The Small Business Acquisition Due Diligence Checklist (2026)

Due diligence is where acquisitions are won or lost. It's the stretch between a signed LOI and a closed deal where you confirm the business is what the seller says it is — and find the things they didn't mention. For search funds, independent sponsors, and self-funded buyers, it's also unusually high-stakes: you're the buyer and the operator, so a problem you miss in diligence becomes a problem you own on day one.

This is a practical checklist of what to verify before you close — and the red flags that should make you slow down or walk.

How acquisition diligence is different for searchers and sponsors

Diligence on a $1-3M EBITDA business isn't a scaled-down version of a $50M private-equity deal. The priorities are different:

• ✓You'll run it, so operational and cultural fit matter more than the reps-and-warranties insurance battle of a large PE deal.
• ✓Diligence cost has to fit the deal. You can't spend $150k of advisor fees diligencing a business you're buying for $2M. Most of the work is reading documents carefully, not buying expensive reports.
• ✓Owner transition is a core risk. If the seller is the business — the relationships, the know-how — your job is to find out how much walks out the door with them.

1. Financial diligence

This is the heart of it. Verify, don't trust:

• ✓3-5 years of financial statements — income statement, balance sheet, cash flow. You're looking for steady revenue, predictable margins, and an explanation for any sudden swing.
• ✓3+ years of federal, state, and local tax returns — and confirm the business is in good standing on its tax obligations. Reconcile the returns against the financials; large gaps are a flag.
• ✓Quality of earnings basics — normalize the numbers. Strip out one-time items and scrutinize owner add-backs (personal expenses run through the business, above-market or below-market owner salary). "Adjusted EBITDA" is where sellers get optimistic.
• ✓Working capital — understand the normal cash the business needs to operate, so you don't get surprised at close.
• ✓Aging reports — accounts receivable and payable aging. Slow-paying customers and stretched vendors tell you about real cash health.

2. Customer concentration — the deal-killer to check first

Run this early, because it can end a deal fast:

• ✓Any single customer over ~20% of revenue is high risk.
• ✓Top 3 customers over ~50% is extreme risk.

If those customers leave — and they may, once the owner they trusted is gone — the business's viability is threatened. Pull a revenue-by-customer breakdown for the last 3 years and look at the trend, not just the snapshot.

3. Commercial and market

• ✓Why is the owner really selling? (Retirement is fine; a market in structural decline is not.)
• ✓Industry trajectory, competition, and the durability of whatever makes this business win.
• ✓Pricing power and whether margins are defensible.

4. Operations and systems

• ✓How dependent is the business on the owner's personal involvement and relationships?
• ✓Documented processes vs. tribal knowledge in the founder's head.
• ✓Key suppliers, single points of failure, and the state of any critical software or equipment.

5. Legal, contracts, and compliance

• ✓Material contracts — customer and supplier agreements, leases, franchise or licensing terms. Check for change-of-control clauses that let a counterparty walk when ownership changes.
• ✓Licenses and permits — are they transferable to you?
• ✓Litigation — past, pending, and threatened.
• ✓IP and assets — what's actually owned vs. licensed, and does it transfer cleanly.

6. People and culture

• ✓Org chart, key employees, and what it takes to retain them post-close.
• ✓The owner-transition plan: how long they'll stay, what they'll hand over, and what happens to the relationships they hold.
• ✓Culture and whether it fits how you intend to run the business.

Red flags that should make you slow down

• ✓Financials that don't reconcile to tax returns or bank statements.
• ✓Heavy customer concentration with a declining trend.
• ✓Add-backs that quietly inflate EBITDA beyond what's defensible.
• ✓A seller who is slow, selective, or evasive with data-room documents.
• ✓Revenue or margins that swing without a clear, verifiable explanation.

How long does diligence take?

It scales with deal complexity. Simpler acquisitions — service routes, small asset-based businesses — can close in 30-45 days. Larger or more complex businesses commonly need 120+ days. The document review is usually the bottleneck.

Where the time actually goes — and how to compress it

Most of diligence is reading: financials, a Confidential Information Memorandum (CIM), contracts, and a data room full of PDFs, cross-checking claims against the underlying documents, and writing up what you find. It's slow, and it's easy to miss a single line in a 200-page lease.

This is the part you can systematize. Deal OS is built for exactly this: it reads the documents in a deal workspace and produces source-cited diligence briefs and findings — every claim quoted from your own documents and verified before you see it — plus risk, contradiction, and missing-information audits across the data room. It doesn't replace your judgment or your advisors; it gets you to the questions that matter faster, without hiring an analyst. Searchers and sponsors use it to review more deals and keep an auditable record of what they checked.

For the document-heavy review specifically, see how we approach diligence automation.

Frequently asked questions

What is the most important part of due diligence when buying a small business? Financial verification and customer concentration. Confirm the financials reconcile to tax returns and bank statements, normalize EBITDA for owner add-backs, and check whether revenue depends on a handful of customers — any single customer over ~20% of revenue is a serious risk.

How long does due diligence take for a small business acquisition? Typically 30-45 days for simpler businesses and 120+ days for larger or more complex ones. The document review is usually what takes the longest.

What are the biggest red flags in acquisition due diligence? Financials that don't reconcile, heavy customer concentration, EBITDA add-backs that don't hold up, a seller who is evasive with data-room documents, and unexplained swings in revenue or margins.

Can AI help with due diligence? Yes, for the document-heavy parts. Tools like Deal OS read the financials, CIM, and contracts in your data room and produce source-cited findings and risk/contradiction audits, so you reach the real questions faster. It supports your diligence; it doesn't replace your own verification or professional advisors.

Run your next deal with less grind

If reading the data room is eating your nights, book a 15-minute walkthrough of how Deal OS turns a workspace of documents into cited diligence findings.