Mergers and Acquisitions Due Diligence Process: Buyer’s Full Workflow (2026)

The mergers and acquisitions due diligence process runs 60 to 90 days from a signed letter of intent to close, costs the buyer $150,000 to $400,000 in third-party fees on a lower middle market deal, and re-trades roughly one in three transactions according to the SRS Acquiom 2025 Deal Terms Study. Sellers who understand the buyer’s sequence, workstreams, and trigger points walk into diligence with documents already organized, surprises already disclosed, and a multiple that holds at signing instead of getting clawed back at week six.

What This Actually Means

Due diligence is the buyer’s investigation of the seller’s business between the signing of the letter of intent and the closing of the purchase agreement. The buyer is no longer asking “do we want to buy this.” That question was answered at the LOI. The buyer is now asking “what does this business actually look like under the hood, and does the price we offered still make sense once we see it.” Every workstream, every data room request, every management interview exists to answer one of those two questions.

The process is layered. Preliminary diligence happens before the LOI is signed and runs on top-line financials and a teaser. Detailed diligence happens after the LOI is signed and covers ten workstreams over eight to ten weeks. Confirmatory diligence happens in the final two weeks before close and verifies that nothing has changed since the definitive agreement was drafted. Each layer has its own deliverables, its own gatekeepers, and its own re-trade triggers.

For the seller, the key reframe is this: diligence is not an audit. An audit verifies what already happened. Diligence verifies what the buyer is about to pay for. The standard is different, the sample size is different, and the consequences of a missed item are different. An audit finding gets footnoted. A diligence finding gets priced.

The Five Phases of the Process

Phase 1: Preliminary (Week 1 to Week 2)

Before the LOI is signed, the buyer is working off a teaser, a confidential information memorandum, and a one-page financial summary. The seller signs an NDA, shares trailing-twelve-month revenue and EBITDA, and answers a short list of qualifying questions: customer concentration, owner involvement, industry licensing, real estate. The buyer is screening for fit and pricing the bid. No third-party fees have been incurred yet by either side. Typical timeline is one to two weeks from first contact to indication of interest.

Phase 2: IOI Submitted (Week 3 to Week 4)

The buyer issues a non-binding indication of interest with a valuation range, typically expressed as a multiple of trailing-twelve-month EBITDA or SDE. The IOI also lays out structure (cash at close, rollover equity, seller note, earnout), exclusivity terms, and the diligence plan. If the seller accepts the IOI and grants exclusivity, the LOI is drafted and signed. Exclusivity windows are usually 60 to 90 days. Once exclusivity attaches, the seller cannot shop the deal, and the buyer starts spending real money on diligence.

Phase 3: Detailed Diligence (Week 5 to Week 12)

This is the meat of the process. All ten workstreams open in parallel. The virtual data room is populated by Week 2 of this phase (Week 6 overall). The first management presentation happens at Week 4 of this phase (Week 8 overall). Quality of earnings preliminary findings hit at Week 6 of this phase (Week 10 overall). By Week 8 of this phase (Week 12 overall), the buyer has a working list of major risks, knows whether the deal still pencils, and is ready to begin definitive agreement negotiations.

Phase 4: Definitive Negotiation (Week 13 to Week 16)

Diligence findings get translated into asset purchase agreement terms. Customer concentration becomes a specific indemnification carve-out. Tax exposure becomes an escrow holdback. Working capital trends become a peg and a true-up mechanism. Representations and warranties get scheduled, exceptions get listed, and the disclosure schedules grow to 50 to 200 pages. This is also when re-trade discussions happen. If the QoE report cut EBITDA by 15 percent, the buyer comes back with a lower price or a larger seller note. The seller’s negotiating position at this stage is whatever they preserved by being transparent in Phase 1.

Phase 5: Confirmatory (Week 17 to Week 20)

Final pre-close verification. The buyer re-pulls bank statements, re-checks the customer list, re-confirms key employee retention, and validates that no material adverse change has occurred since the signing of the definitive agreement. Escrow agreements get funded, transition services agreements get signed, and the wire instructions go out. Closing happens on a target date set in the definitive agreement, typically the first of a month for accounting cleanliness.

The Ten Workstreams in Detail

1. Financial Diligence and Quality of Earnings

The financial workstream is led by a third-party QoE provider. On lower middle market deals, buyers use firms like CohnReznick, RSM, Baker Tilly, BDO, or a regional accounting firm with a transaction services practice. Cost ranges from $50,000 to $150,000 depending on deal size and complexity, with a 4 to 6 week turnaround from kickoff to final report. The QoE verifies that reported EBITDA is real, normalizes add-backs (owner compensation above market, personal expenses, one-time legal fees), identifies non-recurring revenue, and analyzes working capital trends to set the peg for the definitive agreement.

The QoE is the single most important diligence deliverable. Per the SRS Acquiom 2025 Deal Terms Study, financial diligence findings drive 60 to 70 percent of all price re-trades in lower middle market deals. If the QoE knocks $500,000 off normalized EBITDA on a 5x multiple deal, that is $2.5 million off the purchase price. Sellers who prepare a sell-side QoE before going to market lose less in this step because the add-back position has already been pressure-tested.

2. Commercial Diligence

Commercial diligence answers whether the revenue is durable. The buyer or a third-party consultant reviews customer concentration (top 10 as a percent of revenue), contract terms (length, renewal mechanics, termination clauses), historical churn, win-loss rates, Net Promoter Score where available, and the size and growth of the underlying market. On services businesses, commercial diligence often includes blind customer reference calls where a consultant calls 10 to 20 customers without disclosing the transaction and asks about service quality, switching likelihood, and pricing sensitivity.

Customer concentration above 20 percent in a single account is a yellow flag. Above 40 percent is a red flag that typically triggers a structural change to the deal, like a customer-retention earnout. The Capstone Partners 2026 Lower Middle Market Survey reports that 38 percent of deals with greater than 30 percent single-customer concentration include a contingent payment tied to that customer staying through year one.

3. Operational Diligence

Operational diligence walks the facilities, inspects equipment, maps the supply chain, and interviews key vendors. For a manufacturing business, the buyer assesses production capacity, equipment age, maintenance logs, and supplier dependencies. For a services business, the buyer assesses dispatch systems, scheduling software, fleet condition, and subcontractor relationships. The deliverable is a list of capital expenditure requirements over the next 24 months, which becomes a working-capital adjustment or a price reduction.

4. Legal Diligence

Outside counsel reviews corporate records (articles, bylaws, board minutes, cap table, stock ledger), all material contracts, pending and threatened litigation, intellectual property ownership, regulatory inquiries, and historical compliance with state and federal law. Legal diligence on a $25M deal typically runs $50,000 to $100,000 in buyer-side fees over six to eight weeks. The deliverable is a legal due diligence memo identifying every issue that must be resolved before close, disclosed on a schedule, or carved out of the representations.

5. Human Resources Diligence

HR diligence covers the employee roster, comp data, benefit plans (especially any defined-benefit plan or unfunded liability), employment agreements, non-compete enforceability by state, payroll practices, worker classification (W-2 versus 1099), and retention risk. The buyer is specifically looking for key-person dependencies and any employees whose departure would impair the business. Retention bonuses, stay agreements, and post-closing employment contracts for the top three to five employees are typically negotiated during this workstream.

6. Tax Diligence

Tax diligence reviews federal and state income tax returns for the last three years, sales and use tax compliance across every state where the business has nexus, payroll tax filings, any R&D credit claims, and audit history. State nexus exposure is one of the most common surprise findings. A services business operating in 20 states without sales tax registrations can be sitting on six figures of historical exposure plus interest and penalties. The tax workstream usually produces an escrow holdback of 10 to 25 percent of identified exposure, released as the statute of limitations runs.

7. Environmental Diligence

Environmental diligence is required for any deal involving real estate, manufacturing, automotive, dry cleaning, fuel handling, or industrial operations. A Phase I Environmental Site Assessment per ASTM E1527-21 standard is the baseline deliverable and costs $2,500 to $5,000 per site with a 3 to 4 week turnaround. If the Phase I identifies recognized environmental conditions, a Phase II ESA with soil and groundwater sampling follows at $15,000 to $50,000. Findings drive escrow holdbacks, seller indemnifications, and occasionally a price reduction equal to the estimated remediation cost.

8. IT and Cyber Diligence

IT diligence inventories software (and verifies license compliance), reviews infrastructure (cloud versus on-prem, backup posture, disaster recovery), and assesses cyber posture (MFA adoption, endpoint security, incident history, cyber insurance coverage). For software and SaaS businesses, IT diligence is heavier and often includes a code review, a tech debt assessment, and an architecture review. Cyber findings rarely kill deals but frequently produce indemnification carve-outs for any pre-close incident discovered post-close.

9. Compliance and Regulatory

Industry-specific. For healthcare, this means HIPAA, Stark, Anti-Kickback, and CMS billing reviews. For financial services, this means FINRA, SEC, and state licensing. For HVAC, plumbing, and electrical, this means EPA Section 608 certification, contractor licensing by state, and refrigerant handling compliance. The buyer is looking for any unlicensed activity, any historical violations that could become successor liability, and any open inquiries from regulators.

10. Strategic and Synergy Validation

The buyer revisits the original thesis. If the deal was sold to the investment committee on the basis of a roll-up play, strategic diligence tests whether this target actually fits the roll-up. If it was sold on margin expansion, this workstream tests whether the buyer can realistically expand margins given the operational reality observed during diligence. The output goes back to the buyer’s investment committee for re-approval before the definitive agreement is signed.

Worked Example: $25 Million HVAC Acquisition

Consider a buyer acquiring a residential and light commercial HVAC contractor in the Southeast. The business has $18M revenue, $3.5M EBITDA, 85 employees, a 40,000 square foot warehouse, and 35 service vehicles. The LOI was signed at a 7.1x multiple, valuing the deal at $25M with $20M cash at close, $3M seller note over five years, and $2M rollover equity.

Here is how the diligence calendar actually ran:

Buyer-side diligence costs on this deal:

The seller’s QoE adjustment ($215K EBITDA reduction) drove a $1.5M price re-trade. The underlying issue was three years of inflated owner add-backs that did not survive Baker Tilly’s normalization standard. A sell-side QoE prepared before going to market would have flagged this internally and let the seller either fix the add-back position or quote a lower starting price. Going in cold cost this seller roughly $1.5M.

Common Mistakes Sellers Make

Treating the Data Room as a Document Dump

The data room is not a filing cabinet. It is a sales pitch. Every document the buyer pulls answers a question the buyer was about to ask. Sellers who upload 4,000 PDFs in random folders, mix scans with originals, and label files “Document_Final_v3.pdf” are signaling chaos. Sellers who organize the room by workstream (Financial, Legal, HR, Tax, Operations) and include a one-page index per folder are signaling competence. The buyer’s diligence team forms a price opinion partly on the quality of the data room itself.

Hiding the Bad News Instead of Pricing It

Every business has one or two skeletons. The customer that left last year. The sales tax exposure in Texas. The lawsuit that settled. The seller who discloses these in the first management meeting, with a clear explanation and a remediation, controls the narrative. The seller who buries them in the data room and waits for the QoE to find them at Week 6 gives the buyer ammunition for a re-trade. Disclosure is not a weakness. Hidden risk is.

Letting Diligence Distract From the Business

Diligence is a part-time job for the owner and a full-time job for the CFO and controller. If the owner spends three days a week answering buyer questions and the business misses its Q3 number, the buyer sees the miss in monthly financials and adjusts the price downward. Sellers who continue running the business at the same intensity during diligence, and assign a dedicated point person to handle buyer requests, hold their price.

Underestimating Working Capital Mechanics

Working capital is the most-litigated post-close issue in the lower middle market. The buyer sets a target working capital based on the trailing 12 months. If actual working capital at close is below the target, the seller writes a check for the shortfall. Sellers who do not understand the mechanic find out 60 days post-close when the buyer sends a true-up demand for $400,000. Get an outside accountant to model working capital before the definitive agreement is finalized.

Allowing Key Employees to Become a Surprise

If a top operator quits in Week 9 of diligence because of uncertainty about the transaction, the buyer treats it as a material adverse change. Re-trade or kill. The fix is to bring the top three to five people into the loop earlier with stay bonuses, transparent communication, and post-close employment letters drafted in parallel with the APA. The buyer will require this anyway. Doing it proactively reduces the risk that someone walks at the worst possible moment.

Picking the Wrong Advisor for the Wrong Deal

An investment banker who runs $100M deals is not the right advisor for an $8M transaction, and a business broker who lists restaurants is not the right advisor for a $40M industrial services business. Match the advisor to the deal size, vertical, and buyer pool. The wrong advisor wastes the first 30 days of exclusivity and increases the chance the deal dies in diligence.

Timeline and Process Reference

1. Day 0: LOI signed. Exclusivity attaches. Buyer engages QoE provider, legal counsel, and environmental consultant within 7 days.
2. Day 7 to Day 14: Data room populated. Seller’s advisor finalizes the population and runs an internal review for sensitive items.
3. Day 14 to Day 21: First management presentation. Owner, CFO, and top two operators present the business to the buyer’s deal team and key advisors. 3 to 5 hours, in person.
4. Day 21 to Day 42: All ten workstreams in active diligence. Daily document requests, weekly status calls, on-site visits as needed.
5. Day 35 to Day 42: QoE preliminary findings. Buyer and seller align on EBITDA, add-backs, working capital target.
6. Day 45 to Day 55: Major risks identified. Buyer’s investment committee re-approves the deal or requests a re-trade.
7. Day 55 to Day 65: Definitive agreement first draft. Legal teams trade markups. Disclosure schedules drafted by seller’s counsel.
8. Day 65 to Day 75: Final negotiations on reps and warranties, indemnification caps, escrow, working capital peg. Definitive agreement signed.
9. Day 75 to Day 90: Confirmatory diligence. Final document pulls, key employee retention confirmed, no material adverse change verified.
10. Day 90: Closing. Wires sent, equity transferred, post-close transition begins.

Red Flags That Re-Trade or Kill Deals

Per the SRS Acquiom 2025 Deal Terms Study and the Capstone Partners 2026 Lower Middle Market Survey, the most common diligence findings that cause re-trades or terminations are:

• Customer concentration above 30 percent in a single account, especially when contracts are short or terminable for convenience.
• EBITDA quality issues identified by the QoE, particularly aggressive add-backs, deferred revenue treatment, or capitalized expenses that should have been expensed.
• Undisclosed litigation that surfaces in the legal review, especially employment claims, customer disputes, or IP infringement matters.
• Multi-state tax exposure from unregistered nexus, particularly sales tax in states like Texas, California, and New York.
• Environmental contamination identified in a Phase I ESA, triggering a Phase II and potential remediation liability.
• Key employee resignation during the diligence window, especially if the employee is named in the operating model or controls a major customer relationship.
• IP ownership disputes where work product was created by contractors without proper assignment agreements, or where the seller does not own the software, brand, or technology being sold.
• Working capital coming in below buyer expectation based on the QoE target, especially if seasonality was misrepresented.

Any one of these can drive a 5 to 15 percent price reduction. Two or three together can kill the deal entirely. According to SRS Acquiom, roughly 11 percent of LOI-signed deals do not reach close, with diligence-driven termination being the leading cause.

Who Manages the Process

On the buyer side, a senior associate or vice president from the deal team coordinates diligence day to day. A partner or managing director oversees the workstreams and makes the re-trade calls. External consultants (QoE provider, outside legal counsel, environmental consultant, tax specialist, IT auditor) deliver specialized findings into the deal team.

On the seller side, if a sell-side advisor is involved, that firm coordinates seller responses, manages the data room, and quarterbacks management presentations. The seller’s CFO or controller handles financial document requests. The seller’s outside counsel handles legal document requests and APA negotiation. The owner is the face of the business in management meetings and is on the hook for the strategic narrative and the customer-retention story.

If the seller does not use a sell-side advisor (which is the case in roughly 30 to 40 percent of lower middle market deals per Capstone Partners), the owner and CFO carry the entire load. That is workable on smaller deals (under $10M enterprise value) but becomes a bottleneck on larger transactions where the document volume and parallel workstreams exceed what an internal team can handle while still running the business.

How CT Acquisitions Approaches This

CT Acquisitions is the buyer. We pay for the QoE, the legal diligence, the environmental work, the IT audit, and every other third-party fee. Sellers who work with us do not pay an advisor retainer, a success fee, or a percentage of the transaction. The diligence process runs out of our shop, on our timeline, with our external providers.

Our diligence philosophy is direct: tell us what is wrong with the business up front and we will price it accurately at LOI and hold to that price at close. Sellers who use us as a buyer get a fixed offer that does not move based on QoE adjustments, because we incorporate realistic add-back haircuts into our initial bid. If the QoE comes in materially better than expected, the seller benefits. If it comes in worse than disclosed, that is on the seller, but we will not invent reasons to re-trade. Book a free consultation if you want to walk through what diligence would actually look like on your business.

Frequently Asked Questions

How long does the mergers and acquisitions due diligence process take?

Most lower middle market deals run 60 to 90 days from LOI signing to close. Smaller transactions (under $10M enterprise value) can close in 45 to 60 days. Larger or more complex deals (regulated industries, multi-state operations, environmental issues) can run 120 days or longer. Exclusivity windows in the LOI typically grant 60 to 90 days, with extensions available if both parties agree.

Who pays for due diligence?

The buyer pays for all buyer-side diligence costs, including the QoE provider, legal counsel, environmental consultant, IT audit, and any specialized advisors. The seller pays for their own legal counsel, their sell-side advisor if engaged, and any sell-side QoE they choose to commission before going to market. On a $25M deal, buyer-side diligence costs are typically $150,000 to $250,000 and seller-side legal and advisory costs run $100,000 to $400,000 depending on the advisor model.

What is a quality of earnings report and why does it matter?

A quality of earnings report is an analysis prepared by an independent accounting firm that verifies reported EBITDA, normalizes add-backs, identifies non-recurring items, and analyzes working capital trends. It is the most important diligence deliverable because it determines the EBITDA figure used in the final purchase price calculation. A QoE that cuts $300,000 off EBITDA at a 6x multiple reduces the purchase price by $1.8M. Sellers can commission a sell-side QoE before going to market to pressure-test their add-back position.

Can a seller refuse a due diligence request?

A seller can decline any specific request, but each refusal is read by the buyer as a signal. Refusing to share customer-level revenue data, refusing to allow customer reference calls, or refusing to disclose litigation history typically triggers either a price reduction, a structural change to the deal (larger escrow, longer indemnification period), or a deal termination. The right approach is to scope sensitive requests carefully (NDA, clean team, redacted versions) rather than refuse outright.

What happens if diligence finds something material?

The buyer has three options. First, re-trade the price to reflect the finding (most common). Second, restructure the deal with a larger escrow, a specific indemnification, an earnout tied to the issue, or a delayed close pending remediation. Third, terminate the LOI and walk away (least common but legally available within the exclusivity period). The seller’s options depend on what is in the LOI: most LOIs are non-binding except for exclusivity and confidentiality, so neither side has a legal obligation to close on the LOI terms.

How can a seller prepare for diligence before going to market?

Three steps in order. First, commission a sell-side QoE from a regional accounting firm 60 to 90 days before going to market so add-backs are pressure-tested and EBITDA is defensible. Second, organize a data room with all corporate records, financials, contracts, HR files, and tax returns indexed by workstream. Third, disclose all known issues (customer concentration, litigation, tax exposure, key person risk) in the initial conversations with buyers so the LOI price reflects reality. Sellers who do these three things hold their price at close at a rate substantially higher than sellers who go in cold.

What to Do Next

The mergers and acquisitions due diligence process is the single most expensive and risk-laden phase of selling a business. Sellers who understand the buyer’s sequence, prepare the data room before going to market, and disclose known issues in the first management meeting walk away with the LOI price intact. Sellers who treat diligence as something that happens to them lose 5 to 15 percent of enterprise value to re-trades that could have been avoided.

If you are within 12 months of selling, the highest-value move is to commission a sell-side quality of earnings report now, organize your data room by workstream, and have a candid conversation with a buyer who can tell you what the diligence findings on your business will actually be.