Financial Due Diligence Checklist for Buying a Business

What Financial Due Diligence Is (and Is Not)

Financial due diligence is not an audit. An audit is a formal attestation by a CPA that financial statements present fairly in accordance with GAAP. Most small business sellers have never been audited — their financials are internally prepared or CPA-reviewed at best.

Financial due diligence is a verification process. The buyer (typically with the help of an accountant, a buy-side advisor, or a QoE analyst) tests the seller's representations against source documents: tax returns, bank statements, contracts, payroll records, and invoices. The goal is to answer three questions:

1. Is the SDE or EBITDA the seller presented actually supported by the records? 2. Are the add-backs the seller claimed actually one-time, non-recurring, and documentable? 3. Is the revenue trend what it appears, and is the customer base as stable as represented?

Buyers who skip financial due diligence — or who treat it as a formality — consistently overpay. Buyers who conduct thorough due diligence either confirm the value and close with confidence, or find the issues that justify a price reduction or deal termination before they're on the hook for the full purchase price.

For context on how financial due diligence fits into the full M&A process, see the mergers and acquisitions beginner's guide. For how verified financials feed into valuation, see how to value a business.

The Financial Due Diligence Document Request List

Your first step in financial due diligence is requesting the document package. Send this list to the seller or their broker at the start of the exclusivity period. Give the seller a deadline — two weeks is standard — and monitor completeness.

Standard document request for a business acquisition:

• 3 years of business federal income tax returns (Form 1120, 1120S, or Schedule C/1065 as applicable)
• 3 years of business state income tax returns
• 3 years of profit and loss statements (P&Ls), preferably monthly
• Current year-to-date P&L and balance sheet
• 3 years of business bank statements (all accounts — checking, savings, merchant accounts)
• Accounts receivable aging report (current)
• Accounts payable aging report (current)
• Payroll records for the last 2 years (payroll journals or QuickBooks payroll reports)
• Copies of all business loans, lines of credit, and lease agreements
• Seller's add-back schedule with supporting documentation for each add-back claimed
• Customer list with annual revenue per customer for the most recent 12 months
• Top 10 customer contracts (if revenue is contract-based)
• Vendor/supplier contracts (key relationships, pricing agreements)
• Equipment list with purchase dates, book value, and current condition
• Any existing purchase offers, letters of intent, or NDAs with other buyers
• Business licenses, permits, and certifications (copies)
• Any pending or threatened litigation, regulatory actions, or audit notices
• Workers' compensation and general liability insurance certificates
• Lease agreement (commercial space or equipment leases)
• Franchise agreement (if applicable)

Verifying the Income Statement: Step by Step

The income statement verification is the core of financial due diligence for most small business acquisitions. The goal is to independently confirm the SDE or EBITDA the seller presented in their CIM or broker package.

Step 1: Reconcile tax returns to P&Ls. Take the business's gross revenue from the tax return and compare it to the P&L for the same year. These numbers should be identical or explainable. If the P&L shows $800,000 in revenue and the tax return shows $680,000, that is a $120,000 discrepancy that demands explanation. Common causes: unreported cash revenue (which you cannot rely on), timing differences, or a classification difference between how revenue and other income are reported.

Step 2: Reconcile P&L to bank deposits. Take total annual revenue from the P&L and compare it to total bank deposits for the same year. Bank deposit totals should reconcile to reported revenue. Unexplained gaps between bank deposits and P&L revenue are the most common sign that the income statement has been manipulated.

Step 3: Verify the add-back schedule. For each add-back the seller claims, request the supporting document: pay stub or payroll record for owner compensation claims, receipts or bank statements for personal expense claims, invoices and explanation for one-time expense claims. Add-backs that cannot be documented should be excluded from the normalized earnings calculation.

Step 4: Trend the revenue monthly. Twelve months of monthly P&Ls reveal patterns that annual statements hide. Is revenue growing, declining, or lumpy? Are there months where revenue drops to near zero (seasonality)? Were there one-time revenue events in the peak period being presented? A business showing $800,000 annual revenue that earned $500,000 in one month from a non-recurring project is not a $800,000 run-rate business.

Step 5: Test the largest expense categories. Payroll (usually the largest expense) should reconcile to payroll records. Cost of goods sold should reconcile to supplier invoices. Rent should match the lease agreement. Expense categories that are inconsistent across years or inconsistent with the operating model demand explanation.

Step 6: Review the balance sheet. Small business balance sheets are often unreliable — assets are rarely at fair market value, and liabilities may be incomplete. Focus on: accounts receivable (are they actually collectible?), inventory (is it current and saleable?), and liabilities (are there obligations that do not appear on the balance sheet — personal loans from the owner, vendor credit balances, accrued obligations?).

Revenue Quality: What You Are Actually Buying

The income statement tells you what happened. The revenue quality analysis tells you whether it will happen again.

Customer concentration analysis. Request the customer list with revenue per customer for the last 12 months. Build a concentration table: what percentage of total revenue comes from the top 1, 3, 5, and 10 customers? If the top customer represents 35% of revenue and has been with the business for 2 years on a month-to-month agreement, that revenue stream is at risk. If the same customer is on a 3-year contract with automatic renewal and has been a client for 8 years, the risk profile is entirely different.

Contract vs. one-time revenue. Separate revenue into categories: contracted recurring (service agreements, retainers, subscription-based), non-contracted recurring (repeat customers with no formal agreement), project/one-time (single engagements that may or may not repeat), and government or grant-funded (if applicable). The sustainable earning power of the business is driven by contracted recurring revenue; one-time project revenue requires constant replenishment.

Revenue trend by category. Is the contracted recurring base growing, stable, or shrinking? Are new customers replacing churned ones or is the customer list contracting? A business with declining recurring revenue offset by growing one-time project revenue is masking a deteriorating core.

The churn test. If the seller claims "strong customer retention," ask them to produce a cohort analysis: of the customers who were active in Year 1, what percentage are still active in Year 3? Customer retention data is rarely volunteered — request it explicitly. High churn businesses where the seller presents last-year revenue as representative of ongoing revenue is one of the most common forms of earnings misrepresentation in small business M&A.

Financial Due Diligence Red Flags

These are the findings that should stop a deal cold — or trigger a material price reduction — when they appear in due diligence.

Red flags in the income statement: - Tax returns and P&Ls that do not reconcile without explanation - Revenue spikes in the 12 months immediately preceding listing (buyers should ask: what was the business doing to generate this revenue, and is it sustainable?) - Add-backs that cannot be documented or that are implausibly large relative to the business size - Gross margin that deteriorated significantly in the most recent year (cost creep, customer pricing pressure, or product mix shift) - Officer compensation fluctuating dramatically year to year without explanation

Red flags in the customer base: - Single customer above 30% of revenue on month-to-month terms - Multiple key customers whose contracts expire within 6 months of close - Revenue concentration in a customer segment where the seller has a personal relationship that may not transfer (see how to value a service-based business for the owner-dependency discussion) - Customer list that the seller is reluctant to provide until "very late" in diligence

Red flags in the legal and operational review: - Lease expiring within 12–18 months with no renewal option or active negotiation - Key business licenses held in the seller's personal name rather than the business entity - Pending litigation or regulatory notices not disclosed in the seller's representations - Deferred maintenance or equipment in condition significantly worse than represented - Key employees who have informally communicated intent to depart post-close

The "find one lie" rule: In any due diligence, when you find a material discrepancy — a number that cannot be reconciled, a representation that turns out to be false, an add-back that is not supported — assume there are more. The first discrepancy is rarely the last.

Quality of Earnings (QoE): When to Get Professional Help

A Quality of Earnings (QoE) analysis is a structured financial due diligence report prepared by a CPA firm or financial advisory firm that independently verifies the seller's earnings representations. QoE reports are standard in mid-market transactions ($2M+ EBITDA) and increasingly common in smaller deals where the buyer wants independent verification before committing significant capital.

What a QoE report covers: - Independent normalization of earnings (rebuilds SDE or EBITDA from source documents) - Add-back analysis with document support or rejection - Revenue quality assessment (recurring vs. one-time, trend analysis, customer concentration) - Working capital analysis (does the business generate adequate cash flow to fund operations, or does it consume cash?) - Key accounting policies and any unusual estimates or judgments - Comparison of tax returns to financial statements

When to get a QoE report: - Any deal above $1M purchase price where the earnings are material to your equity - Deals with complex add-back schedules or unusual revenue recognition - Deals where the seller's financials are internally prepared and not reviewed or compiled by a CPA - Any deal where you have already found one discrepancy in self-directed due diligence

Cost: QoE reports for small business acquisitions ($1M–$5M enterprise value) typically cost $5,000–$20,000 depending on complexity. For a deal where you are writing a $150,000–$500,000 check as a down payment, this is insurance, not overhead.

SBA lenders and QoE: Some SBA lenders require an independent third-party valuation or QoE for acquisition loans above certain thresholds. Even when not required, having a QoE strengthens your loan application by providing independent support for the earnings you are asking the lender to underwrite.

For how SBA underwriters review financial documentation and what they are looking for, see the SBA loan to buy a business guide. For what should already be captured in the letter of intent before due diligence begins, see how to write a letter of intent to buy a business.

Frequently Asked Questions