50+ Due Diligence Questions When Buying a Business: The Complete Buyer’s Checklist

Christoph Totter · Managing Partner, CT Acquisitions

20+ home services M&A transactions across HVAC, plumbing, pest control, roofing · Updated June 10, 2026

Due diligence is the period between LOI and close where the buyer earns the right to walk away. Before LOI, you have hypotheses. During diligence, you test them. After close, you live with the answers. Buyers who run shallow diligence wire money based on the seller’s narrative; buyers who run rigorous diligence wire money based on tested facts.

The seller’s incentive in diligence is opposite yours. They want minimum disclosure, fast timelines, and signed contracts. You want comprehensive disclosure, time to verify, and the leverage to renegotiate or walk. The diligence question list is your tool for forcing the seller’s information advantage out into the open. The questions you don’t ask become contingent liabilities you can’t price.

This guide organizes 57 specific diligence questions across seven categories. Financial (15). Operational (10). Legal (8). Customer (6). Employee and HR (8). IT and systems (5). Environmental and regulatory (5). Each table includes the question and why it matters. The questions are the same ones used in $50M+ private equity deals — scaled appropriately, they apply to deals as small as $1M.

Use the lists below as the spine of your diligence request. Send them via the data room. Track responses in a tracker spreadsheet. Flag every ‘not available,’ ‘in process,’ or ‘the seller doesn’t track that’ response. Those flags often matter more than the answers you do receive. A seller who can’t produce a customer-level revenue file is a seller whose financials you cannot trust.

Due diligence questions when buying a business
The right diligence questions don’t just verify what you’ve been told. They surface what the seller didn’t volunteer.

“Diligence isn’t about confirming the deal. It’s about earning the right to walk away. Every question you don’t ask becomes a contingency you can’t price.”

TL;DR — the 90-second brief

  • Due diligence is not a checklist; it’s an interrogation. The 57 questions below cover seven categories: financial, operational, legal, customer, employee/HR, IT/systems, and environmental/regulatory.
  • Financial diligence (15 questions) drives the price. Margin trends, working capital, add-back legitimacy, and customer-level revenue quality decide whether the EBITDA is real.
  • Legal diligence (8 questions) drives the structure. Pending litigation, IP ownership, license transferability, and change-of-control clauses determine asset vs. stock sale and indemnification needs.
  • Customer and HR diligence (14 questions) drives the post-close survival. Concentration, contract terms, key employee retention, and unwritten relationships determine whether revenue holds after the seller leaves.
  • IT and environmental diligence (10 questions) drives hidden liabilities. Software license non-compliance, cybersecurity gaps, and environmental contamination are the most under-priced risks in lower-middle-market deals.

Key Takeaways

  • Run diligence in seven parallel workstreams: financial, operational, legal, customer, HR, IT, and regulatory. Each stream produces independent findings.
  • The 15 financial questions drive the price. EBITDA add-back legitimacy and customer-level revenue quality matter more than headline revenue.
  • The 6 customer questions drive the survival case. Concentration, contracts, and seller-relationship dependence determine post-close revenue retention.
  • The 8 legal questions drive the structure. Litigation, IP ownership, and change-of-control clauses determine asset vs. stock sale and indemnification scope.
  • The 5 IT questions and 5 environmental questions surface hidden liabilities — software license exposure, cybersecurity gaps, contamination, regulatory non-compliance.
  • Track every ‘not available’ or ‘not tracked’ response. Inability to produce data is itself a finding.

Financial diligence: 15 questions that drive the price

Financial diligence is where most deals get retraded. The seller pitches a Quality of Earnings (QoE) story; the buyer’s diligence either confirms it or breaks it. The 15 questions below get under the headline numbers and into the structural quality of revenue, margin, and cash flow.

These questions assume access to bank statements, accounting software, and customer-level data. Sellers occasionally resist customer-level disclosure on confidentiality grounds. Push back. A confidentiality agreement covers the disclosure; refusal to disclose at all means you cannot price customer concentration risk and should walk.

#Financial diligence questionWhy it matters
1Provide three years of audited or reviewed financial statements plus trailing-twelve-month P&LThe base data set. Compiled statements are inadequate for deals over $1M EBITDA — they have not been tested by the accountant.
2Provide three years of federal tax returns and any amended returnsTax returns are signed under penalty of perjury and tend to be more conservative than internal financials. Discrepancies between tax returns and book financials are red flags.
3Reconcile reported EBITDA to net income with every add-back itemized and supportedSellers present aggressive ‘Adjusted EBITDA.’ Each add-back must be tested for legitimacy: owner comp above market is fair, but personal expenses run through the business or one-time revenue spikes often are not.
4Provide monthly P&L by department or product line for the last 24 monthsMonthly granularity reveals seasonality, pulled-forward revenue, and margin compression that annual numbers hide.
5Provide gross margin by product line, customer, and channel for the last 24 monthsAggregate gross margin can be stable while underlying mix shifts toward lower-margin business. Mix shifts predict future margin direction.
6Provide accounts receivable aging at month-end for the last 24 monthsAR aging tells you collection quality. AR over 90 days above 5% is a yellow flag; above 10% is a red flag and may indicate revenue recognition issues.
7Provide accounts payable aging and a list of past-due payablesPast-due payables suggest cash flow pressure that EBITDA doesn’t reveal. Sellers sometimes stretch payables before sale to inflate cash position.
8Provide working capital calculations (AR + inventory − AP) at month-end for 24 monthsEstablishes the working capital peg the buyer assumes at close. Sellers may try to extract excess working capital pre-close; the peg prevents this.
9Provide capital expenditure history for the last 5 years and the next 24-month capex budgetSellers often defer capex pre-sale to inflate EBITDA. The gap between historical capex and the next 24-month requirement is real cash the buyer funds post-close.
10Provide top 20 customers by revenue for each of the last 3 years with year-over-year changeCustomer churn is invisible in topline revenue if new customers replace lost ones. Customer-level data reveals churn that aggregate revenue hides.
11Provide a complete list of revenue by month with line-item adjustments and creditsReveals one-time revenue items, subscription revenue concentration, and any ‘catch-up’ entries that inflated reported revenue.
12Provide details of any related-party transactions in the last 5 yearsBelow-market or above-market transactions with the owner’s related entities distort EBITDA. All related-party transactions need to be normalized to market.
13Provide owner’s W-2 income, draws, and personal expenses run through the businessOwner compensation above market is a legitimate add-back. Personal expenses (vehicle, country club, family travel) run through the business require closer scrutiny.
14Provide all loan agreements, lines of credit, and capital leasesOutstanding debt structures determine working capital availability and any prepayment penalties or change-of-control clauses that affect deal structure.
15Provide cash flow statements with non-cash adjustments separately itemizedDistinguishes cash-generating EBITDA from accrual-based EBITDA. Cash conversion below 70% is a flag for working capital issues or revenue quality issues.

Operational diligence: 10 questions on how the business actually runs

Operational diligence tests whether the business can run without the seller. Process documentation, system dependencies, single points of failure, and capacity constraints. A business that depends on undocumented seller knowledge has a ceiling on its post-close performance — and a floor on its post-close failure risk.

#Operational diligence questionWhy it matters
16Provide an organizational chart with names, titles, tenure, and direct reportsReveals the actual chain of command and identifies key employees whose departure would damage operations.
17Document the standard operating procedures for sales, fulfillment, customer service, and accountingIf SOPs don’t exist, the business runs on tribal knowledge held by individuals. Tribal knowledge does not transfer in an asset purchase.
18Provide a list of all software systems used to operate the business and the cost of eachSoftware stack reveals dependencies, license obligations, and replacement costs. Outdated systems are 12-24 month, $500k-$2M projects post-close.
19Identify all single points of failure: any system, vendor, or person whose absence would meaningfully disrupt operationsForces the seller to articulate risks they often haven’t consciously recognized. The list is rarely complete on first pass — iterate it.
20Provide capacity utilization metrics for the last 24 months (production, fulfillment, headcount)Determines whether growth requires additional capex or headcount. A business operating at 95% capacity needs investment to grow; one at 60% can grow on existing infrastructure.
21Provide quality metrics: defect rates, customer complaints, return rates, warranty claimsOperational quality is a leading indicator of customer churn. Rising defect or complaint rates predict revenue decline that has not yet shown up in financials.
22Provide the last 3 years of insurance certificates: general liability, workers’ comp, professional liability, cyber, D&OInsurance gaps are contingent liabilities. Inadequate coverage limits or missing policies (cyber especially) are common in lower-middle-market deals.
23Identify all licenses and permits required to operate and confirm transferabilityMany state and federal licenses don’t transfer automatically in asset sales. Operating without the license post-close is illegal and uninsurable.
24Document the seller’s typical workweek: meetings, decisions, customer interactions, vendor callsReveals owner dependency in concrete terms. If the seller spends 60% of the week on activities the buyer can’t replicate, the transition risk is high.
25Provide the last 24 months of incident logs, downtime reports, and operational disruptionsReveals operational fragility that aggregate metrics hide. Frequent disruptions predict future disruptions and post-close stress.

Legal diligence determines deal structure (asset vs. stock sale), indemnification scope, and rep-and-warranty insurance feasibility. Pending litigation, IP ownership defects, regulatory non-compliance, and change-of-control clauses all reshape the deal. A buyer who skips legal diligence often inherits liabilities they didn’t price.

#Legal diligence questionWhy it matters
26Provide a complete list of pending, threatened, and settled litigation in the last 7 yearsPattern matters as much as any single case. Frequent litigation is a structural problem that one-off settlements don’t fix.
27Provide all customer, vendor, and partnership contracts including change-of-control and assignment clausesChange-of-control clauses can trigger termination or renegotiation in stock sales. Non-assignable contracts complicate asset sales.
28Provide a complete IP inventory: trademarks, patents, copyrights, software code, customer databasesIP ownership defects are common in small businesses. Verify the company owns the IP — not the seller personally, not a former contractor.
29Provide all employment agreements, non-compete agreements, and confidentiality agreements with current and former employeesWeak or unenforceable non-competes (especially in California, North Dakota, Oklahoma) increase post-close competitive risk.
30Provide the corporate organizational documents, ownership history, and current cap tableOwnership defects (unsigned stock transfers, missing minutes, dissenting minority shareholders) can block close or trigger appraisal rights.
31Disclose all UCC filings, liens, encumbrances, and security interests against company assetsLiens follow assets in many cases. Title insurance and lien releases are required to deliver clean assets at close.
32Provide all regulatory filings, audits, and notices from federal, state, and local agencies in the last 5 yearsReveals regulatory exposure: OSHA, EPA, IRS, DOL, state environmental, state health, industry-specific regulators.
33Disclose any guarantees, indemnifications, or off-balance-sheet obligationsOff-balance-sheet liabilities (personal guarantees on supplier credit, indemnifications to former employees, escrow obligations from prior transactions) follow ownership.

Customer diligence: 6 questions that drive the survival case

Customer diligence tests whether revenue survives after the seller leaves. Concentration, contract terms, switching costs, and seller-relationship dependence are the four dimensions. Each has to be tested independently. A business with low concentration but high seller-relationship dependence is just as risky as a business with high concentration on contracted terms.

#Customer diligence questionWhy it matters
34Provide top 20 customers by revenue for each of the last 3 years with year-over-year revenue changeReveals concentration, churn, and growth concentration. Top customer over 20% is a yellow flag; over 35% is structural risk.
35Provide written contracts for all top-10 customers with term, renewal, and termination clauses highlightedConcentration on at-will terms is the worst combination. Concentration with multi-year take-or-pay contracts is much less risky.
36Identify which top customers have a personal relationship with the seller (vs. a structural relationship with the company)Seller-relationship dependent customers reconsider when the seller leaves. Often 30-60% of small-business top customers fall into this category.
37Provide customer churn data: customers acquired and lost by month for the last 24 monthsHidden churn (new customers replacing lost ones) is invisible in topline revenue. Churn rate predicts post-close retention.
38Provide customer satisfaction metrics, NPS scores, or survey results if availableForward-looking indicator of churn. Declining NPS predicts revenue decline that hasn’t shown up yet.
39Identify any customer that has indicated they may not renew, expand competitively, or change suppliers post-closeCustomers often signal intent to leave months before they actually do. The seller usually knows. Force the disclosure.

Employee and HR diligence: 8 questions that drive transition success

Employee diligence determines whether the team holds together post-close. Key employee identification, retention agreements, hidden HR liabilities, and the gap between the formal org chart and actual work allocation. Most acquisitions that fail in months 1-12 fail because of employee departures the buyer didn’t see coming.

#Employee/HR diligence questionWhy it matters
40Provide a complete employee roster: name, role, tenure, compensation, location, employment status (W-2 vs. 1099)Misclassification of contractors as employees is a common contingent liability. Tenure data identifies institutional knowledge concentration.
41Identify the 3-7 key employees whose departure would meaningfully damage operationsForces the seller to be explicit. Each key employee needs a retention agreement signed before close.
42Provide the last 5 years of EEOC filings, DOL audits, workers’ comp claims, and OSHA citationsHR liability history. Patterns of complaints (especially around a single supervisor or department) signal cultural issues that survive transition.
43Provide employee benefits documentation: health, retirement (401(k), pension), PTO accrual policy, severance policyBenefits costs and obligations transfer with the company. Underfunded pensions and accrued PTO are real liabilities at close.
44Document any pending grievances, mediations, or arbitrations involving current or former employeesPending matters are contingent liabilities that may convert to settlements post-close. Each requires reserve or seller indemnification.
45Provide compensation data benchmarked to market for the top 20 employeesBelow-market compensation predicts post-close attrition (employees become flight risks once they realize they’re underpaid). Above-market compensation is an EBITDA add-back candidate — or a retention tool the buyer needs to maintain.
46Provide the employee handbook, code of conduct, and any documented complaints in the last 3 yearsReveals cultural and HR-policy gaps. Missing or outdated handbook is a common compliance issue in small businesses.
47Document the seller’s relationships with key employees and identify any informal commitments (bonus promises, equity promises, severance commitments)Verbal promises from sellers create post-close obligations the buyer didn’t budget for. Ask explicitly — the seller often forgets these unless prompted.

IT and systems diligence: 5 questions that surface hidden tech liabilities

IT diligence reveals replacement costs, security exposure, and license non-compliance. Many small businesses run on 10-20 year-old systems patched together over decades, with cybersecurity gaps and undercount on commercial software licenses. Each is a contingent liability that should be quantified pre-close.

#IT/systems diligence questionWhy it matters
48Provide an inventory of all software licenses with seat counts, license types, and renewal datesSoftware license non-compliance (Microsoft, Adobe, Autodesk under-counts) is common. Vendor audits can demand back-payment plus penalties.
49Provide cybersecurity documentation: MFA coverage, endpoint detection, backup procedures, incident response plan, cyber insurance policyCybersecurity gaps are hidden liabilities. Ransomware in month 3 of ownership is a deal-breaker for many buyers’ financing covenants.
50Disclose any data breaches, ransomware incidents, or unauthorized access events in the last 5 yearsPrior incidents predict future incidents. Disclosure obligations under state breach laws follow ownership.
51Identify any legacy or custom systems that are unsupported, undocumented, or dependent on a single individualSingle-point-of-failure systems are 12-24 month replacement projects. Cost should be quantified and factored into the deal.
52Provide a list of all data assets (customer databases, vendor data, transaction history) with retention policies and access controlsData ownership and retention are GDPR/CCPA compliance issues. Inadequate access controls predict insider risk and breach exposure.

Environmental and regulatory diligence: 5 questions on the most under-priced risks

Environmental and regulatory diligence catches the largest contingent liabilities in industrial, manufacturing, and trades businesses. Soil and groundwater contamination, regulatory non-compliance, and unpermitted operations create liabilities that follow the property or the entity for years post-close. A Phase I environmental site assessment is non-negotiable for any business with industrial, manufacturing, automotive, or chemical-handling operations.

#Environmental/regulatory diligence questionWhy it matters
53Commission a Phase I environmental site assessment for any owned or leased property where industrial, manufacturing, or chemical handling occursEnvironmental liability follows the property in most states. Phase I cost is typically modest; remediation cost can be six or seven figures.
54Provide all environmental permits, registrations, and reporting obligations (air, water, hazardous waste, stormwater)Permit lapses or unreported releases are regulatory violations that follow ownership. Verify all permits are current and transfer-eligible.
55Disclose any environmental notices of violation, consent orders, or pending agency investigations in the last 10 yearsOpen or recent enforcement actions are contingent liabilities. Settlement costs and remediation timelines should be reserved against the purchase price.
56Provide industry-specific regulatory documentation: contractor licenses, healthcare licenses, transportation authority, food safety, FCC, FDAIndustry-specific regulatory non-compliance is often invisible to buyers from other sectors. Engage industry-experienced counsel for these reviews.
57Disclose any tax audits, sales tax exposure, or unfiled returns in the last 7 yearsState sales tax exposure for online or multi-state businesses is a significant contingent liability. Unfiled returns or under-reported tax can produce six-figure assessments post-close.

How to use this question list

Send the questions in three waves, not all at once. Wave 1 (financial + customer + employee summary) goes immediately after LOI. Wave 2 (legal + operational + IT) goes 2-3 weeks later once Wave 1 responses are in hand. Wave 3 (environmental + regulatory + deep-dive follow-ups) goes 4-6 weeks in, after the first responses have surfaced areas needing deeper investigation.

Track every response in a tracker spreadsheet. Question number, status (pending, partial, complete, refused), date received, file location in data room, follow-up needed, materiality flag. The tracker becomes the diligence audit trail and the basis for retrade negotiations if findings emerge.

Flag every ‘not available’ or ‘we don’t track that.’ Inability to produce data is itself a finding. A seller who cannot produce customer-level revenue is a seller whose financial story you cannot verify. Inability to produce capex history means you cannot test deferred-investment risk. Each gap should reduce trust in the seller’s narrative and shift price or structure in your favor.

Use diligence findings to retrade or walk — or to confirm and close. Diligence is not paperwork. It’s the negotiation. Material findings should produce price adjustments, indemnification expansions, escrow holdbacks, or transaction-cancellation. Sellers expect modest retrades; buyers who run rigorous diligence almost always find them. Buyers who don’t find anything either ran shallow diligence or are buying a uniquely clean business — usually the former.

Looking to acquire a business?

We work primarily with sellers, but that means we see exactly which buy-side diligence requests get answered fully and which get the runaround. A 30-minute confidential conversation can sharpen the diligence list you’re sending into your next data room — what to ask, what to push when responses are incomplete, and what to walk on. No contract, no cost, no follow-up if it’s not a fit.

Book a 30-Min Call

Conclusion

Diligence is the negotiation, not the paperwork. The 57 questions above are the spine of a sophisticated buyer’s investigation: 15 financial questions that drive the price, 10 operational questions that test whether the business runs without the seller, 8 legal questions that drive the structure, 6 customer questions that drive the survival case, 8 HR questions that drive the transition, 5 IT questions that surface hidden technology liabilities, and 5 environmental and regulatory questions that catch the largest contingent risks. Send them in waves. Track every response. Treat ‘not available’ as a finding. And use what you learn to retrade, restructure, or walk — not to rationalize the deal you’ve already decided to close. The buyers who run diligence as a serious investigation, not a checklist, are the buyers who don’t end up writing post-close case studies about everything they should have caught.

Frequently Asked Questions

What is due diligence when buying a business?

Due diligence is the buyer’s investigation of the target between LOI and close. It tests every claim in the seller’s pitch, surfaces undisclosed risks, and earns the buyer the right to retrade, restructure, or walk away. It typically runs 30-90 days and produces findings that reshape the deal.

How long does due diligence take?

Typically 30-90 days from LOI to close. Smaller deals (under $5M) can run on the shorter end; larger or more complex deals (regulated industries, multi-jurisdiction operations, environmental exposure) can run 90-180 days. The biggest driver is data-room responsiveness from the seller.

What are the most important due diligence questions to ask?

The financial questions drive the price (EBITDA add-back legitimacy, customer-level revenue, working capital, capex history). The customer questions drive the survival case (concentration, contracts, seller-relationship dependence). The legal questions drive the structure (litigation, IP ownership, change-of-control clauses).

What does Quality of Earnings (QoE) cover?

A QoE study tests the legitimacy of EBITDA: add-back validation, revenue recognition, customer concentration, working capital normalization, and one-time items. Buyer-commissioned QoE is standard for deals over $2-3M of EBITDA and produces findings that often retrade the price by 5-15%.

Should I trust the seller’s financial statements?

Audited statements are reasonably reliable. Reviewed statements are acceptable but should be tested. Compiled statements (the most common in small businesses) have not been tested by the accountant and should be verified through bank statement reconciliation, tax return cross-checks, and customer-level revenue analysis.

What red flags should I look for in due diligence?

Inability to produce customer-level revenue. Compiled-only financial statements for deals over $1M EBITDA. EBITDA add-backs over 25% of EBITDA. Top customer over 35% of revenue. Pending litigation outside ordinary course. Unsigned key employees. Deferred capex. Software license under-counts. Phase I environmental concerns. Each is a structural risk that should reprice or restructure.

How do I verify customer concentration?

Request top-20 customer revenue for each of the last 3 years. Calculate top-1, top-5, top-10 concentration. Read written contracts on every top-10 customer. Identify which customers have a personal relationship with the seller. Confirm change-of-control clauses do not trigger termination.

What is a Phase I environmental site assessment?

A Phase I ESA is a standardized environmental investigation of a property to identify recognized environmental conditions: prior industrial use, soil or groundwater contamination, hazardous material storage, regulatory violations. It’s required for most commercial real estate transactions and any business with industrial, manufacturing, automotive, or chemical-handling operations.

What happens if due diligence finds problems?

Several options. Retrade the price (most common). Expand indemnification or escrow. Add closing conditions or covenants. Restructure as asset sale to limit liability. Walk away if findings are material. Sellers expect modest retrades; major findings can produce 10-30% price adjustments or kill the deal entirely.

Should I hire outside advisors for due diligence?

Yes, for deals over $2-3M EBITDA. The standard team: a transaction attorney (legal diligence, drafting), an accounting firm for QoE (financial diligence), an environmental consultant (Phase I, Phase II if needed), and an industry-experienced operator or sector advisor (operational diligence). Cost is typically 1-3% of deal value — less than the value of findings they surface.

Can the seller refuse to answer diligence questions?

Sellers can refuse, but each refusal is a finding. Confidentiality concerns are addressed through NDAs and clean-team protocols, not blanket refusals. A seller who refuses to disclose top-customer revenue (citing confidentiality) is signaling either real concentration risk or a lack of customer-level data — both of which should reprice or kill the deal.

What’s the difference between an asset sale and a stock sale in diligence?

Asset sales: buyer acquires specific assets and assumes specific liabilities. Most contracts must be assigned and re-negotiated. Most licenses don’t transfer automatically. Liability protection is broader but operational complexity is higher. Stock sales: buyer acquires the entity. Contracts and licenses generally transfer (subject to change-of-control clauses). Liability protection is narrower; legal diligence must be more thorough because all historical liabilities transfer with the entity.

Related Guide: Quality of Earnings: What QoE Tests and Why It Matters — The buyer-commissioned QoE study is the single most important diligence investment in deals over $2-3M of EBITDA.

Related Guide: Letter of Intent (LOI) — Your Complete Guide — The 9 essential terms every buyer must understand before signing the LOI that triggers diligence.

Related Guide: Asset Sale vs. Stock Sale: Which Structure Fits Your Deal — Diligence requirements and liability transfer differ sharply between asset and stock sales. Choose the structure before you build the diligence list.

Related Guide: Reps and Warranties Insurance: When Buyers Should Demand R&W Coverage — R&W insurance bridges the gap between diligence findings and seller indemnification capacity. Increasingly standard in deals over $25M.

Christoph Totter, Founder of CT Acquisitions

About the Author

Christoph Totter is the founder of CT Acquisitions, a buy-side deal origination firm headquartered in Sheridan, Wyoming. CT Acquisitions sources founder-led businesses for 75+ private equity firms, family offices, and search funds across the U.S. lower middle market ($1M–$25M EBITDA). Christoph writes about M&A from the perspective of someone on the phone with both sides of the deal table every week. Connect on LinkedIn · Get in touch

Want a Specific Read on Your Business?

30 minutes, confidential, no contract, no cost. You leave with a read on your local buyer market and a likely valuation range.

CT Acquisitions is a trade name of CT Strategic Partners LLC, headquartered in Sheridan, Wyoming.
30 N Gould St, Ste N, Sheridan, WY 82801, USA · (307) 487-7149 · Contact

Leave a Reply

Your email address will not be published. Required fields are marked *