Due Diligence Checklist: 42 Things to Verify Before Buying a Business

Due diligence is where buyers earn their returns — or lose their shirts. The goal isn't to find reasons to walk away; it's to price risk accurately. Here's what to verify, organized by urgency.

Phase 1: Financial Due Diligence (Week 1-2)

Start here. If the numbers don't work, nothing else matters.

• 3 years of tax returns — compare to financial statements. Differences tell a story.
• Monthly P&Ls for the current year — look for trends, not just totals.
• Bank statements for 12 months — verify revenue deposits match reported sales.
• Accounts receivable aging — anything over 90 days is probably uncollectible.
• Customer concentration analysis — top 5 customers as % of revenue.
• Vendor concentration — dependency on any single supplier.
• Owner's compensation and perks — what's actually business vs. personal expense.
• Debt schedule — all loans, lines of credit, personal guarantees.
• Capital expenditure history — deferred maintenance inflates earnings.
• Working capital trends — is the business consuming or generating cash?

Phase 2: Legal Due Diligence (Week 2-3)

• Corporate formation documents — articles, bylaws, operating agreement.
• Cap table and ownership records — who actually owns what.
• Material contracts — customer agreements, vendor contracts, leases.
• Change-of-control provisions — which contracts terminate on sale?
• Pending or threatened litigation — lawsuits, demand letters, regulatory actions.
• IP ownership — patents, trademarks, copyrights, trade secrets. Who wrote the code?
• Employment agreements — non-competes, non-solicits, IP assignment.
• Insurance policies — coverage limits, claims history, tail coverage needs.
• Regulatory compliance — industry-specific licenses and permits.
• Environmental liabilities — especially for manufacturing, real estate.

Phase 3: Operational Due Diligence (Week 3-4)

• Organizational chart — who reports to whom, key person dependencies.
• Employee roster — tenure, compensation, benefits, turnover rate.
• Key employee retention risk — who leaves if the owner leaves?
• Customer satisfaction data — NPS, reviews, churn rate, complaint history.
• Sales pipeline and win rates — how predictable is revenue?
• Marketing spend and CAC — customer acquisition cost by channel.
• Operational SOPs — are processes documented or all in someone's head?
• Supplier relationships — pricing, terms, switching costs.
• Inventory management — turnover, obsolescence, shrinkage.
• Facilities and equipment — condition, age, maintenance schedules.

Phase 4: Technology and Systems (Week 4-5)

• Tech stack inventory — every software tool in use, licensing costs.
• IT infrastructure — servers, networks, security posture.
• Data security and privacy — breach history, compliance (GDPR, CCPA).
• Software code ownership — open source licenses, contractor IP assignment.
• System integrations — what breaks if one tool goes down?
• Data backup and recovery — RPO and RTO.

Phase 5: Strategic and Cultural (Week 5-6)

• Market position and competitive landscape — who's gaining share?
• Growth opportunities — new markets, products, channels.
• Company culture — employee surveys, Glassdoor, exit interviews.
• Customer references — talk to 5-10 customers directly.
• Post-acquisition integration plan — what changes on day one?
• Why is the seller selling? — the stated reason vs. the real reason.

Red Flags That Kill Deals

Some issues can be priced in. These usually can't: undisclosed litigation, customer concentration >40%, owner dependence (business collapses without them), declining revenue trend with no explanation, and sellers who resist providing basic financial records.