47-Point Due Diligence Checklist Before You Buy Any Business

Skipping due diligence is the #1 mistake first-time buyers make. Cover these bases before you commit a single dollar.

1. Financial Due Diligence

• ›Last 3 years of federal business tax returns (verify against what the broker shows you)
• ›Last 3 years of profit & loss statements, month by month
• ›Last 3 years of balance sheets
• ›YTD financials — current within 60 days
• ›All bank statements for the past 24 months (match deposits to reported revenue)
• ›Accounts receivable aging report (how old is the money owed?)
• ›Accounts payable aging report (what does the business owe, and is it current?)
• ›Any outstanding loans, lines of credit, or equipment financing
• ›Sales tax returns for the past 3 years (another data point on revenue)
• ›Payroll records and 941 filings (verify headcount and wages)
• ›Build your own adjusted SDE — do not accept the broker's number at face value

2. Revenue and Customer Due Diligence

• ›Top 10 customers by revenue — what % does each represent?
• ›Revenue by customer for the last 3 years — who's growing, who's shrinking, who's gone?
• ›Existing contracts: length, renewal terms, termination clauses
• ›Customer interviews — ask the seller to facilitate 3-5 reference calls
• ›Google/Yelp reviews and online reputation — look at the one-star reviews
• ›Any pending customer disputes, chargebacks, or refund demands
• ›Revenue by product/service line — concentration risk across products
• ›Recurring vs. one-time revenue breakdown
• ›Pipeline and backlog if applicable (services businesses, contractors)

3. Legal and Compliance Due Diligence

• ›Corporate formation documents (articles, bylaws, operating agreement)
• ›Cap table — who owns what percentage?
• ›All past and pending litigation — search court records, don't just ask
• ›Any OSHA, EPA, or regulatory violations in the past 5 years
• ›Business licenses and permits — are they transferable?
• ›Professional licenses required to operate (contractor licenses, etc.) — can you obtain them?
• ›Any liens on business assets — search UCC filings
• ›IP ownership: trademarks, patents, domain names, social media accounts
• ›Non-compete agreements with former employees that might restrict future hiring

4. Operations and Real Estate Due Diligence

• ›Current lease: term remaining, renewal options, assignment clause
• ›Landlord relationship — will they cooperate with a sale? Increases coming?
• ›Equipment condition — walk the floor and inspect everything
• ›Equipment maintenance records and recent repair costs
• ›Inventory count and age (stale inventory is often worth less than stated)
• ›Technology systems: POS, CRM, accounting software — what transfers and what needs to be re-licensed?
• ›Key vendor relationships — are there exclusive agreements? Volume discounts that may not survive ownership change?
• ›Supply chain risk — single-source suppliers for critical inputs?
• ›Any pending capital expenditures the seller has deferred

5. Employee Due Diligence

• ›Full employee roster with tenure, title, compensation, and role
• ›Key employee retention risk — who's staying, who might leave?
• ›Employee agreements: non-competes, NDAs, IP assignments
• ›Any past or pending HR claims: discrimination, harassment, wage disputes
• ›Benefits: health insurance, 401k — what are you inheriting?
• ›Workers' compensation claims history
• ›Contractor vs. employee classification — misclassification is a significant liability
• ›Org chart: who does what? Is this business running on one person?

6. Seller Relationship and Transition Due Diligence

• ›Why is the seller actually selling? Validate the stated reason.
• ›How long is the seller willing to provide transition support? Get this in writing.
• ›Will the seller sign a non-compete? Length and geography must be appropriate.
• ›Will the seller finance part of the deal? (A seller note is evidence they believe in the business)
• ›Is the seller introducing you to key customers and suppliers before closing?
• ›Any family members involved in the business who might not cooperate post-sale?
• ›Does the seller's lifestyle depend on the sale proceeding? (Motivated sellers cooperate; desperate sellers hide things)

6. IT Due Diligence

• ›Full inventory of hardware: servers, workstations, POS terminals, networking equipment — age, condition, and ownership (leased vs. owned)
• ›Software licenses: which are transferable? Which are seat-based and tied to the seller's identity? Which expire at change of ownership?
• ›SaaS subscriptions: list every tool, monthly cost, and whether the account can be transferred or requires a new sign-up
• ›Cybersecurity posture: when was the last security audit or penetration test? Are there any known vulnerabilities or open findings?
• ›History of data breaches, ransomware incidents, or security events — verify through staff interviews, not just seller disclosure
• ›Customer data handling: what PII is collected and stored? Is the business GDPR/CCPA compliant? Are there data processing agreements in place with vendors?
• ›Backup and disaster recovery: how often is data backed up, where, and has recovery ever been tested?
• ›Network infrastructure: who owns and manages the IT? In-house, outsourced MSP, or ad hoc? What are the MSP contract terms?
• ›Proprietary software or custom-built tools: who wrote it? Is the source code owned by the business or a contractor? Is there documentation?
• ›Domain names, SSL certificates, and hosting: are all registered in the business's name or the seller's personal accounts?
• ›Email infrastructure: is email on a business domain with proper SPF/DKIM/DMARC configured, or on personal Gmail/Yahoo accounts?
• ›Access and credentials: does the business have a password manager and documented access controls, or is critical access locked in one employee's head?

"Can I see your bank statements?" This is the most reliable verification tool in business due diligence. Revenue that shows on the P&L but doesn't show up as cash deposits is a red flag. Always compare reported revenue to actual deposits.

How to Organize Your Due Diligence

Create a shared data room with your attorney and CPA. Assign one person to own each category. Set a deadline — 30 to 45 days of exclusivity is standard in an LOI. Use that deadline to prioritize: financial and legal diligence first, operational second.

Document every finding. If you negotiate a price reduction based on a discovered issue, you need that issue documented in writing before close.

And remember: due diligence is not just about finding reasons to walk away. It's about calibrating what you're paying for. A deal with issues you understand and can price is often better than a "clean" deal priced for perfection.