The M&A Due Diligence Checklist (2026)

Due diligence is the work between a signed LOI and a closed deal where you confirm the business is what the seller says it is — and surface what they left out. This is the master checklist: the nine areas every acquirer works through, organized by discipline so nothing falls through the cracks. It's the hub for our industry-specific checklists — once you know the general framework, jump to the small business, SaaS, e-commerce, manufacturing, or home services checklist for the items unique to your deal.

Quick answer: M&A due diligence breaks into nine areas — financial, tax, legal, commercial, operational, technology, HR, environmental/regulatory, and integration. For a small-to-mid-market deal you won't go as deep on every one as a large PE buyer would, but you should consciously decide how deep to go on each, rather than skipping one by accident. The fastest deal-killers usually live in the financial and commercial areas, so start there.

The nine areas at a glance

Area	What it confirms	Where it usually bites
1. Financial	The earnings are real and repeatable	Add-backs, customer concentration, working capital
2. Tax	No inherited tax liabilities	Unfiled/underpaid taxes, nexus, misclassified contractors
3. Legal & corporate	Clean ownership and contracts	Change-of-control clauses, pending litigation, IP ownership
4. Commercial	Demand is durable	Customer churn, pipeline reality, pricing power
5. Operational	The business runs without the seller	Owner dependency, key-person risk, process gaps
6. Technology & IT	Systems and data transfer cleanly	Code/IP ownership, security, license compliance
7. HR & people	The team stays and is compliant	Key-employee retention, misclassification, benefits liabilities
8. Environmental & regulatory	No compliance time bombs	Permits, licenses, environmental liabilities
9. Integration	You can run it on day one	Transition plan, systems access, knowledge transfer

1. Financial diligence

The heart of every deal. Verify, don't trust: 3-5 years of financial statements and tax returns (reconciled against each other), normalized quality of earnings with owner add-backs scrutinized, working-capital requirements, and AR/AP aging. The single most common overstatement is "adjusted EBITDA" built on add-backs that don't hold up.

2. Tax diligence

You can inherit a seller's tax problems. Confirm federal, state, and local filings are current and paid; check sales-tax nexus (especially for multi-state or e-commerce sellers); and verify workers aren't misclassified as contractors. An asset purchase limits some exposure, but never assume — a tax advisor earns their fee here.

3. Legal and corporate diligence

• ✓Corporate records — clean cap table, good standing, and clear ownership of what you're buying.
• ✓Material contracts — read them for change-of-control clauses that let a key customer or supplier walk at close, auto-renewals, and unusual commitments.
• ✓Litigation and liabilities — pending or threatened claims, liens, guarantees, and off-balance-sheet obligations.
• ✓IP ownership — trademarks, domains, and (critically) that the company actually owns code or designs built by contractors.

4. Commercial and customer diligence

• ✓Customer concentration — any single customer over ~20% of revenue is high risk; top 3 over ~50% is extreme. Pull revenue-by-customer for 3 years and look at the trend.
• ✓Retention and churn — is the base sticky, or is sales spend filling a leaky bucket?
• ✓Pipeline and pricing power — is growth repeatable, and has the business ever raised prices without losing customers?

5. Operational diligence

For searchers and sponsors this matters more than in a big PE deal, because you'll run it. Map owner dependency (how many relationships and decisions live only in the seller's head), key-person risk below the owner, documented processes, and what the first 90 days post-close actually require.

6. Technology and IT diligence

Code and data ownership, security posture and breach history, third-party license compliance, and critical software/vendor dependencies. Even a non-tech business runs on systems now — confirm they transfer and you can access them on day one.

7. HR and people diligence

Key-employee retention (who must stay, and will they?), employment-law compliance, contractor classification, and any unfunded benefit or PTO liabilities you'd inherit. In owner-operated businesses, the people risk is often the real risk.

8. Environmental and regulatory diligence

Required permits and licenses (and whether they transfer), industry-specific compliance, and environmental liabilities — which matter enormously for manufacturing and any business touching property. Some environmental liabilities follow the asset regardless of deal structure.

9. Integration and day-one readiness

Diligence isn't just should I buy — it's can I run it Monday. Confirm the transition plan, knowledge transfer, systems access, vendor/customer introductions, and banking/payroll cutover before you close, not after.

Industry-specific checklists

The nine areas are universal; the red flags differ by business type. Use the right spoke for your deal:

• ✓Small Business Acquisition Checklist — the general searcher/sponsor playbook
• ✓SaaS Due Diligence Checklist — ARR quality, churn, code and IP
• ✓E-commerce Due Diligence Checklist — channel and ad dependency, true margins
• ✓Manufacturing Due Diligence Checklist — equipment, capacity, supply chain
• ✓Home Services Due Diligence Checklist — recurring revenue, technicians, licensing

Red flags across every deal

• ✓Adjusted EBITDA propped up by add-backs that don't survive scrutiny.
• ✓Revenue concentrated in one customer, channel, or product.
• ✓A seller who is the business — relationships and know-how that walk at close.
• ✓A seller evasive or slow with data-room documents.
• ✓Material contracts with change-of-control clauses that let key counterparties exit.
• ✓Unfiled or underpaid taxes, or misclassified workers.

Where the time goes — and how to compress it

Most diligence is reading and reconciling: statements, tax returns, contracts, and a data room full of PDFs — cross-checking each claim against the underlying document. It's slow, and a single missed clause can change the deal.

This is the part you can systematize. Deal OS reads the documents in a deal workspace and produces source-cited diligence briefs and findings — every claim quoted from your own documents and verified before you see it — plus risk, contradiction, and missing-information audits across the room. It doesn't replace your judgment, your QoE provider, or your legal review; it gets you to the questions that matter faster. See a real cited brief for what that looks like.

Frequently asked questions

What are the main types of due diligence in an acquisition? Nine areas: financial, tax, legal and corporate, commercial/customer, operational, technology and IT, HR and people, environmental and regulatory, and integration/day-one readiness. Not every deal goes deep on all nine, but you should consciously decide how far to take each rather than skip one by accident.

What is the most important part of due diligence? Financial and commercial diligence catch the fastest deal-killers — overstated earnings and customer concentration. For search funds and self-funded buyers, operational diligence (owner dependency) is a close third, because you inherit any gap as the new operator.

How long does M&A due diligence take? For a small-business acquisition, typically 30-60 days; larger or more complex deals run 90-120+ days. The document review — reading and reconciling financials, contracts, and the data room — is usually what takes longest.

Can software do due diligence for you? Software can do the document-heavy parts — reading, extracting financials, and flagging contradictions and missing information across a data room — and produce source-cited findings so you reach the real questions faster. It doesn't replace your judgment, seller conversations, legal review, or a quality-of-earnings analysis. Treat it as leverage on the reading.

Run your next deal with less grind

If working through the data room is eating your nights, book a 15-minute walkthrough of how Deal OS turns a workspace of documents into cited diligence findings.