What Questions to Ask When Buying a Business in 2026: 40+ Across 8 Diligence Categories

What questions to ask when buying a business in 2026 breaks into 40+ tactical questions across eight diligence categories: financial (recast EBITDA, working capital, cash conversion), commercial (customer concentration, contract renewal cycles, market position), operational (systems, key employees, capacity), HR (retention, benefits, non-competes), legal (litigation, permits, IP), tax (open audits, deferred items), cyber (breach history, IT stack), and ESG (regulatory exposure, sustainability commitments). A $4M EBITDA HVAC worked example shows how the questions cascade during a real diligence process.

The questions when buying a business that actually matter are the ones the seller hopes you won’t ask. A polished CIM and three friendly management meetings leave the buyer with the impression that the business runs itself, that customers are sticky, that the books are clean, and that the team will stay through close. The 40+ questions in this guide test each of those impressions across eight categories. Use this as a working checklist: each section gives the specific questions, why they matter, and what an honest answer looks like. The HVAC worked example near the end shows how the same 40 questions apply to a real $4M EBITDA acquisition. Internal links connect to deeper guides on due diligence questions, the full acquisition due diligence process, and our buying an existing business checklist.

“The questions when buying a business that surface real risk are almost never on the seller’s prepared list. The buyer’s job is to bring the list the seller didn’t expect.”

Key Takeaways

• The financial questions when buying a business carry the most price impact: gross margin trend, addback quality, AR aging, and working capital normalization can move the offer by 0.5x to 1.5x EBITDA.
• Commercial questions confirm whether the revenue is recurring or repeated. Top 10 customer tenure, churn rate, and pipeline coverage are the three highest signal metrics.
• Operational and HR questions surface key person dependency, the single largest source of post close failure in deals under $25M EBITDA.
• Legal and tax questions are where carve outs, escrows, and special indemnities get negotiated. Missing IP assignments and sales tax nexus exposure are the two most common findings.
• Cyber and ESG questions are now standard in any deal over $5M EBITDA. CMMC, SOC 2, and OSHA records are commonly requested in the second data room request.
• The HVAC worked example shows how the 40 question checklist plays out on a real $4M EBITDA acquisition, including which questions surfaced the biggest issues.

Financial questions when buying a business (10 questions)

Financial questions are where the price gets set or reset. Every dollar of addback that gets disallowed in a Quality of Earnings report comes out of the offer at the deal multiple. The ten questions below drive the most price impact.

#	Financial question	What an honest answer looks like
1	Walk me through revenue by month for the last 36 months, by customer cohort and by product line.	A view that shows seasonality, cohort retention, and which product lines are growing versus declining. Anything less is incomplete.
2	What is the trailing 36 month gross margin by product line, and what is driving any movement?	Margin trend explained by input costs, pricing actions, and mix shift. A 200 basis point compression without a clear cause is a red flag.
3	How is EBITDA reported and how does it reconcile to GAAP net income?	A clear bridge from net income to EBITDA, with each line item supported by source documents.
4	List every addback above $10K with documentation.	Owner comp normalization, one time legal, discretionary travel, related party rent. Anything labeled “other” or “miscellaneous” gets disallowed.
5	What percentage of revenue comes from the top 1, top 5, and top 10 customers?	Top 10 above 50% is concentration risk. Top 1 above 20% is a separate carve out conversation. See our deep dive on how to evaluate a small business for acquisition.
6	Show me the AR aging at month end for the last 12 months.	Stable aging buckets. A growing 90+ bucket is a hidden bad debt reserve waiting to bite.
7	What is the normalized working capital target, and how was it calculated?	A 12 month trailing average of net working capital, peg adjusted for seasonality. Sellers often present a low peg to inflate the equity check.
8	What is the capex history and the maintenance capex run rate?	Maintenance capex of 1.5% to 4% of revenue is typical for asset light services. Anything below that suggests deferred maintenance.
9	What inventory adjustments and write downs have you taken in the last 36 months?	A clear policy with documented write offs. No write offs in 3 years means a balloon is coming.
10	Are there any related party transactions, and how are they priced?	Disclosed and priced at fair market value. Below market rent from a related party LLC is a classic carve out.

Commercial questions when buying a business (6 questions)

Commercial questions confirm whether revenue is durable. A company can show three years of growth and still be a melting ice cube if the growth was driven by one customer or one sales rep who is about to leave. The six questions below test commercial durability.

#	Commercial question	Why it matters
11	Show me the top 20 customers by revenue with tenure and renewal history.	Tenure under 18 months for the top 5 is a churn warning. Long tenure with rising spend is the gold standard.
12	What is the gross and net revenue retention by cohort?	Gross retention above 90% with net above 100% indicates pricing power and expansion. Anything below 80% gross is a churn problem.
13	What is the sales rep productivity, ramp time, and quota attainment by rep?	A top heavy distribution where 2 reps drive 60% of bookings is key person risk on the revenue side.
14	What is the current pipeline by stage, age, and probability?	Pipeline coverage of 3x to 4x next quarter quota is healthy. Below 2x is a forecast risk.
15	What is the customer acquisition cost, payback period, and LTV to CAC ratio?	Payback under 18 months and LTV to CAC above 3:1 is the benchmark for healthy unit economics.
16	Which customers are at risk and what is the seller doing to retain them?	An honest list of at risk accounts with retention plans. A “no churn risk anywhere” answer is dishonest.

Commercial answers should match customer call data. If the seller reports 8% churn but three out of five reference calls describe service issues, real churn is higher. The M&A due diligence checklist covers how to schedule references without spooking the account.

Operational questions when buying a business (5 questions)

Operational questions test whether the business runs on documented process or on the owner’s head. A business that depends on the owner to quote, dispatch, or close large deals can lose 20% to 40% of its EBITDA in the year after the owner leaves. The five below surface key person dependency before LOI.

#	Operational question	What to listen for
17	Which core processes are documented in SOPs, and which live in the owner’s head?	An honest split. Most lower middle market businesses have 30% to 50% process documentation. Less than 20% is a transition risk.
18	What does the owner do day to day that nobody else can do today?	Three or fewer items is healthy. Ten or more is a multi year transition.
19	Walk me through the technology stack: ERP, CRM, dispatch, accounting, payroll.	Modern stack on supported versions is a green flag. QuickBooks Desktop 2014 with spreadsheets gluing it together is a 6 to 12 month upgrade project.
20	What is the equipment fleet age, replacement schedule, and current condition?	A documented replacement schedule with reserve funding. Field equipment past useful life with no replacement plan is deferred capex.
21	What software contracts auto renew in the next 12 months and at what terms?	A clear contract log with renewal dates. Surprise auto renewals are a common post close cash drain.

HR questions when buying a business (5 questions)

HR questions surface the talent that needs to be retained and the talent that needs to be re evaluated. Buyers often discover post close that the comp plan is below market, that key managers expect a stay bonus, or that critical IP was developed by an employee who never signed an assignment. Each of those is fixable, but only if it is surfaced during diligence.

#	HR question	Why it matters
22	Share the org chart with names, titles, tenure, and total comp for everyone above $75K.	The first look at the management bench. Watch for departures in the 6 months before signing.
23	How does total comp benchmark against industry and geography?	Above market means margin compression risk; below market means retention risk. Both need a comp study.
24	Who needs a stay bonus to stay through close and 12 months post close?	Typically the top 3 to 5 employees. Stay bonuses of 25% to 50% of base for 12 to 24 months are standard.
25	Are there current employment agreements, non competes, non solicits, and confidentiality agreements for all key employees?	If the answer is no, expect to ask key employees to sign at or before close. Some will refuse.
26	Are there signed IP assignment and invention agreements for every developer, engineer, or creative employee?	Missing IP assignments are deal killers in software, IP heavy, and creative businesses. Surface this in week 2.

These questions should also be tested in employee interviews after the seller announces the deal. The org chart on paper rarely matches the org chart on the ground.

Legal questions when buying a business (5 questions)

Legal questions surface contingent liabilities that walk with the entity in a stock deal or get carved out in an asset deal. The five below cover the most common carve out, escrow, and special indemnity triggers.

#	Legal question	What honest disclosure looks like
27	List every active, threatened, and settled litigation matter in the last 7 years.	Counsel produces a complete schedule. A short verbal list from the owner is incomplete.
28	What licenses, permits, and regulatory approvals does the business hold, and which transfer on a change of control?	A documented license schedule, with change of control implications flagged. Some require regulator pre approval.
29	What environmental assessments have been done in the last 10 years, and what was found?	Phase I ESA on every owned property in the last 5 years. Anything older is stale; anything missing is a Phase I trigger.
30	Who owns the IP, including trademarks, patents, copyrights, source code, and trade secrets?	A clear IP schedule with assignments from every contributor. Gaps are the most common deal carve out.
31	List every lease over $50K annual rent, with term, renewal options, change of control clauses, and personal guarantees.	A complete lease schedule. Hidden personal guarantees and change of control clauses can hold up close.

Tax questions when buying a business (4 questions)

Tax questions surface exposure that survives the deal in a stock sale and gets indemnified in an asset sale. The four below cover the most common surprises: audit history, state nexus, sales tax exposure, and R&D credits or NOLs that may or may not survive a change of control.

#	Tax question	Why it matters
32	What federal, state, and local tax audits have been conducted in the last 7 years, and what were the findings?	A clean audit history is reassuring. Open audits or unresolved assessments are carve out triggers.
33	In how many states does the business have economic or physical nexus, and what is filed?	A nexus study covering all 50 states. Companies that ship to all 50 states and file in 12 have an exposure problem.
34	What is the sales and use tax exposure if every state were assessed today?	Quantified exposure with a reserve. The Wayfair decision (South Dakota v Wayfair, 2018) made every remote seller potentially liable.
35	What R&D credits, NOL carryforwards, and other tax attributes exist, and which survive a change of control under IRC Section 382?	A clear schedule with Section 382 limitation modeling. Most NOLs in a stock sale are limited.

Cyber questions when buying a business (3 questions)

Cyber questions are now standard in any deal over $5M EBITDA and mandatory in any deal with federal contracts. The three below cover compliance posture, certification status, and breach history. Undisclosed breach history is one of the top three post close litigation triggers in lower middle market deals.

#	Cyber question	What to require
36	Does the business need CMMC, ITAR, or DFARS compliance for any current or prospective contracts?	For federal contractors: CMMC Level 2 certification or a documented gap remediation plan. The Department of Defense CMMC 2.0 final rule (32 CFR Part 170) became effective December 16, 2024 with phased contract enforcement.
37	What security certifications does the business hold (SOC 2 Type II, ISO 27001, HITRUST)?	For software and services businesses: a current SOC 2 Type II report covering the last 12 months. An expired or scoped down report is a red flag.
38	Has the business had any security incidents, ransomware events, or data breaches in the last 5 years, including those that were not externally reported?	A complete incident log with root cause, scope, remediation, and any regulator or customer notification. Hidden breaches surface in indemnity claims post close.

ESG questions when buying a business (3 questions)

ESG questions are no longer optional for institutional buyers. Even a search fund using SBA financing will face questions from the bank on OSHA history and environmental compliance. The three below are the minimum.

#	ESG question	Why it matters
39	What is the OSHA recordable incident rate and DART rate for the last 5 years, and how does it compare to industry?	Industry comparison via Bureau of Labor Statistics. Above industry average is a worker safety carve out and an insurance premium driver.
40	Has the business measured its Scope 1, Scope 2, and Scope 3 carbon footprint?	For deals above $25M EBITDA, expect institutional buyers and lenders to ask. The SEC climate disclosure rule (March 2024) is in litigation, but lender expectations have already shifted.
41	Are there any pending EPA, state environmental agency, or local environmental enforcement actions or consent decrees?	Open enforcement actions are a deal stop. Resolved consent decrees with ongoing compliance are workable with disclosure.

Worked example: 40 question checklist on a $4M EBITDA HVAC acquisition

Target profile. Family owned residential and light commercial HVAC company in a Sun Belt metro, 42 employees, $24M revenue, $4M reported EBITDA, $4.6M after addbacks. Owner is 62, asking 6.5x adjusted EBITDA ($29.9M EV). Buyer is a search fund operator using SBA 7(a) financing. The 40 question checklist surfaced eight material issues in 30 days.

Financial (questions 1-10). Light commercial growth (18% annually) was driven entirely by one new construction relationship started in 2023 (22% of 2025 revenue: concentration). Addbacks included $185K of undocumented “owner discretionary” travel; QoE disallowed $140K, pulling $910K out of the offer at 6.5x. Maintenance capex ran 1.1% of revenue versus 2.8% benchmark: $400K-$500K of deferred fleet capex on 18 trucks.

Commercial (questions 11-16). The 22% customer had 14 months tenure, no signed contract, and had been approached by two competitors. 70% of new commercial bookings came from one rep age 58 “thinking about slowing down.” Light commercial pipeline coverage was 2.1x next quarter quota versus 3x benchmark.

Operational (questions 17-21). Process documentation existed for dispatch and field paperwork but not for commercial quoting or maintenance contract pricing (both in the owner’s head). Stack was ServiceTitan plus QuickBooks Desktop 2018 plus spreadsheets. Service truck fleet averaged 9 years versus 7 year manufacturer recommendation.

HR (questions 22-26). Strong 12 year service manager, weak 8 month operations manager (replacing a departure). Field technicians 8% below market, explaining 24% annual turnover. Stay bonuses required for service manager and senior commercial rep ($185K over 18 months). No employment agreements or non solicits existed.

Legal (questions 27-31). Three active matters: a 2024 wage and hour class action ($250K exposure), a covered customer property damage claim, and a former employee discrimination claim in mediation ($75K). Shop lease required landlord change of control consent and an owner personal guarantee. Phase I triggered because the last one was 2014.

Tax (32-35). Clean 7 year audit history, single state nexus, sales tax collected correctly, no R&D credits or NOLs.

Cyber and ESG (36-41). No federal contracts (CMMC not relevant), no SOC 2 needed. One 2023 ransomware event took down dispatch for 4 days, never disclosed to customers. OSHA recordable rate was 4.8 per 100 FTE versus the HVAC industry average of 3.4 (two heat exhaustion incidents in summer 2024), driving an 18% insurance premium markup.

How the questions changed the deal. Buyer cut the offer from $29.9M to $27.6M, structured a $1.5M escrow against the wage and hour litigation and the cyber incident, required a $185K stay bonus pool, and negotiated a 60 day landlord consent extension. Deal closed 84 days after LOI signing. Without the 40 question checklist, the buyer would have paid $29.9M, missed the concentration call, and inherited the litigation with no escrow.

How to use the questions when buying a business checklist

Sequence matters. Run financial questions in week 1 with the seller and the QoE provider. Schedule customer references and employee interviews in weeks 4 through 7. Reserve legal, tax, cyber, and ESG questions for weeks 3 through 8 with the relevant specialists. Use the last two weeks to triangulate inconsistencies and finalize the carve out and escrow list.

Document every answer and walk away early if the answers are evasive. A diligence question log with the question, the answer, the source, and the date prevents the seller from telling two different stories to two different members of the deal team. A pattern of “we’ll get to that later” answers in the first three meetings is a sign that the seller is hiding something or that the team does not actually know the answer. Either is a reason to slow down.

Frequently Asked Questions

What are the most important questions when buying a business?

The most important questions when buying a business are the financial ones: revenue trend, gross margin trend, EBITDA addback quality, customer concentration, AR aging, and working capital normalization. These six drive the most price impact. After financials, commercial questions (top customer tenure, churn, sales rep productivity) and HR questions (key person dependency, stay bonus needs, IP assignments) are the next most impactful. Legal, tax, cyber, and ESG questions are critical but more often drive escrows and carve outs than headline price.

How many questions should I prepare for diligence?

40 to 60 questions across the eight categories is the minimum for a lower middle market deal. The 41 questions in this guide are the core. Add deal specific questions for your industry, your transaction structure, and any prior red flags. The list grows during diligence as answers surface follow up questions. A diligence log with 100 to 150 questions and answers at close is typical for a $4M to $10M EBITDA deal.

What questions surface EBITDA addback issues fastest?

Three: (1) list every addback above $10K with documentation; (2) what would a third party QoE provider disallow on this list; (3) which addbacks would continue under new ownership versus which are one time or owner specific. Sellers who cannot answer question 1 with source documents are presenting unsupported addbacks. Sellers who push back hard on question 2 already know the QoE will haircut the number. Question 3 separates “owner discretionary” expenses that go away under new ownership from operating expenses that will continue.

How do I ask about cyber incidents without insulting the seller?

Frame it as standard practice and ask in writing as part of a representations and warranties checklist. “For the rep and warranty insurance underwriter, we need a complete log of any security incidents in the last 5 years, including those not externally reported. This is standard for every deal we run.” The framing is professional, the source is the insurer, and the documentation requirement protects both sides. Sellers who refuse to document this are signaling a problem.

What questions should I ask employees during diligence?

Five core questions: (1) what does the owner do that nobody else can do; (2) what would you change if you ran the place; (3) which customers are at risk and why; (4) what would make you leave in the first year under new ownership; (5) what is broken that nobody talks about. Run these one on one, in a private location, after the seller announces the deal. The answers triangulate against management’s version of the same questions.

How do I ask about sales tax nexus without alarming the seller?

Frame it as a buyer requirement, not a seller failure. “Our tax advisor needs a nexus study covering all 50 states for the last 7 years. This is standard since the South Dakota v Wayfair decision in 2018 changed remote seller obligations. We will share the study with you and we can resolve any gaps together before close.” The framing acknowledges that nexus exposure is common, normalizes the conversation, and offers cooperation on remediation.

What is the difference between pre LOI questions and post LOI diligence questions?

Pre LOI questions screen for deal breakers and confirm the target is worth pursuing. Post LOI diligence questions verify what the seller said and surface what was not volunteered. The 41 questions in this guide are diligence questions, designed for post LOI use when the buyer has data room access, management meetings, customer call permission, and employee interview access. See our companion guide on due diligence questions when buying a business for the full pre LOI to close question set.

How do I prioritize the 41 questions if I am short on time?

Run questions 1 through 10 (financial) in week 1 with no exception. Run questions 22 through 26 (HR) and 27 through 31 (legal) in week 2. Run questions 11 through 16 (commercial) in weeks 2 through 4 alongside customer references. Run questions 32 through 35 (tax) and 36 through 38 (cyber) in weeks 3 through 6. Run questions 17 through 21 (operational) and 39 through 41 (ESG) in weeks 4 through 8. The financial 10 are non negotiable; the rest are essential but can be parallelized with specialists.