Sell-Side Due Diligence in 2026: What Buyers Will Actually Dig Into First

Most lower middle market owners go to market believing their books are clean, their contracts are tight, and their team will hold together through a transition. Then a buyer drops a 200-line diligence checklist on them, hires a Big Four or top regional accounting firm to tear into the financials, and within four weeks the deal is either trading at a lower multiple or dead.

Sell-side due diligence is how you flip that dynamic. Instead of letting a buyer be the first person to find your add-back errors, customer concentration risk, or undocumented IP, you find them yourself, fix what you can, and disclose the rest on your terms. This guide walks through what buyers actually scrutinize, in the order they look at it, and what to do about each item before the data room ever opens.

When to commission sell-side diligence (8 to 12 weeks before go-to-market)

The right window is 8 to 12 weeks before you launch the process. Sell-side QoE providers typically need 6 to 8 weeks of fieldwork plus 2 to 4 weeks for revisions, management interviews, and final report assembly. If you start later, you either delay launch or hand buyers an incomplete report, which defeats the purpose.

For deals under $20M EBITDA, expect a sell-side QoE to cost $50,000 to $125,000. Mid-tier deals ($20M to $75M EBITDA) run $125,000 to $300,000. Large deals north of $75M EBITDA can run $300,000 to $600,000 depending on entity count, ERP complexity, and how many adjustments need to be tested. See our 2026 QoE provider comparison for current fee benchmarks across the major firms.

The biggest mistake we see is owners commissioning sell-side work too late, often after they have already accepted a non-binding offer. By that point, the buyer is anchored to a number, the timeline is fixed, and any adjustment the QoE surfaces becomes a re-trade conversation rather than a positioning advantage.

Named sell-side QoE providers worth shortlisting

The provider market has consolidated, but the practical shortlist for U.S. lower middle market deals still has 8 firms worth interviewing:

• RSM US, the most active sell-side QoE provider in the $5M to $50M EBITDA segment, deep manufacturing and distribution coverage, fast turnaround on simpler files.
• Plante Moran, particularly strong on Midwest industrials and family-owned businesses, with carve-out experience that smaller firms lack.
• BDO USA, broad national footprint, strong tech and healthcare verticals, often the default for PE-backed buyers who want a familiar name on the sell-side report.
• Cherry Bekaert, Southeast strength, government contracting and construction expertise, competitive on price for $10M to $30M EBITDA deals.
• FocalPoint Partners (Riveron acquired), boutique transaction advisory positioning, partner-led teams, well-regarded for tight-timeline sell-side mandates.
• Riveron, technology-enabled diligence platform, strong on data tape rebuilds and complex revenue recognition under ASC 606.
• EisnerAmper, Northeast roots with national coverage, real estate and consumer products specialty practices.
• Mazars USA (now Forvis Mazars), top 10 firm post-merger, particularly active on cross-border deals where the buyer pool includes European strategics.

Interview at least three firms before you engage. Ask each one to walk through a recent sell-side report from a comparable deal, the size of the engagement team, who actually does the fieldwork (not who pitches the deal), and how many adjustments their typical QoE surfaces. Get fees in writing and confirm whether the deliverable is a databook plus narrative or just summary slides.

1. Financial QoE, the foundation of every sell-side diligence file

QoE is where every diligence process starts and where the largest valuation swings happen. The buyer’s QoE provider is going to reconstruct your trailing twelve month adjusted EBITDA from the ground up. They will challenge every add-back, normalize owner compensation, test the durability of your gross margins, and rebuild your customer revenue waterfall.

What buyers look for in financial QoE: the integrity of the revenue stream (one-time vs. recurring, contracted vs. spot), the legitimacy of EBITDA add-backs, gross margin stability over 36 months, the quality of accruals and revenue cut-off, working capital seasonality, and any indication that the trailing twelve months has been managed for sale.

Common red flags that re-trade deals: aggressive add-backs that fail testing (personal expenses without backup, double-counted owner comp, one-time costs that recurred), revenue recognition that does not match cash receipts within a reasonable window, channel stuffing in the final quarter before the data room opens, undisclosed related-party transactions, and any month where the bank reconciliation has unexplained variances. Each one of these typically costs 0.5x to 1.5x of EBITDA in deal value.

How to preempt: commission a sell-side QoE that mirrors what the buyer will do. Have the provider stress-test every add-back, document the supporting evidence in the data room, and write the narrative in language the buyer’s investment committee will accept. If a buyer can re-perform your numbers and arrive at the same adjusted EBITDA, the conversation moves from “is this real” to “what is it worth.” That single shift is what closes deals at full price. Our deeper walk-through is in the QoE buyer playbook.

2. Customer concentration, the second sell-side diligence workstream every buyer runs

The minute a buyer believes the financials, they pull customer revenue and rank it. If your top customer is more than 15 percent of revenue, expect questions. If your top three customers are more than 35 percent, expect a structural change to the deal: earn-out tied to retention, escrow against churn, or a haircut on the multiple.

What buyers look for: revenue by customer for 36 months, contract terms and remaining duration, switching costs the customer faces, length of relationship, named buyer-side contact and whether you are sole-sourced, and the dollar-weighted retention rate over the past 3 years.

Common red flags: a top customer with a contract that auto-terminates on change of control, a customer that has issued a request for proposal within the last 12 months, declining wallet share at your top accounts, or a single salesperson holding the relationship rather than an institutional one.

How to preempt: build a customer concentration appendix into your sell-side data room that shows revenue by customer, contract end dates, the renewal motion, and any change-of-control provisions. If you have a high-concentration profile, lead with the offsetting story: 15-year average tenure, contractual switching costs, deep integration into the customer’s workflow. Buyers will still discount for concentration, but they will not panic.

3. Working capital, where the last 2 percent of purchase price disappears

The working capital peg is settled in the last two weeks before close, and it is where deals quietly lose hundreds of thousands of dollars. Buyers want to fund the business with a “normal” level of net working capital at close. They define normal as the trailing twelve month average (sometimes 24 month average), and they will use their QoE provider’s number, not yours.

What buyers look for: 36 months of monthly accounts receivable, accounts payable, inventory, accrued liabilities, and deferred revenue. They are looking for the true seasonal pattern, the right exclusions (cash, debt, debt-like items), and any one-time builds or drawdowns in the trailing twelve months that distort the average.

Common red flags: a working capital peg that does not adjust for seasonality, AR that is artificially low because you collected early before close, inventory builds funded by debt that should be treated as debt-like, customer deposits classified as deferred revenue without proper treatment, and any related-party balances that should be settled at close.

How to preempt: commission a sell-side working capital analysis at the same time as the QoE. Have the provider calculate the peg under both 12-month and 24-month methodologies, document seasonality with monthly graphs, and pre-agree on the exclusions list. Going into LOI negotiations with a defensible peg means you set the anchor rather than the buyer.

4. Management team and key-person risk in sell-side due diligence

For founder-led businesses, key-person risk is the single biggest non-financial discount buyers apply. If you are the owner and you sell the deals, hold the customer relationships, sign the contracts, and run operations, the buyer is acquiring a job, not a business. That gets priced.

What buyers look for: an org chart with depth, a second-in-command who can run the business if the founder is hit by a bus, documented sales processes that do not rely on the owner, customer relationships held by account managers rather than just the founder, and a leadership team with at least 3 years of tenure.

Common red flags: a top sales producer who is not under a non-compete or has weak restrictive covenants, a CFO who is part-time or outsourced when the deal needs financial leadership, no documented succession plan, key managers who would leave on close because they were promised equity and are not getting it, and an owner whose personal brand is the business.

How to preempt: in the 12 to 18 months before sale, deliberately demote yourself. Promote a second-in-command, transfer customer relationships to account owners, document the sales playbook, get non-competes and stay bonuses on key people, and structure a retention pool the buyer will fund at close. Buyers pay for a self-running business and discount for a personality-led one.

5. Contracts in sell-side due diligence: IP assignment, MSAs, and restrictive covenants

Legal diligence runs in parallel with financial diligence, and it is where deals get structurally complicated. The buyer’s law firm will pull every material contract, every IP assignment, every employment agreement, and every restrictive covenant. They will read each one and flag any provision that creates friction at close or post-close.

What buyers look for: change-of-control provisions in customer and supplier contracts, IP that is actually owned by the entity (not the founder personally), invention assignment agreements signed by every employee and contractor, MSAs with current pricing and proper signature blocks, non-competes and non-solicits that survive change of control, and any contracts with above-market liquidated damages or unusual indemnities.

Common red flags: patents or trademarks held in the founder’s name rather than the entity, contractor work product without written IP assignment, a top customer MSA that requires written consent for assignment (and the customer is known to refuse), employment agreements that lack non-solicits, software the company relies on with restrictive license terms (especially anything GPL or AGPL in the codebase), and contracts that auto-renew with adverse pricing terms.

How to preempt: commission a legal diligence sweep 90 days before launch. Get every contract into the data room, indexed by counterparty and type. Re-paper IP into the operating entity. Confirm every employee and contractor has signed an invention assignment. Identify the change-of-control provisions and start the consent conversations early with the most important counterparties. The deals that close on time are the ones where consent letters are already drafted before the LOI is signed.

6. Litigation, regulatory, and tax exposure

Buyers will pull every lawsuit, every threatened claim, every regulatory action, every state tax registration, every audit, and every notice of deficiency from the last 7 years. This workstream rarely kills deals on its own, but it almost always reshapes the indemnity and escrow.

What buyers look for: active and threatened litigation, settled matters with confidentiality, employment claims (especially EEOC and DOL wage-and-hour), product liability history, sales tax nexus across states (now a much bigger issue post-Wayfair), state income tax filings in every state where you have employees or material activity, R&D credit substantiation, and any open IRS or state audits.

Common red flags: unfiled sales tax in states where you have established nexus (the median exposure on a multi-state SMB is mid-six-figures), misclassified independent contractors who should have been W-2 employees, R&D credits taken without contemporaneous documentation, employment claims that were settled without confidentiality (they will surface in litigation searches), and any regulatory matter the owner does not remember but the diligence team finds in a public records search.

How to preempt: commission a state tax nexus study and clean up filings before going to market (voluntary disclosure agreements are cheaper than buyer-discovered exposure). Run a litigation search on the entity and its principals. Pull every employment file and confirm classifications. Document R&D credits with contemporaneous backup. The cleaner this is, the lower the indemnity cap and the smaller the escrow.

7. Cybersecurity and IT diligence

Cybersecurity diligence has gone from a checkbox to a workstream of its own, especially for any business that holds PII, processes payments, or relies heavily on a SaaS or proprietary platform. Buyers are scarred by post-close ransomware events and by the discovery that the seller had a breach they never disclosed.

What buyers look for: an inventory of systems and data, the security stack (endpoint, identity, email, network), patch and vulnerability management evidence, incident history for the last 36 months, vendor and third-party risk management, cyber insurance coverage and exclusions, and SOC 2 or ISO 27001 status if applicable to the buyer pool.

Common red flags: a known breach that was never disclosed to customers or regulators, unpatched systems with public CVEs, shared admin credentials, no multi-factor authentication on email or critical systems, no documented incident response plan, cyber insurance with exclusions for the most likely loss types, and a development environment where production credentials are stored in code.

How to preempt: commission a third-party cyber assessment in the same window as the QoE. Remediate the high and critical findings before the data room opens. If you have had an incident, get the written disclosure and remediation narrative ready before buyers ask. Maintain cyber insurance with adequate limits. A clean cyber posture removes a category of escrow conversation that has become standard in deals over $25M.

8. ESG and compliance, the workstream that grew up fast

Five years ago, ESG was a footnote. Today, every institutional buyer has an ESG screen, and many have hard exclusions. Even traditional industrial buyers now run environmental, OSHA, and DOL diligence as standard workstreams.

What buyers look for: environmental Phase I (and Phase II if Phase I flagged anything) on every owned or operated property, OSHA history including DART rate and any willful or repeat violations, EPA history and any consent decrees, DOL wage-and-hour history, EEO-1 filings and any active EEOC matters, anti-bribery and trade compliance programs if you do any cross-border business, and ESG policies appropriate to the buyer pool’s LPs.

Common red flags: known soil or groundwater contamination on a property, an OSHA history with a fatality or a willful violation, repeated EEOC complaints in the same protected category, no written anti-harassment training program, and no written supplier code of conduct for businesses with international supply chains.

How to preempt: commission a Phase I on every real estate asset before launch. Pull the OSHA 300 log and prepare the narrative for any incident in the last 5 years. Run an EEO-1 filing review. For PE buyers, draft a one-page ESG summary that aligns with common LP frameworks (SASB, TCFD). This is increasingly a gate, not a discount.

How sell-side diligence changes the negotiation

The reason sell-side due diligence is now the norm in deals over $5M EBITDA is simple math. A well-run sell-side workstream costs $100,000 to $400,000 depending on size. The defended purchase price improvement, when measured against deals where the buyer drove the entire process, is typically 5 to 15 percent. On a $20M deal, that is $1M to $3M of value. The ROI is not close.

It also changes the close timeline. Deals with sell-side diligence in hand close 30 to 45 days faster on average because the buyer’s QoE provider is reviewing your work product, not building from scratch. Faster close means less risk of buyer remorse, fewer market shocks intervening, and less time for key employees or customers to discover the deal and react.

For a broader look at the buyer side of the table, including how serious buyers approach the same data, see what serious buyers look for in diligence and the companion piece on why buyers care about a sell-side QoE. If you are evaluating the technology side of how diligence is run in 2026, our due diligence platform comparison covers the data room and workflow tools the major QoE firms now standardize on.

Frequently asked questions about sell-side due diligence

How much does sell-side due diligence cost in 2026?

For deals under $20M EBITDA, a sell-side QoE typically costs $50,000 to $125,000. Mid-market deals ($20M to $75M EBITDA) run $125,000 to $300,000. Large deals above $75M EBITDA can run $300,000 to $600,000. Legal diligence, environmental Phase I, cyber, and tax nexus studies add another $40,000 to $150,000 depending on scope.

When should I commission sell-side diligence?

Eight to 12 weeks before you plan to go to market. The QoE provider needs 6 to 8 weeks of fieldwork plus 2 to 4 weeks of revisions. Commissioning later forces you to either delay launch or hand buyers an incomplete report, which defeats the purpose.

Which sell-side QoE provider is best for my deal?

It depends on size, industry, and buyer pool. RSM and BDO have the broadest national coverage. Plante Moran is strong on Midwest industrials and family-owned carve-outs. Cherry Bekaert competes hard on Southeast deals. FocalPoint and Riveron are partner-led boutiques known for tight timelines. Interview three firms minimum, ask for a recent sell-side report from a comparable deal, and confirm who actually does the fieldwork.

Will a sell-side QoE actually prevent re-trades?

It does not eliminate re-trades, but it changes their character. Re-trades on deals with a sell-side QoE typically involve fact patterns the report did not cover (a customer churn that happens during exclusivity, a tax notice that arrives after diligence closes). Re-trades on deals without a sell-side QoE often involve add-backs that fail testing or working capital that gets renegotiated at the wire. The first kind is recoverable. The second kind costs real money.

Can I share my sell-side QoE with multiple buyers?

Yes, and you should. The whole point is to give every bidder the same defensible baseline so they compete on price and terms rather than on whose accountant can find the most adjustments. Most sell-side reports include a buyer-side reliance letter that the QoE provider issues to the winning buyer (and sometimes to lenders) on a fee basis after LOI.

What is the difference between sell-side diligence and an audit?

An audit issues an opinion under GAAP. A sell-side QoE rebuilds adjusted EBITDA, tests add-backs, analyzes revenue quality, and produces a transaction-ready narrative. Audits do not adjust for owner compensation, do not test add-backs, and do not look at working capital normalization the way a QoE does. Both have value, but only the QoE answers the questions a buyer is going to ask.

Do I need sell-side diligence if my buyer pool is search funds or individual buyers?

Less imperative, but still useful. Search funds and individual buyers usually engage a regional QoE provider after LOI. If you have a sell-side QoE in hand, you can accelerate the post-LOI process by 30 to 45 days and provide a defensible adjusted EBITDA number that anchors negotiations. For deals under $2M EBITDA, a scaled-down sell-side QoE in the $30,000 to $60,000 range usually pays for itself.

What happens if my sell-side QoE surfaces a problem I cannot fix in time?

You disclose it on your terms, in your narrative, with a remediation plan. Buyers respect early disclosure and punish late disclosure. The worst outcome is a buyer finding the issue themselves in week 4 of confirmatory diligence. If you find it first and frame it (the issue, the root cause, the remediation plan, and any quantification), it almost always stays in the deal at the original price.

Where to go next

If you are 6 to 18 months from a sale process, the most productive next step is a confidential conversation about timing, buyer pool, and which workstreams will move the valuation needle for your specific business. Run our free valuation tool first to get a baseline range, then book a 15-minute call to walk through how sell-side diligence would sequence for your deal. If you would rather see how our network of 40+ capital partners evaluates businesses like yours before you commit to a process, that conversation is free and confidential as well.