50+ Due Diligence Questions When Buying a Business: The Complete Buyer’s Checklist
Christoph Totter · Managing Partner, CT Acquisitions
20+ home services M&A transactions across HVAC, plumbing, pest control, roofing · Updated June 10, 2026
Due diligence is the period between LOI and close where the buyer earns the right to walk away. Before LOI, you have hypotheses. During diligence, you test them. After close, you live with the answers. Buyers who run shallow diligence wire money based on the seller’s narrative; buyers who run rigorous diligence wire money based on tested facts.
The seller’s incentive in diligence is opposite yours. They want minimum disclosure, fast timelines, and signed contracts. You want comprehensive disclosure, time to verify, and the leverage to renegotiate or walk. The diligence question list is your tool for forcing the seller’s information advantage out into the open. The questions you don’t ask become contingent liabilities you can’t price.
This guide organizes 57 specific diligence questions across seven categories. Financial (15). Operational (10). Legal (8). Customer (6). Employee and HR (8). IT and systems (5). Environmental and regulatory (5). Each table includes the question and why it matters. The questions are the same ones used in $50M+ private equity deals — scaled appropriately, they apply to deals as small as $1M.
Use the lists below as the spine of your diligence request. Send them via the data room. Track responses in a tracker spreadsheet. Flag every ‘not available,’ ‘in process,’ or ‘the seller doesn’t track that’ response. Those flags often matter more than the answers you do receive. A seller who can’t produce a customer-level revenue file is a seller whose financials you cannot trust.

“Diligence isn’t about confirming the deal. It’s about earning the right to walk away. Every question you don’t ask becomes a contingency you can’t price.”
TL;DR — the 90-second brief
- Due diligence is not a checklist; it’s an interrogation. The 57 questions below cover seven categories: financial, operational, legal, customer, employee/HR, IT/systems, and environmental/regulatory.
- Financial diligence (15 questions) drives the price. Margin trends, working capital, add-back legitimacy, and customer-level revenue quality decide whether the EBITDA is real.
- Legal diligence (8 questions) drives the structure. Pending litigation, IP ownership, license transferability, and change-of-control clauses determine asset vs. stock sale and indemnification needs.
- Customer and HR diligence (14 questions) drives the post-close survival. Concentration, contract terms, key employee retention, and unwritten relationships determine whether revenue holds after the seller leaves.
- IT and environmental diligence (10 questions) drives hidden liabilities. Software license non-compliance, cybersecurity gaps, and environmental contamination are the most under-priced risks in lower-middle-market deals.
Key Takeaways
- Run diligence in seven parallel workstreams: financial, operational, legal, customer, HR, IT, and regulatory. Each stream produces independent findings.
- The 15 financial questions drive the price. EBITDA add-back legitimacy and customer-level revenue quality matter more than headline revenue.
- The 6 customer questions drive the survival case. Concentration, contracts, and seller-relationship dependence determine post-close revenue retention.
- The 8 legal questions drive the structure. Litigation, IP ownership, and change-of-control clauses determine asset vs. stock sale and indemnification scope.
- The 5 IT questions and 5 environmental questions surface hidden liabilities — software license exposure, cybersecurity gaps, contamination, regulatory non-compliance.
- Track every ‘not available’ or ‘not tracked’ response. Inability to produce data is itself a finding.
Financial diligence: 15 questions that drive the price
Financial diligence is where most deals get retraded. The seller pitches a Quality of Earnings (QoE) story; the buyer’s diligence either confirms it or breaks it. The 15 questions below get under the headline numbers and into the structural quality of revenue, margin, and cash flow.
These questions assume access to bank statements, accounting software, and customer-level data. Sellers occasionally resist customer-level disclosure on confidentiality grounds. Push back. A confidentiality agreement covers the disclosure; refusal to disclose at all means you cannot price customer concentration risk and should walk.
| # | Financial diligence question | Why it matters |
|---|---|---|
| 1 | Provide three years of audited or reviewed financial statements plus trailing-twelve-month P&L | The base data set. Compiled statements are inadequate for deals over $1M EBITDA — they have not been tested by the accountant. |
| 2 | Provide three years of federal tax returns and any amended returns | Tax returns are signed under penalty of perjury and tend to be more conservative than internal financials. Discrepancies between tax returns and book financials are red flags. |
| 3 | Reconcile reported EBITDA to net income with every add-back itemized and supported | Sellers present aggressive ‘Adjusted EBITDA.’ Each add-back must be tested for legitimacy: owner comp above market is fair, but personal expenses run through the business or one-time revenue spikes often are not. |
| 4 | Provide monthly P&L by department or product line for the last 24 months | Monthly granularity reveals seasonality, pulled-forward revenue, and margin compression that annual numbers hide. |
| 5 | Provide gross margin by product line, customer, and channel for the last 24 months | Aggregate gross margin can be stable while underlying mix shifts toward lower-margin business. Mix shifts predict future margin direction. |
| 6 | Provide accounts receivable aging at month-end for the last 24 months | AR aging tells you collection quality. AR over 90 days above 5% is a yellow flag; above 10% is a red flag and may indicate revenue recognition issues. |
| 7 | Provide accounts payable aging and a list of past-due payables | Past-due payables suggest cash flow pressure that EBITDA doesn’t reveal. Sellers sometimes stretch payables before sale to inflate cash position. |
| 8 | Provide working capital calculations (AR + inventory − AP) at month-end for 24 months | Establishes the working capital peg the buyer assumes at close. Sellers may try to extract excess working capital pre-close; the peg prevents this. |
| 9 | Provide capital expenditure history for the last 5 years and the next 24-month capex budget | Sellers often defer capex pre-sale to inflate EBITDA. The gap between historical capex and the next 24-month requirement is real cash the buyer funds post-close. |
| 10 | Provide top 20 customers by revenue for each of the last 3 years with year-over-year change | Customer churn is invisible in topline revenue if new customers replace lost ones. Customer-level data reveals churn that aggregate revenue hides. |
| 11 | Provide a complete list of revenue by month with line-item adjustments and credits | Reveals one-time revenue items, subscription revenue concentration, and any ‘catch-up’ entries that inflated reported revenue. |
| 12 | Provide details of any related-party transactions in the last 5 years | Below-market or above-market transactions with the owner’s related entities distort EBITDA. All related-party transactions need to be normalized to market. |
| 13 | Provide owner’s W-2 income, draws, and personal expenses run through the business | Owner compensation above market is a legitimate add-back. Personal expenses (vehicle, country club, family travel) run through the business require closer scrutiny. |
| 14 | Provide all loan agreements, lines of credit, and capital leases | Outstanding debt structures determine working capital availability and any prepayment penalties or change-of-control clauses that affect deal structure. |
| 15 | Provide cash flow statements with non-cash adjustments separately itemized | Distinguishes cash-generating EBITDA from accrual-based EBITDA. Cash conversion below 70% is a flag for working capital issues or revenue quality issues. |
Operational diligence: 10 questions on how the business actually runs
Operational diligence tests whether the business can run without the seller. Process documentation, system dependencies, single points of failure, and capacity constraints. A business that depends on undocumented seller knowledge has a ceiling on its post-close performance — and a floor on its post-close failure risk.
| # | Operational diligence question | Why it matters |
|---|---|---|
| 16 | Provide an organizational chart with names, titles, tenure, and direct reports | Reveals the actual chain of command and identifies key employees whose departure would damage operations. |
| 17 | Document the standard operating procedures for sales, fulfillment, customer service, and accounting | If SOPs don’t exist, the business runs on tribal knowledge held by individuals. Tribal knowledge does not transfer in an asset purchase. |
| 18 | Provide a list of all software systems used to operate the business and the cost of each | Software stack reveals dependencies, license obligations, and replacement costs. Outdated systems are 12-24 month, $500k-$2M projects post-close. |
| 19 | Identify all single points of failure: any system, vendor, or person whose absence would meaningfully disrupt operations | Forces the seller to articulate risks they often haven’t consciously recognized. The list is rarely complete on first pass — iterate it. |
| 20 | Provide capacity utilization metrics for the last 24 months (production, fulfillment, headcount) | Determines whether growth requires additional capex or headcount. A business operating at 95% capacity needs investment to grow; one at 60% can grow on existing infrastructure. |
| 21 | Provide quality metrics: defect rates, customer complaints, return rates, warranty claims | Operational quality is a leading indicator of customer churn. Rising defect or complaint rates predict revenue decline that has not yet shown up in financials. |
| 22 | Provide the last 3 years of insurance certificates: general liability, workers’ comp, professional liability, cyber, D&O | Insurance gaps are contingent liabilities. Inadequate coverage limits or missing policies (cyber especially) are common in lower-middle-market deals. |
| 23 | Identify all licenses and permits required to operate and confirm transferability | Many state and federal licenses don’t transfer automatically in asset sales. Operating without the license post-close is illegal and uninsurable. |
| 24 | Document the seller’s typical workweek: meetings, decisions, customer interactions, vendor calls | Reveals owner dependency in concrete terms. If the seller spends 60% of the week on activities the buyer can’t replicate, the transition risk is high. |
| 25 | Provide the last 24 months of incident logs, downtime reports, and operational disruptions | Reveals operational fragility that aggregate metrics hide. Frequent disruptions predict future disruptions and post-close stress. |
Legal diligence: 8 questions that drive the structure
Legal diligence determines deal structure (asset vs. stock sale), indemnification scope, and rep-and-warranty insurance feasibility. Pending litigation, IP ownership defects, regulatory non-compliance, and change-of-control clauses all reshape the deal. A buyer who skips legal diligence often inherits liabilities they didn’t price.
| # | Legal diligence question | Why it matters |
|---|---|---|
| 26 | Provide a complete list of pending, threatened, and settled litigation in the last 7 years | Pattern matters as much as any single case. Frequent litigation is a structural problem that one-off settlements don’t fix. |
| 27 | Provide all customer, vendor, and partnership contracts including change-of-control and assignment clauses | Change-of-control clauses can trigger termination or renegotiation in stock sales. Non-assignable contracts complicate asset sales. |
| 28 | Provide a complete IP inventory: trademarks, patents, copyrights, software code, customer databases | IP ownership defects are common in small businesses. Verify the company owns the IP — not the seller personally, not a former contractor. |
| 29 | Provide all employment agreements, non-compete agreements, and confidentiality agreements with current and former employees | Weak or unenforceable non-competes (especially in California, North Dakota, Oklahoma) increase post-close competitive risk. |
| 30 | Provide the corporate organizational documents, ownership history, and current cap table | Ownership defects (unsigned stock transfers, missing minutes, dissenting minority shareholders) can block close or trigger appraisal rights. |
| 31 | Disclose all UCC filings, liens, encumbrances, and security interests against company assets | Liens follow assets in many cases. Title insurance and lien releases are required to deliver clean assets at close. |
| 32 | Provide all regulatory filings, audits, and notices from federal, state, and local agencies in the last 5 years | Reveals regulatory exposure: OSHA, EPA, IRS, DOL, state environmental, state health, industry-specific regulators. |
| 33 | Disclose any guarantees, indemnifications, or off-balance-sheet obligations | Off-balance-sheet liabilities (personal guarantees on supplier credit, indemnifications to former employees, escrow obligations from prior transactions) follow ownership. |
Customer diligence: 6 questions that drive the survival case
Customer diligence tests whether revenue survives after the seller leaves. Concentration, contract terms, switching costs, and seller-relationship dependence are the four dimensions. Each has to be tested independently. A business with low concentration but high seller-relationship dependence is just as risky as a business with high concentration on contracted terms.
| # | Customer diligence question | Why it matters |
|---|---|---|
| 34 | Provide top 20 customers by revenue for each of the last 3 years with year-over-year revenue change | Reveals concentration, churn, and growth concentration. Top customer over 20% is a yellow flag; over 35% is structural risk. |
| 35 | Provide written contracts for all top-10 customers with term, renewal, and termination clauses highlighted | Concentration on at-will terms is the worst combination. Concentration with multi-year take-or-pay contracts is much less risky. |
| 36 | Identify which top customers have a personal relationship with the seller (vs. a structural relationship with the company) | Seller-relationship dependent customers reconsider when the seller leaves. Often 30-60% of small-business top customers fall into this category. |
| 37 | Provide customer churn data: customers acquired and lost by month for the last 24 months | Hidden churn (new customers replacing lost ones) is invisible in topline revenue. Churn rate predicts post-close retention. |
| 38 | Provide customer satisfaction metrics, NPS scores, or survey results if available | Forward-looking indicator of churn. Declining NPS predicts revenue decline that hasn’t shown up yet. |
| 39 | Identify any customer that has indicated they may not renew, expand competitively, or change suppliers post-close | Customers often signal intent to leave months before they actually do. The seller usually knows. Force the disclosure. |
Employee and HR diligence: 8 questions that drive transition success
Employee diligence determines whether the team holds together post-close. Key employee identification, retention agreements, hidden HR liabilities, and the gap between the formal org chart and actual work allocation. Most acquisitions that fail in months 1-12 fail because of employee departures the buyer didn’t see coming.
| # | Employee/HR diligence question | Why it matters |
|---|---|---|
| 40 | Provide a complete employee roster: name, role, tenure, compensation, location, employment status (W-2 vs. 1099) | Misclassification of contractors as employees is a common contingent liability. Tenure data identifies institutional knowledge concentration. |
| 41 | Identify the 3-7 key employees whose departure would meaningfully damage operations | Forces the seller to be explicit. Each key employee needs a retention agreement signed before close. |
| 42 | Provide the last 5 years of EEOC filings, DOL audits, workers’ comp claims, and OSHA citations | HR liability history. Patterns of complaints (especially around a single supervisor or department) signal cultural issues that survive transition. |
| 43 | Provide employee benefits documentation: health, retirement (401(k), pension), PTO accrual policy, severance policy | Benefits costs and obligations transfer with the company. Underfunded pensions and accrued PTO are real liabilities at close. |
| 44 | Document any pending grievances, mediations, or arbitrations involving current or former employees | Pending matters are contingent liabilities that may convert to settlements post-close. Each requires reserve or seller indemnification. |
| 45 | Provide compensation data benchmarked to market for the top 20 employees | Below-market compensation predicts post-close attrition (employees become flight risks once they realize they’re underpaid). Above-market compensation is an EBITDA add-back candidate — or a retention tool the buyer needs to maintain. |
| 46 | Provide the employee handbook, code of conduct, and any documented complaints in the last 3 years | Reveals cultural and HR-policy gaps. Missing or outdated handbook is a common compliance issue in small businesses. |
| 47 | Document the seller’s relationships with key employees and identify any informal commitments (bonus promises, equity promises, severance commitments) | Verbal promises from sellers create post-close obligations the buyer didn’t budget for. Ask explicitly — the seller often forgets these unless prompted. |
IT and systems diligence: 5 questions that surface hidden tech liabilities
IT diligence reveals replacement costs, security exposure, and license non-compliance. Many small businesses run on 10-20 year-old systems patched together over decades, with cybersecurity gaps and undercount on commercial software licenses. Each is a contingent liability that should be quantified pre-close.
| # | IT/systems diligence question | Why it matters |
|---|---|---|
| 48 | Provide an inventory of all software licenses with seat counts, license types, and renewal dates | Software license non-compliance (Microsoft, Adobe, Autodesk under-counts) is common. Vendor audits can demand back-payment plus penalties. |
| 49 | Provide cybersecurity documentation: MFA coverage, endpoint detection, backup procedures, incident response plan, cyber insurance policy | Cybersecurity gaps are hidden liabilities. Ransomware in month 3 of ownership is a deal-breaker for many buyers’ financing covenants. |
| 50 | Disclose any data breaches, ransomware incidents, or unauthorized access events in the last 5 years | Prior incidents predict future incidents. Disclosure obligations under state breach laws follow ownership. |
| 51 | Identify any legacy or custom systems that are unsupported, undocumented, or dependent on a single individual | Single-point-of-failure systems are 12-24 month replacement projects. Cost should be quantified and factored into the deal. |
| 52 | Provide a list of all data assets (customer databases, vendor data, transaction history) with retention policies and access controls | Data ownership and retention are GDPR/CCPA compliance issues. Inadequate access controls predict insider risk and breach exposure. |
Environmental and regulatory diligence: 5 questions on the most under-priced risks
Environmental and regulatory diligence catches the largest contingent liabilities in industrial, manufacturing, and trades businesses. Soil and groundwater contamination, regulatory non-compliance, and unpermitted operations create liabilities that follow the property or the entity for years post-close. A Phase I environmental site assessment is non-negotiable for any business with industrial, manufacturing, automotive, or chemical-handling operations.
| # | Environmental/regulatory diligence question | Why it matters |
|---|---|---|
| 53 | Commission a Phase I environmental site assessment for any owned or leased property where industrial, manufacturing, or chemical handling occurs | Environmental liability follows the property in most states. Phase I cost is typically modest; remediation cost can be six or seven figures. |
| 54 | Provide all environmental permits, registrations, and reporting obligations (air, water, hazardous waste, stormwater) | Permit lapses or unreported releases are regulatory violations that follow ownership. Verify all permits are current and transfer-eligible. |
| 55 | Disclose any environmental notices of violation, consent orders, or pending agency investigations in the last 10 years | Open or recent enforcement actions are contingent liabilities. Settlement costs and remediation timelines should be reserved against the purchase price. |
| 56 | Provide industry-specific regulatory documentation: contractor licenses, healthcare licenses, transportation authority, food safety, FCC, FDA | Industry-specific regulatory non-compliance is often invisible to buyers from other sectors. Engage industry-experienced counsel for these reviews. |
| 57 | Disclose any tax audits, sales tax exposure, or unfiled returns in the last 7 years | State sales tax exposure for online or multi-state businesses is a significant contingent liability. Unfiled returns or under-reported tax can produce six-figure assessments post-close. |
How to use this question list
Send the questions in three waves, not all at once. Wave 1 (financial + customer + employee summary) goes immediately after LOI. Wave 2 (legal + operational + IT) goes 2-3 weeks later once Wave 1 responses are in hand. Wave 3 (environmental + regulatory + deep-dive follow-ups) goes 4-6 weeks in, after the first responses have surfaced areas needing deeper investigation.
Track every response in a tracker spreadsheet. Question number, status (pending, partial, complete, refused), date received, file location in data room, follow-up needed, materiality flag. The tracker becomes the diligence audit trail and the basis for retrade negotiations if findings emerge.
Flag every ‘not available’ or ‘we don’t track that.’ Inability to produce data is itself a finding. A seller who cannot produce customer-level revenue is a seller whose financial story you cannot verify. Inability to produce capex history means you cannot test deferred-investment risk. Each gap should reduce trust in the seller’s narrative and shift price or structure in your favor.
Use diligence findings to retrade or walk — or to confirm and close. Diligence is not paperwork. It’s the negotiation. Material findings should produce price adjustments, indemnification expansions, escrow holdbacks, or transaction-cancellation. Sellers expect modest retrades; buyers who run rigorous diligence almost always find them. Buyers who don’t find anything either ran shallow diligence or are buying a uniquely clean business — usually the former.
Looking to acquire a business?
We work primarily with sellers, but that means we see exactly which buy-side diligence requests get answered fully and which get the runaround. A 30-minute confidential conversation can sharpen the diligence list you’re sending into your next data room — what to ask, what to push when responses are incomplete, and what to walk on. No contract, no cost, no follow-up if it’s not a fit.
Book a 30-Min CallConclusion
Diligence is the negotiation, not the paperwork. The 57 questions above are the spine of a sophisticated buyer’s investigation: 15 financial questions that drive the price, 10 operational questions that test whether the business runs without the seller, 8 legal questions that drive the structure, 6 customer questions that drive the survival case, 8 HR questions that drive the transition, 5 IT questions that surface hidden technology liabilities, and 5 environmental and regulatory questions that catch the largest contingent risks. Send them in waves. Track every response. Treat ‘not available’ as a finding. And use what you learn to retrade, restructure, or walk — not to rationalize the deal you’ve already decided to close. The buyers who run diligence as a serious investigation, not a checklist, are the buyers who don’t end up writing post-close case studies about everything they should have caught.
Frequently Asked Questions
What is due diligence when buying a business?
Due diligence is the buyer’s investigation of the target between LOI and close. It tests every claim in the seller’s pitch, surfaces undisclosed risks, and earns the buyer the right to retrade, restructure, or walk away. It typically runs 30-90 days and produces findings that reshape the deal.
How long does due diligence take?
Typically 30-90 days from LOI to close. Smaller deals (under $5M) can run on the shorter end; larger or more complex deals (regulated industries, multi-jurisdiction operations, environmental exposure) can run 90-180 days. The biggest driver is data-room responsiveness from the seller.
What are the most important due diligence questions to ask?
The financial questions drive the price (EBITDA add-back legitimacy, customer-level revenue, working capital, capex history). The customer questions drive the survival case (concentration, contracts, seller-relationship dependence). The legal questions drive the structure (litigation, IP ownership, change-of-control clauses).
What does Quality of Earnings (QoE) cover?
A QoE study tests the legitimacy of EBITDA: add-back validation, revenue recognition, customer concentration, working capital normalization, and one-time items. Buyer-commissioned QoE is standard for deals over $2-3M of EBITDA and produces findings that often retrade the price by 5-15%.
Should I trust the seller’s financial statements?
Audited statements are reasonably reliable. Reviewed statements are acceptable but should be tested. Compiled statements (the most common in small businesses) have not been tested by the accountant and should be verified through bank statement reconciliation, tax return cross-checks, and customer-level revenue analysis.
What red flags should I look for in due diligence?
Inability to produce customer-level revenue. Compiled-only financial statements for deals over $1M EBITDA. EBITDA add-backs over 25% of EBITDA. Top customer over 35% of revenue. Pending litigation outside ordinary course. Unsigned key employees. Deferred capex. Software license under-counts. Phase I environmental concerns. Each is a structural risk that should reprice or restructure.
How do I verify customer concentration?
Request top-20 customer revenue for each of the last 3 years. Calculate top-1, top-5, top-10 concentration. Read written contracts on every top-10 customer. Identify which customers have a personal relationship with the seller. Confirm change-of-control clauses do not trigger termination.
What is a Phase I environmental site assessment?
A Phase I ESA is a standardized environmental investigation of a property to identify recognized environmental conditions: prior industrial use, soil or groundwater contamination, hazardous material storage, regulatory violations. It’s required for most commercial real estate transactions and any business with industrial, manufacturing, automotive, or chemical-handling operations.
What happens if due diligence finds problems?
Several options. Retrade the price (most common). Expand indemnification or escrow. Add closing conditions or covenants. Restructure as asset sale to limit liability. Walk away if findings are material. Sellers expect modest retrades; major findings can produce 10-30% price adjustments or kill the deal entirely.
Should I hire outside advisors for due diligence?
Yes, for deals over $2-3M EBITDA. The standard team: a transaction attorney (legal diligence, drafting), an accounting firm for QoE (financial diligence), an environmental consultant (Phase I, Phase II if needed), and an industry-experienced operator or sector advisor (operational diligence). Cost is typically 1-3% of deal value — less than the value of findings they surface.
Can the seller refuse to answer diligence questions?
Sellers can refuse, but each refusal is a finding. Confidentiality concerns are addressed through NDAs and clean-team protocols, not blanket refusals. A seller who refuses to disclose top-customer revenue (citing confidentiality) is signaling either real concentration risk or a lack of customer-level data — both of which should reprice or kill the deal.
What’s the difference between an asset sale and a stock sale in diligence?
Asset sales: buyer acquires specific assets and assumes specific liabilities. Most contracts must be assigned and re-negotiated. Most licenses don’t transfer automatically. Liability protection is broader but operational complexity is higher. Stock sales: buyer acquires the entity. Contracts and licenses generally transfer (subject to change-of-control clauses). Liability protection is narrower; legal diligence must be more thorough because all historical liabilities transfer with the entity.
Related Guide: Quality of Earnings: What QoE Tests and Why It Matters — The buyer-commissioned QoE study is the single most important diligence investment in deals over $2-3M of EBITDA.
Related Guide: Letter of Intent (LOI) — Your Complete Guide — The 9 essential terms every buyer must understand before signing the LOI that triggers diligence.
Related Guide: Asset Sale vs. Stock Sale: Which Structure Fits Your Deal — Diligence requirements and liability transfer differ sharply between asset and stock sales. Choose the structure before you build the diligence list.
Related Guide: Reps and Warranties Insurance: When Buyers Should Demand R&W Coverage — R&W insurance bridges the gap between diligence findings and seller indemnification capacity. Increasingly standard in deals over $25M.
Want a Specific Read on Your Business?
30 minutes, confidential, no contract, no cost. You leave with a read on your local buyer market and a likely valuation range.
30 N Gould St, Ste N, Sheridan, WY 82801, USA · (307) 487-7149 · Contact
