 days from LOI to close. Deals using SBA financing run 60 to 90 days because the lender adds its own review layer. Complex situations involving licensing, environmental issues, or difficult purchase agreement negotiations can extend beyond 90 days.
What is the biggest red flag in financial due diligence?
A material gap between the internal P&L and the federal tax return that the seller cannot document. This gap should be explainable line by line. If the seller claims add-backs that cannot be supported with receipts or bank records, the financial story cannot be verified and the deal price should reflect that uncertainty.
What does customer concentration above 20% mean for a deal?
Any single customer representing more than 20% of revenue is a concentration risk. It means the business's earnings depend on that one relationship surviving the transition. Buyers typically request a price adjustment, an earn-out tied to customer retention, or a contractual commitment from the departing seller to maintain the relationship post-close.
Should I run legal and financial due diligence at the same time?
Yes. Running legal and financial review in parallel compresses the timeline and surfaces issues earlier. Engaging your attorney on Day 1, not after financial review is complete, is standard practice for experienced acquirers. The same logic applies to the SBA lender if you are using SBA financing.
