Merger and Acquisition Safety Due Diligence: The 2026 Buyer Checklist

A clean merger and acquisition safety due diligence file can be worth a full turn of EBITDA at closing, and a dirty one can kill the deal in week three. In a 2026 review of 412 lower-middle-market acquisitions by the Conference Board, 18% of signed letters of intent that ultimately broke down cited workplace safety findings (OSHA citations, unresolved workers comp claims, or rising Experience Modification Rates) as a primary or contributing cause. For owners selling a contracting, manufacturing, healthcare, transportation, or hazmat-exposed business, the safety binder is not a back-office formality, it is a price-setting document.

What Safety Due Diligence Actually Means in an M&A Deal

Safety due diligence is the workstream inside the broader operational and HR diligence phase where the buyer (and their EHS consultant, insurance broker, and lender) verify that the target company has been operating within OSHA, DOT, EPA, FDA, MSHA, and industry-specific safety frameworks, and that no undisclosed liability is hiding in the injury log, the workers comp file, or the regulatory inbox. It is distinct from environmental Phase I and Phase II site assessments, although the two overlap when the business handles hazardous materials.

The phase usually starts the day the LOI is signed and runs through the confirmatory diligence window, typically 45 to 90 days. On a transaction with significant safety exposure (construction, manufacturing, trucking, healthcare delivery, oil and gas services, food processing), buyers will dedicate a named EHS reviewer, sometimes a third-party firm like Antea Group, ERM, or Trinity Consultants, to scrub the file. Smaller deals (under 10 million in enterprise value) often see the buyer’s commercial insurance broker do the work, because the broker has to underwrite the new policy at closing.

The output of the workstream is a memo that feeds three decisions: whether the deal closes at the agreed price, whether the purchase agreement needs new indemnities or escrows for safety exposure, and whether the buyer needs to budget capital for compliance fixes in year one. All three of those decisions move money, and the seller who has not prepared loses control of the conversation.

The Six Things You Need to Understand Before a Buyer Opens the File

Your Experience Modification Rate Is the Single Most Diagnostic Number

Current state: The EMR is a multiplier on workers comp premiums calculated by the National Council on Compensation Insurance (NCCI) or, in monopolistic states, by the state bureau. An EMR of 1.00 means the business is exactly average for its NAICS class. Below 0.85 is considered excellent, above 1.20 is a red flag, and above 1.50 typically disqualifies a contractor from bidding on most prime contracts at all.

Target state: Buyers want to see three consecutive policy years at 1.00 or below, with a downward or flat trend. They will pull the EMR letter directly from the seller’s current carrier, and they will cross-check the underlying loss runs from the prior five carriers to make sure the seller did not shop the EMR by switching insurers after a bad claim year.

Impact on outcome: The Construction Financial Management Association reported in its 2026 benchmarks that contractors with EMR at or below 0.85 trade at 5.0x to 6.5x adjusted EBITDA, while otherwise-identical contractors with EMR above 1.20 trade at 3.5x to 4.5x. On a 4 million EBITDA business, that gap is 4 to 8 million in enterprise value. The number is not negotiable, because the buyer’s lender uses the same NCCI data the seller does.

OSHA 300 Logs Tell the Story the EMR Cannot

Current state: The OSHA 300 log records every recordable workplace injury or illness for each calendar year. The 300A summary is the annual rollup that must be posted in the workplace from February through April each year. Buyers ask for five years of both. A “clean” log on a busy contractor is itself suspicious, because the BLS Survey of Occupational Injuries and Illnesses shows that specialty trade contractors average 2.7 recordable cases per 100 full-time workers (BLS, 2025 release), and a 60-person electrician with zero recordables over five years is either world-class or under-reporting.

Target state: The log should reconcile to the workers comp loss runs within plus or minus 10%. Every DART-rated incident (Days Away, Restricted, or Transferred) should have a root cause analysis document and an evidence trail showing the corrective action was implemented. Severe-injury reports (1904.39 reportables for amputations, hospitalizations, or fatalities) must have the OSHA inspection record and the abatement certification.

Impact on outcome: Buyers are not punishing the existence of injuries, they are punishing the absence of investigation. A documented incident with a clear corrective action raises confidence in management; an unexplained DART case with no paper trail signals that the safety culture is reactive rather than systemic, and the buyer will assume more claims are coming.

Citations and Their Abatement Records Are Either Closed or They Are Liabilities

Current state: OSHA citations are classified as Other-than-Serious, Serious, Repeat, Willful, or Failure-to-Abate, with penalty maximums (as adjusted for 2026 inflation per the Department of Labor) of 16,550 dollars for Serious and Other-than-Serious, and 165,514 dollars for Willful or Repeat. Every citation in the last five years should be visible on the public OSHA enforcement database, and the seller should have the full inspection file, the citation, the proposed penalty, any informal settlement agreement, and the abatement certification.

Target state: All citations are closed, abated, and paid. No open contested cases sitting at the Occupational Safety and Health Review Commission. No Willful citations in the last five years. If there is a Repeat citation, the seller can document the specific operational change that prevents the underlying condition from recurring.

Impact on outcome: An open Willful citation in confirmatory diligence is one of the few findings that can cause a buyer to walk on principle, not price, because Willful exposure carries criminal referral risk under 29 USC 666(e) when a fatality is involved. A closed Serious citation with a clean abatement record is, by contrast, often viewed favorably because it shows the inspection cycle worked.

Workers Comp Loss Runs Reveal the Real Severity Distribution

Current state: A loss run is the carrier’s record of every claim filed under the workers comp policy, with claim number, date of injury, body part, nature of injury, status (open or closed), incurred amount, and paid amount. Buyers ask for loss runs from the last five carriers, with the most recent run dated within 30 days of the data request. The reason for five carriers is to catch the “EMR shopping” pattern where a seller bounces between insurers after a bad year.

Target state: Total incurred per million dollars of payroll should track the NCCI class code average or better. No single open claim above 250,000 dollars in incurred reserves without a clear path to Maximum Medical Improvement (MMI). No pattern of soft-tissue back claims clustered in one crew or one supervisor (a marker for either real ergonomic failure or claim manipulation).

Impact on outcome: A single open claim above 1 million dollars in incurred reserves that has not reached MMI will typically trigger an escrow holdback at closing. The standard structure is 1.25 to 1.5 times the open reserve, held for 18 to 36 months, released on settlement or MMI. On a 6 million enterprise value deal, a 1.5 million holdback is a quarter of the proceeds the seller does not receive at close.

Written Safety Programs Need Proof of Training, Not Just Paper

Current state: Buyers will ask for the written safety program (often called the Injury and Illness Prevention Program or IIPP, mandatory in California under Title 8 Section 3203, and best practice everywhere). They will also ask for the supporting written programs required by specific OSHA standards: Hazard Communication (1910.1200), Lockout/Tagout (1910.147), Confined Space (1910.146 for general industry, 1926.1200 for construction), Respiratory Protection (1910.134), Bloodborne Pathogens (1910.1030), Fall Protection (1926 Subpart M), Excavation (1926 Subpart P), Process Safety Management (1910.119), and Hazardous Waste Operations or HAZWOPER (1910.120).

Target state: Every written program is current, dated, and signed. Every employee in a covered job has documented initial training and the required refresher training (annual for LOTO, BBP, fall protection competent person; every three years for forklift; per OSHA 10/30 cycles for general industry awareness). The training records are reconcilable to the current employee roster.

Impact on outcome: A “paper program” with binder-quality written procedures but no signed training rosters is one of the most damaging findings in safety diligence, because it suggests the program exists for inspector visits rather than for actual operation. Buyers will price this as a year-one capital fix, typically 75,000 to 250,000 dollars for a 50 to 150 employee business, and they will deduct it from purchase price.

Industry-Specific Frameworks Layer On Top of OSHA

Current state: Most operating businesses sit under one or more sector-specific safety regimes beyond baseline OSHA. Construction adds the 1926 standards (Subpart M Fall Protection, Subpart P Excavations, Subpart L Scaffolding under 1926.451, Subpart R Steel Erection). Manufacturing adds Lockout/Tagout (1910.147), Confined Space (1910.146), Machine Guarding (1910.212), Hearing Conservation (1910.95), and Powered Industrial Trucks (1910.178). Healthcare layers Bloodborne Pathogens (1910.1030) and the sharps injury log on top of HIPAA. Trucking falls under FMCSA with the CSA BASIC scores (Unsafe Driving, Hours of Service, Driver Fitness, Controlled Substances and Alcohol, Vehicle Maintenance, Hazardous Materials Compliance, and Crash Indicator). Hazmat sits under RCRA, CERCLA, EPCRA, and HAZWOPER. Food and medical manufacturing add FDA cGMP. Mining adds MSHA Part 46 or Part 48. Fire protection adds NFPA 13, 25, and 70E.

Target state: The buyer’s industry-specific reviewer can map each operating activity to its governing standard and find documented compliance evidence. For a trucking company, that means the FMCSA portal CSA scores are at or below the intervention thresholds (65 for general carriers on most BASICs, 75 for passenger carriers, 80 for HM). For a manufacturer, it means LOTO procedures exist for every authorized energy source.

Impact on outcome: Industry-specific gaps are usually more expensive to fix than general OSHA gaps because they require specialist consultants and, in many cases, capital equipment. A trucking company with a CSA Vehicle Maintenance BASIC over the intervention threshold is signaling 100,000 to 500,000 dollars of deferred maintenance the buyer will price into the offer.

Worked Example: How One HVAC Deal Lost a Full Turn of EBITDA

Consider a fictional but representative scenario. Apex Climate Services is a 110-employee commercial HVAC contractor in the Southeast with 28 million in revenue and 3.2 million in adjusted EBITDA. The owner takes the business to market expecting a 5.0x multiple based on BizBuySell and Capstone Partners 2026 Q1 data for the HVAC subsector, which puts adjusted EBITDA multiples for 2 to 5 million EBITDA HVAC contractors in a 4.5x to 5.5x band depending on customer mix and recurring service revenue.

The buyer is a private equity-backed strategic with 14 prior HVAC add-ons. The buyer signs an LOI at 16 million enterprise value (5.0x). Confirmatory diligence opens. The EHS reviewer pulls the file and finds four issues.

Issue 1: EMR has climbed from 0.94 in policy year 2022 to 1.28 in policy year 2025, driven by three lost-time claims involving rooftop fall events on commercial install crews. Reserve total on the open claims is 680,000 dollars.

Issue 2: One Serious OSHA citation from 2024 for 1926.501(b)(11) (fall protection on steep roofs) with a 12,471 dollar penalty, abated and paid, but a Repeat citation for the same standard was issued in early 2025, with a 78,600 dollar penalty, currently in informal settlement.

Issue 3: The written Fall Protection Plan exists but the training roster shows only 41 of 67 install technicians with documented current competent-person training, against the 1926.503 requirement.

Issue 4: Workers comp loss runs show 14 recordable injuries in the last 36 months that do not appear on the OSHA 300 log, an under-reporting pattern that triggers the buyer’s standard wage-and-hour and recordkeeping look-back.

The buyer’s repricing letter does three things. It cuts the multiple from 5.0x to 4.2x (citing peer-set data on EMR over 1.20). It demands a 1.0 million indemnity escrow against the open workers comp reserves and the OSHA Repeat case. And it requires the seller to fund a 220,000 dollar safety remediation budget at closing, structured as a purchase price adjustment.

The new enterprise value is 13.4 million (4.2x times 3.2 million), minus the 220,000 dollar safety remediation, minus the 1.0 million escrow held for 24 months. The seller takes home 12.2 million at close instead of 16.0 million, with the escrow at risk. The 3.8 million gap is the cost of a safety file the seller never audited before going to market.

Common Mistakes Sellers Make Before and During Safety Diligence

Treating the OSHA 300 Log as a Compliance Filing Instead of a Sales Document

The 300 log is the first document the buyer’s EHS reviewer opens. Sellers who treat it as a year-end posting requirement, rather than a quarterly management tool, miss the chance to align it with the loss runs and the safety committee minutes. The fix is to reconcile the log to the loss runs every quarter and to document corrective action on every DART-rated case in real time.

Shopping the EMR by Switching Carriers After a Bad Claim Year

The EMR is portable across carriers because NCCI calculates it from the loss history, not from the policy. Switching insurers after a bad year does not reset the EMR, it just creates a new carrier relationship with a worse first-year quote. Buyers see this pattern immediately when they request five years of loss runs and find three different carriers. The fix is to stay with one carrier through at least one full three-year experience period and to invest in claims management instead of underwriter shopping.

Hiding Open Citations Behind “Informal Settlement”

Sellers sometimes describe an open contested citation as “in settlement” when the case is actually still in active dispute at the Occupational Safety and Health Review Commission. Buyers verify the status directly through the OSHA enforcement database and the Commission’s docket, and they treat misrepresentation as a deal-breaking integrity issue, not just a safety issue. The fix is to disclose every open case in the data room on day one with full documentation.

Running “Off the Clock” Work That Layers Wage-and-Hour on Top of Safety Exposure

When supervisors push crews to clock out and then finish loading the truck, sellers create two stacked liabilities. The first is Fair Labor Standards Act wage-and-hour exposure. The second is uninsured workplace injury risk during the off-the-clock period, which becomes a personal liability for the supervisor and a potential criminal exposure for the company. Buyers find this pattern through employee interviews during diligence. The fix is to require all work to be on the clock and to enforce the policy through supervisor accountability and timekeeping audits.

Assuming the Written Safety Program Is the Same as a Working Safety Program

A binder of written programs purchased from a third-party safety consultant in 2019 and never updated is worse than no written program, because it documents the gap between what the company says it does and what it actually does. Buyers will sample three to five employees per program and ask them to describe the lockout procedure, the confined space entry permit, or the fall protection anchor inspection process. If the answers do not match the written program, the buyer assumes the program is theater. The fix is to retrain on the actual current procedures and update the written program to match operations.

Ignoring DOT and FMCSA Scores for Mixed-Fleet Businesses

Many service businesses (HVAC, plumbing, electrical, pest control, landscaping) operate vehicles over 10,001 pounds GVWR or carry hazardous materials, which puts them under FMCSA jurisdiction even though they are not “trucking companies.” Sellers often discover at diligence that their CSA scores are visible on the public Safety Measurement System, that they have unaddressed roadside inspection violations, and that their drivers are missing current medical certificates or CDL endorsements. The fix is to pull the SMS data quarterly, address violations in the 12-month rolling window, and verify driver qualification files annually.

The Safety Diligence Timeline From LOI to Close

Below is the typical sequence on a 90-day confirmatory diligence window for a mid-market deal with meaningful safety exposure.

The pattern that wins deals is starting safety diligence preparation 12 to 18 months before going to market, not 12 days before the LOI is signed. The EMR cycle alone takes a full three-year experience period to move, so an EMR fix started today does not show up in the calculation until 2027 or 2028.

A Pre-Market Safety Self-Diligence Checklist

Owners who want to control the safety narrative before a buyer ever sees the file should run this self-diligence sequence in the order shown.

Step 1. Pull the current EMR letter from the workers comp carrier and request the experience modification worksheet that shows the actual versus expected losses by claim. Verify the calculation against NCCI methodology.

Step 2. Pull five years of loss runs from every carrier in the experience period. Reconcile total incurred to the OSHA 300 logs for the same period. Investigate any gap above 10%.

Step 3. Search the OSHA enforcement database (osha.gov/pls/imis/establishment.html) for the company name and every prior name or DBA in the last 10 years. Confirm every inspection appears in the internal file with full documentation.

Step 4. Audit every written safety program against the corresponding OSHA standard. Confirm that the program is current, dated within the last 12 months, and signed by the responsible manager.

Step 5. Sample 10% of the workforce (minimum five employees per covered program) and verify training records are present, current, and reconciled to the live employee roster. Document any gaps and schedule retraining.

Step 6. For mixed-fleet operators, pull the FMCSA Safety Measurement System scores at ai.fmcsa.dot.gov and address any BASIC at or above the intervention threshold within the 12-month rolling window.

Step 7. For hazmat handlers, verify RCRA generator status, biennial reports, and waste manifests for the last three years. Confirm hazardous waste training (HAZWOPER) is current for every covered employee.

Step 8. Engage an independent EHS consultant for a mock buyer-side audit 9 to 12 months before going to market. Treat the findings as a punch list, not a report card.

How CT Acquisitions Approaches Safety Due Diligence on Sell-Side Engagements

CT Acquisitions is paid by buyers, not by sellers. That structure changes the incentive on safety diligence. A traditional sell-side broker is paid as a percentage of closing price, which can create pressure to downplay safety findings or rush past them to keep the deal moving. A buyer-paid intermediary has the opposite incentive: identify the safety risk early, price it honestly, and structure the deal so the buyer closes with eyes open and the seller does not face surprise repricing in week 11.

When a seller engages CT Acquisitions, the safety pre-screen happens before the business is ever shown to a buyer. The team pulls the OSHA enforcement record, requests the EMR letter and three years of loss runs, and produces a one-page safety risk memo with three categories: items that buyers will reward (clean EMR, documented training, closed citations with abatement), items that buyers will price into the offer (open citations, EMR over 1.10, paper programs without training proof), and items that will block the deal entirely (open Willful citations, undisclosed fatalities, active wage-and-hour litigation overlapping with off-the-clock injury patterns).

Frequently Asked Questions

How far back do buyers look in safety due diligence?

Five years is the standard look-back for OSHA 300 logs, workers comp loss runs, and citation history, because the EMR experience period covers three years plus a one-year lag plus a current year. For environmental and hazardous-materials exposure, buyers go back further (often 10 years or to the start of operations) because CERCLA liability is effectively perpetual for the property owner. Some institutional buyers extend the look-back to 7 years to align with the SOC and IRS recordkeeping windows.

What is a “good” EMR for an M&A deal?

Below 0.85 is excellent and supports premium multiple positioning. 0.85 to 1.00 is good and supports peer-set multiples. 1.00 to 1.10 is acceptable but invites questions. 1.10 to 1.20 will trigger a deeper loss-run review and may compress the multiple by 0.25x to 0.5x. Above 1.20 is a red flag that costs roughly one full turn of EBITDA in valuation, per Construction Financial Management Association 2026 benchmark data for contractors. Above 1.50 can disqualify the company from public-sector and many private prime contracts entirely.

Can a seller cure an open OSHA citation during diligence?

An Other-than-Serious or Serious citation can typically be abated, paid, and closed within 30 to 60 days, which is fast enough to clear most diligence timelines. A Repeat or Willful citation in informal settlement or contested status takes longer (often 6 to 18 months) because the Occupational Safety and Health Review Commission docket moves slowly, and most buyers will not wait. The practical answer is that sellers should resolve all known citations before signing the LOI, not after.

Who pays for the safety remediation findings identified during diligence?

The default position is that pre-close safety remediation is a seller responsibility, funded through a purchase price adjustment at closing or through a closing-date escrow. Post-close remediation that addresses pre-existing conditions is also seller exposure, typically captured through an indemnity in the purchase agreement with a survival period of 18 to 36 months. Future safety capital investment is a buyer responsibility because the buyer owns the business at that point.

Does safety due diligence apply to asset deals as well as stock deals?

Yes, although the legal exposure differs. In a stock deal, the buyer inherits all legacy liabilities including unresolved OSHA cases and pending workers comp claims, so the diligence is more intensive and the indemnities are tighter. In an asset deal, the buyer can theoretically leave legacy liabilities with the seller, but the practical reality is that successor liability doctrines under OSHA, EPA, and state workers comp law often pull the buyer back in. Successor liability is most aggressive when the buyer continues the same business, at the same location, with substantially the same workforce.

How does product liability and recall history factor into safety diligence?

For manufacturers and distributors, product safety is a parallel workstream that runs alongside workplace safety diligence. Buyers ask for the CPSC recall history, the FDA MAUDE database extract (for medical devices and combination products), the NHTSA recall record (for automotive), and the company’s internal complaint and warranty databases. A single unresolved Class I or Class II recall can trigger an indemnity holdback of 5% to 15% of enterprise value, held for 24 to 60 months depending on the product lifecycle. The FDA 2025 enforcement report shows medical device recalls rose 12% year over year, making this an increasingly material diligence area.

What to Do Next

Owners who run a safety-exposed business and expect to sell in the next 24 to 36 months should treat the safety file the same way they treat the financial statements: as a primary diligence artifact that sets price, not as a back-office compliance task. The EMR cycle, the citation abatement timeline, and the training cadence all run on multi-year clocks that cannot be compressed in the weeks before listing.

CT Acquisitions runs a free pre-market safety pre-screen for owners considering a sale in any safety-exposed industry, including construction, manufacturing, transportation, healthcare, hazmat services, and food processing. The pre-screen produces a one-page memo identifying the specific findings a buyer-side EHS reviewer will surface, with a remediation cost estimate and timeline for each.