M&A due diligence is the buyer’s structured investigation of a target company before closing. The goal is to test the assumptions behind the purchase price and deal structure, identify liabilities and operating risks, understand what must be fixed or negotiated before closing, and prepare for ownership after the transaction.
For a small business acquisition, due diligence should be risk-based rather than a mechanical checklist. The buyer does not need every possible workstream on every deal, but material risks should have a clear owner, a defined scope, and a documented conclusion.
What does M&A due diligence cover?
| Workstream | Typical questions | Common specialists |
|---|---|---|
| Financial | Are revenue and earnings supportable? What is normalized working capital? Are there unusual expenses, debt-like items, or cash-flow issues? | Transaction advisory, CPA, financial diligence specialist |
| Legal | What liabilities, contracts, litigation, licenses, IP, employment, or change-of-control issues could affect the deal? | M&A attorney and specialty counsel |
| Tax | Are there unpaid taxes, nexus issues, payroll or sales-tax exposures, or structure considerations? | Transaction tax advisor |
| Commercial | How durable are the market, customers, pricing, competitive position, and growth assumptions? | Commercial diligence or industry specialist |
| Operational | Can the business operate reliably without the seller? Are processes, suppliers, capacity, equipment, and controls adequate? | Operating advisor or functional specialist |
| Technology & cybersecurity | Who owns the systems and code? Are licenses valid? Is the architecture scalable? Are there material security or data risks? | Technology/cyber diligence specialist |
| Human resources | Which employees are critical? Are compensation, classification, benefits, retention, or compliance issues material? | Employment counsel, HR specialist, benefits advisor |
| Insurance & risk | Are limits, exclusions, claims history, and required policies appropriate? | Insurance advisor or broker |
Large advisory firms describe similarly broad diligence frameworks. Deloitte identifies commercial, operational, legal, and other critical workstreams, while PwC describes integrated financial, commercial, tax, IT, cyber, operations, insurance, and human-capital diligence.
When does due diligence start?
Some preliminary diligence happens before an LOI. A buyer may review a CIM, financial statements, tax returns, customer information, online presence, and management materials to decide whether to make an offer. The detailed diligence phase commonly begins after the LOI, when the buyer receives broader data-room access and starts spending meaningful professional fees.
The post-LOI due diligence timeline can help buyers sequence the work after exclusivity begins.
The M&A due diligence process
1. Define the investment thesis and deal-breakers
Before sending a long request list, write down what must be true for the acquisition to work. Examples include sustainable earnings, retention of a key customer, transferability of a license, continued access to a supplier, acceptable seller dependence, or the ability to obtain financing.
2. Build a risk-based scope
Map each major risk to a workstream and an owner. A buyer with strong operating expertise may handle some commercial or operational review internally while using outside specialists for financial, legal, tax, or technology diligence.
3. Open and organize the data room
The seller should provide organized, current information. Missing documents are not automatically a red flag, especially in a small company, but repeated gaps, unexplained inconsistencies, or reluctance to provide core records should be escalated.
4. Verify, do not merely collect
Due diligence is not complete because a document exists. Financial information may need to be reconciled to bank statements, tax returns, invoices, or source systems. Contracts should be checked for actual term, renewal, assignment, and change-of-control language. Customer and employee assumptions should be tested rather than accepted at face value.
5. Keep a live issues list
Track open questions by severity, owner, required follow-up, and potential deal impact. Separate missing information from confirmed problems. The goal is to make important issues visible early enough to change the deal if needed.
6. Connect findings to the transaction
A diligence finding can affect purchase price, working capital, financing, indemnification, escrow, representations and warranties, closing conditions, transition planning, or the decision to walk away. Advisors should explain the transaction consequence, not just the technical issue.
7. Close the loop before signing
Before the definitive agreement is signed, confirm that every material issue is either resolved, priced, protected contractually, accepted knowingly, or designated as a post-close action item.
M&A due diligence checklist for small business buyers
Financial
- Monthly and annual income statements, balance sheets, and cash-flow information
- Tax returns and general-ledger detail
- Bank and merchant-processing statements where relevant
- Revenue by customer, product, service, or location
- Owner compensation, related-party items, and proposed add-backs
- Accounts receivable, accounts payable, inventory, and working-capital trends
- Debt, leases, capital expenditures, and off-balance-sheet commitments
Legal and corporate
- Formation and governance documents
- Material customer, supplier, lease, loan, franchise, and service agreements
- Licenses, permits, regulatory correspondence, and litigation
- Intellectual-property ownership and registrations
- Employment agreements, restrictive covenants, and contractor arrangements
- Change-of-control, assignment, and consent requirements
Commercial
- Customer concentration and retention
- Pricing history and discounting
- Pipeline and backlog quality
- Competitive position and market trends
- Lead sources and sales process
- Dependence on the owner or a small number of relationships
Operations
- Key processes and SOPs
- Capacity, equipment, facilities, and maintenance
- Supplier concentration and purchasing terms
- Quality controls and service-delivery metrics
- Required licenses and operational dependencies
- Business continuity and disaster recovery
Technology and data
- Core applications, licenses, contracts, and renewal dates
- Software ownership and third-party code
- Cybersecurity controls, incidents, backups, and access management
- Data privacy obligations and sensitive-data handling
- Technical debt, scalability, and key-person dependence
For a more granular list, use the dedicated M&A Due Diligence Checklist.
Financial due diligence versus quality of earnings
Financial due diligence can range from targeted verification to a full quality of earnings engagement. A QoE typically focuses on the sustainability and composition of earnings, working capital, cash flow, customer concentration, add-backs, and related financial issues. It is not an audit and it does not replace legal, tax, commercial, operational, or technology diligence.
Buyers can review the financial due diligence guide and the Quality of Earnings guide to determine the appropriate financial scope.
How long does M&A due diligence take?
There is no universal timeline. The schedule depends on seller readiness, deal size, financing, data quality, regulatory issues, and the number of workstreams. A smaller transaction with a well-organized seller may move quickly; a complex deal can require substantially more time. The LOI should provide enough time for the actual diligence plan rather than relying on a default number copied from another transaction.
What DueDilio Project Requests Show
Real acquisition diligence rarely follows an identical template from deal to deal.
In one June 2026 DueDilio project involving a manufacturing acquisition valued at approximately $5 million to $7 million, the buyer wanted to understand whether recent profit improvement was sustainable even though revenue had remained relatively flat. The requested financial diligence emphasized normalized earnings, gross-margin drivers, inventory, working capital, and debt and debt-like items.
In a separate May 2026 manufacturing and fabrication acquisition, customer concentration was a major concern. The requested financial diligence added detailed customer concentration, vendor concentration, and capital-expenditure analysis to the core Quality of Earnings scope.
These are two anonymized DueDilio project examples, not a representative sample of all SMB acquisitions. They illustrate why diligence should be designed around the buyer’s investment thesis, financing requirements, and transaction-specific risks rather than applying the same checklist to every business.
Common due diligence mistakes
- Starting with a generic checklist instead of the investment thesis.
- Leaving key workstreams until the end of exclusivity.
- Accepting adjusted EBITDA without testing the underlying support.
- Ignoring owner dependence, customer concentration, or employee retention because the financials look strong.
- Treating missing documents as either harmless or catastrophic without investigating why they are missing.
- Failing to connect findings to purchase price, structure, legal protection, or post-close actions.
- Using advisors with strong credentials but little relevant transaction experience.
Who should be on the diligence team?
The team should fit the risks. A typical SMB acquisition may involve the buyer, M&A attorney, financial diligence provider, lender, and selected specialists. A technology company may require deeper software and cybersecurity diligence. A regulated business may need licensing or regulatory counsel. A labor-intensive company may require HR, benefits, workers’ compensation, or employment-law review.
For help comparing outside specialists, see How to Choose a Due Diligence Firm. DueDilio also maintains a network of vetted M&A service providers.
Bottom line
Good due diligence is not about producing the longest request list. It is about identifying the assumptions that matter, assigning qualified people to test them, escalating material findings early, and translating the results into an informed closing decision. A buyer should finish diligence knowing not only what is wrong with the business, but what is true, what remains uncertain, and what must change in the deal or ownership plan because of the findings.
FAQ
Frequently Asked Questions
M&A due diligence is the buyer’s structured investigation of a target company before closing. It tests the assumptions behind the purchase price and deal structure, identifies liabilities and operating risks, and helps the buyer decide what must be renegotiated, protected, fixed, or accepted.
Common workstreams include financial, legal, tax, commercial, operational, technology and cybersecurity, human resources, insurance, regulatory, and environmental diligence. The exact mix should reflect the target company and the risks of the specific transaction.
Preliminary diligence often begins before an LOI, using the information available to decide whether to make an offer. Detailed diligence commonly begins after the LOI, when the buyer receives broader data-room access and starts engaging outside specialists.
There is no standard duration. Timing depends on seller readiness, deal complexity, financing, data quality, industry, regulatory issues, and the workstreams required. The LOI should provide enough time for the actual diligence plan.
Financial due diligence is the broader category. A quality of earnings analysis is one type of financial diligence focused on the sustainability and composition of earnings, working capital, cash flow, add-backs, customer concentration, and related financial issues.
The buyer normally leads the overall process and may use an M&A attorney, financial diligence provider, lender, tax advisor, technology specialist, commercial or operational advisor, HR specialist, insurance advisor, or other experts depending on the deal.
Common documents include monthly and annual financial statements, tax returns, general-ledger detail, bank and merchant statements when relevant, accounts receivable and payable, inventory information, debt and lease schedules, customer-level revenue, and support for owner add-backs or adjustments.
The buyer may request more information, change the purchase price or structure, add legal protections, require a closing condition, change financing assumptions, create a post-close remediation plan, or walk away. The appropriate response depends on the severity and certainty of the issue.
No. A checklist is a useful organizational tool, but effective diligence requires verification, judgment, follow-up questions, and prioritization. The scope should be driven by the investment thesis and the specific risks of the target company.
Every material issue should be resolved, priced into the deal, protected in the definitive agreement, accepted knowingly, or assigned as a post-close action item. The buyer should also document remaining uncertainties rather than treating unanswered questions as completed work.
