First-Time Acquirer Due Diligence Checklist: 47 Items Before You Wire Money

You signed the LOI. You have 60–90 days before the wire clears and the keys change hands. What you discover — or miss — during this window is the difference between acquiring a cash-flowing asset and inheriting someone else’s operational debt. This business acquisition due diligence checklist for the first-time buyer is not a generic M&A template. It is an operator-lens framework for the $300K–$2M range: 47 items organized into five tracks, each with a red-flag trigger that tells you what the finding means for post-acquisition cash flow and how hard you will be working on day 91.

General information only, not legal, financial, or tax advice. Business acquisitions are complex transactions. Retain qualified legal counsel and a CPA before signing any binding agreement or wiring funds.

The stakes are real. According to Bhide et al. (2024, “On the Nature of Due Diligence in a Search Fund Acquisition,” Yale School of Management), quality of earnings findings routinely reveal a 5–20% delta between the seller’s stated EBITDA and a verified normalized number — before you even get to operational or legal issues. First-time buyers are the most likely to accept add-back schedules at face value, skip customer reference calls, and underestimate key-man risk. That is the gap this checklist closes.

About the author: Cole Merritt has reviewed 12+ SMB acquisitions in the $300K–$2M range as an independent operator and acquisition advisor. About page.

All 47 Due Diligence Items at a Glance

Use this summary as your data-room request letter or share it with your CPA on day one of diligence. The detailed items with red-flag triggers follow in each track section below.

How to Use This Checklist

Run all five tracks in parallel, not sequentially. Diligence has a clock — the seller’s patience, your LOI exclusivity window, and lender underwriting timelines all compress. Assign each track to a workstream owner (you, your CPA, your attorney, or a hired QoE firm), set weekly check-ins, and treat any red-flag trigger as a reason to renegotiate — not necessarily to walk. The checklist also works as your macro risk filter: some deals look fine at the micro level but are entering a structural headwind — macro headwinds that affect SMB acquisition timing — that changes the return thesis entirely.

Track 1 — Financials (Items 1–12)

This is where first-time buyers lose the most money. Small businesses routinely use cash-basis accounting, run personal expenses through the P&L, and present add-back schedules that range from fully defensible to creative fiction. Your job is to verify every number against a source you control.

1. 36 months of bank statements, matched to reported revenue by month. Tie deposits to the P&L line by line. Card processor netting and multiple accounts create legitimate mismatches — reconcile them. Red flag: monthly deposits consistently run 8%+ below reported revenue with no explanation.
2. Tax returns (federal) for the last 3 years. Cross-reference Schedule C or corporate return revenue to the bank statement deposits you just reconciled. Red flag: any year where reported bank revenue materially exceeds tax-return revenue — the seller is either understating to the IRS or overstating to you.
3. Recast P&L with a verified add-back schedule. Request the seller’s normalized EBITDA worksheet, then challenge every line. Defensible add-backs: excess owner comp above market rate for the role, truly one-time legal or accounting fees, and depreciation/amortization (net of normalized maintenance capex). Red flag: add-backs that assume revenue you have not yet earned, family salaries with no documented work, or personal expenses without receipts.
4. Quality of Earnings (QoE) report from an independent CPA firm. For a deal above $500K SDE, this is not optional. Expect to pay $15,000–$25,000. The QoE validates normalized EBITDA, accounts receivable aging, working capital trends, and revenue recognition. Red flag: seller resists or delays access needed for QoE — that resistance is itself a finding.
5. Accounts receivable aging report. The EBIT Community SMB due diligence playbook flags any A/R balance over 90 days exceeding 10% of total as a red flag. Red flag: A/R over 90 days is above 10% of total, or the aging worsened significantly in the trailing 12 months.
6. Working capital baseline. Calculate net working capital (current assets excluding cash minus current liabilities excluding debt) for each of the last 12 months. Look for seasonality. Red flag: working capital declining in a business with flat or growing revenue suggests cash is being extracted ahead of the sale.
7. Revenue concentration by customer, product, and channel (TTM). Build the full distribution — top 1, top 5, top 10, top 20 customers by trailing-twelve-month revenue. Red flag: any single customer over 20% of revenue (see Track 3 for escalated thresholds).
8. Gross margin trend for the last 3 years. Margin compression is often masked in revenue-growth years. Red flag: gross margin declining more than 2 percentage points year-over-year without a clear, documented explanation.
9. Owner compensation, benefits, and perks itemized. The seller’s total draw — salary, distributions, health insurance, vehicle, phone, travel — forms the baseline for your add-back. Then benchmark the role: what would a manager cost you to replace the seller’s day-to-day function? Red flag: owner comp below market rate for the role, which means the normalized EBITDA should be lower, not higher.
10. Capital expenditure history and upcoming needs. Ask for a list of every equipment purchase over $5,000 in the last 3 years, plus any deferred maintenance or planned capex. Red flag: a business with aging equipment and no recent capex where the seller is exiting is a classic deferred-maintenance trap.
11. Debt schedule — all outstanding liabilities. Request a complete schedule of long-term debt, lines of credit, equipment loans, and any seller-carried obligations. Confirm what transfers and what does not. Red flag: an undisclosed line of credit or personal guarantee that attaches to the business at close.
12. Sales tax, payroll tax, and any outstanding IRS notices. Request copies of the last 2 years of payroll tax filings and any correspondence with state or federal tax authorities. Red flag: unpaid payroll tax liabilities are a successor-in-interest risk in some states — your attorney must evaluate the specific jurisdiction.

Track 2 — Operations (Items 13–24)

Operations due diligence answers the question: how hard will this be to run without the seller? That question determines your workload on day one — and your risk of a key-man implosion in month three. Map the business’s operational DNA before you acquire it; institutional knowledge that lives only in the seller’s head cannot be reconstructed after the handoff. For post-close efficiency tools, see the operator resource library — but those are post-close problems. Right now, focus on what the business actually runs on.

13. Org chart and role descriptions for every W-2 employee and 1099 contractor. Map who does what, who reports to whom, and which roles are single-threaded (only one person can do the task). Red flag: more than 30% of revenue-critical functions are single-threaded and performed by the seller personally.
14. Key employee interviews (with seller permission). Ask your top 3–5 employees: What would change under new ownership? What concerns do you have? Vague answers are data. Red flag: “we’ll see how it goes” or visible hesitation about staying — a leading indicator of post-close attrition that financials will miss.
15. Employee tenure distribution. Long average tenure is a proxy for culture stability. High turnover in the last 18 months, especially at the management level, is not. Red flag: two or more managers departed in the last 12 months with no documented, non-competitive departure story.
16. Worker classification audit (W-2 vs. 1099). Misclassified contractors are a hidden liability. The IRS and most state agencies apply successor liability standards. Red flag: more than 20% of the workforce is 1099 but performing tasks that look like employee functions — set hours, company tools, exclusive arrangement.
17. Standard operating procedures (SOPs) documented and accessible. Ask for the operations manual, dispatch protocol, billing process, QA checklist — whatever is relevant to the business. Red flag: zero written SOPs means the business runs on tribal knowledge, and the tribe may leave with the seller.
18. Software, systems, and technology stack. List every subscription, license, and tool the business runs on. Confirm which are in the seller’s personal name versus the company entity. Red flag: core software licenses tied to the seller’s personal account that cannot be transferred without re-contracting.
19. Vendor relationships and supply chain concentration. Who are the top 3 vendors by spend? Are any relationships personal to the seller? Red flag: a primary vendor whose pricing or terms are based on a personal relationship the seller has built over 10+ years.
20. Equipment condition and maintenance records. Request maintenance logs and the date of last major service for any revenue-critical equipment. Red flag: missing maintenance records for equipment over $50,000 in replacement value.
21. Facilities — lease terms, renewal options, and landlord relationship. Confirm the lease is assignable without landlord consent (or that you can obtain consent). Review remaining term and any rent escalation clauses. Red flag: a lease with fewer than 24 months remaining and no renewal option that has not been negotiated.
22. Insurance coverage — general liability, workers’ comp, E&O, key-man. Request current certificates of insurance and claims history for the last 3 years. Red flag: any open workers’ comp claim or a significant increase in experience modification rate (EMR) over the last 2 years.
23. Regulatory licenses, permits, and certifications. List every license the business holds and confirm each is transferable upon change of ownership. State-by-state rules vary enormously. Red flag: a core operating license that requires a personal certification held by the seller — you may not be able to operate the business at close without a licensed operator in place.
24. SBA 7(a) lender diligence requirements (if you are financing the acquisition). The majority of $300K–$2M SMB deals are financed through the SBA 7(a) program. Your lender runs a parallel diligence process that can add 2–4 weeks to the close schedule. Items your lender will require include: personal financial statement (PFS), business plan and forward projections, real estate or equipment appraisal (Form 651 if applicable), Phase 1 environmental assessment (for any real property), and life insurance assignment naming the lender as beneficiary. Confirm your lender’s full list before hiring your QoE firm — some lender-required reviews overlap with QoE scope and you may be able to share deliverables. Red flag: starting SBA underwriting without these documents ready adds weeks; any environmental issue in a Phase 1 can kill the deal entirely.

Track 3 — Customers (Items 25–33)

Customer due diligence is where first-time buyers most consistently under-invest. The seller has a naturally positive relationship with customers; your job is to test whether those relationships will survive the handoff — and whether the revenue is actually sticky once it no longer has the seller’s name attached.

Source: EBIT Community SMB Acquisition Due Diligence Playbook

25. Full customer list by TTM revenue with churn history. You need the full distribution, not a curated top-10. Calculate what percentage of revenue churned in each of the last 3 years. Red flag: annual revenue churn above 15% with no acquisition strategy to replace it.
26. Customer concentration analysis using the table above. Apply the thresholds. Be especially skeptical if the seller’s concentration was higher 2 years ago and has “improved” — sometimes that means the business grew, sometimes it means the big customer already started leaving. Red flag: top customer concentration improved dramatically in the last 12 months but revenue is flat.
27. Reference calls with 5–15 customers representing 30–60% of revenue. This is the single highest-signal activity in customer diligence. Ask: How long have you been a customer? What would make you leave? Would you continue with new ownership? Red flag: customers who describe the business differently from the seller’s representation, or who express uncertainty about post-close continuation.
28. Average contract length and renewal rate. Is revenue under contract or month-to-month? Month-to-month revenue is real but fragile — it can evaporate without breach. Red flag: more than 50% of revenue is month-to-month with no formal agreement.
29. Customer acquisition channels and cost. How does the business replace churned customers? Is acquisition systematic (referral program, SEO, paid ads) or purely personal-network dependent? Red flag: 80%+ of new customers come from the seller’s personal referral network with no documented alternative channel.
30. Top-5 customer contract assignability. Pull the actual contracts for your five largest accounts. Look for change-of-control clauses and assignment restrictions. Red flag: a top customer contract that requires their written consent for assignment — this is leverage they can use to renegotiate terms post-close.
31. Pricing history and any informal rate adjustments. Have prices increased with the market or have they been held flat to preserve relationships? Red flag: rates not adjusted for inflation in 3+ years — you will face a pricing renegotiation risk if you raise them immediately post-close.
32. Backlog and signed-but-not-yet-started revenue. Confirm with documentation. A healthy backlog improves day-one cash flow visibility. Red flag: backlog reported verbally but not supported by signed agreements or deposits.
33. Net Promoter Score or customer satisfaction data, if it exists. Even anecdotal surveys matter. Red flag: no customer satisfaction measurement of any kind in a service business with high customer interaction — means there is no early warning system for churn.

Track 4 — Legal and Contracts (Items 34–42)

Three contract types kill more deals after LOI than any other legal issue: leases with non-assignment clauses, customer contracts with change-of-control provisions, and government or municipal contracts that require re-bidding on ownership change. Your attorney should flag all three in the first two weeks of legal diligence — before you spend another dollar on QoE or operational review.

34. Corporate formation documents and cap table. Confirm the entity type, registered state, and that the seller has clean authority to sell. Red flag: multiple equity holders not disclosed at LOI, or a minority shareholder without a signed consent.
35. All material customer contracts (change-of-control clauses). This is deal-killer #1. A contract that terminates automatically on change of control means you do not acquire the revenue you underwrote. Red flag: any revenue over 10% of total under a contract with an automatic termination on change of ownership.
36. Facility lease (assignment and consent requirements). This is deal-killer #2. Even if the landlord is friendly now, a non-assignment clause gives them negotiating leverage at the worst moment. Secure written consent in escrow before close. Red flag: lease requires landlord consent and landlord has been non-responsive during diligence.
37. Government, municipal, or institutional contracts. This is deal-killer #3. Public-sector contracts frequently require re-bidding or approval upon change of ownership — and re-bid timelines can exceed 6 months. Red flag: government revenue over 15% of total in a jurisdiction with known change-of-control re-bid requirements.
38. Non-compete and non-solicitation agreements with the seller. Confirm the scope, geography, and duration. A seller who is free to start a competing business the day after close is a revenue risk. Red flag: no non-compete, or a non-compete limited to a geography so narrow it does not protect the actual customer base.
39. Employment agreements and any severance obligations. Are any employees under contracts with change-of-control triggers? Red flag: a key manager with a contract that entitles them to severance on change of ownership — you may owe a payment the moment you close.
40. IP ownership — trademarks, domain, software, content. Verify ownership is in the entity being acquired, not the seller personally or a related entity. Red flag: the business domain or core trademark is registered to the seller personally rather than the business entity.
41. Pending and historical litigation, arbitration, and regulatory actions. Request a rep from the seller’s attorney and review court records independently. Red flag: any pending litigation where the claim exceeds 10% of the purchase price — get a legal opinion on probability and timeline.
42. Working-capital peg and closing adjustment mechanism. Working-capital disputes are among the top three post-close litigation sources in SMB acquisitions. Confirm the target net working capital at close is documented in the purchase agreement, with a 60–90-day true-up provision specifying what is included and excluded (typically: cash excluded, receivables included, current liabilities included). The target should be a trailing-average figure, not a single-point estimate. Red flag: purchase agreement silent on working capital, or using a single-point estimate rather than a trailing average — leaves six figures of exposure undefined at close.

Track 5 — Owner Dependency and Key-Man Risk (Items 43–47)

In the $300K–$2M deal range, key-man risk is the most underpriced risk in most deals. The financials look fine. The customers love the company. And then the seller leaves after 90 days, taking three relationships and the tribal knowledge of the pricing model with them. This plays out not catastrophically but with a painful 6–12 months of margin compression while you rebuild — a direct hit to post-acquisition cash flow that never appears in any diligence spreadsheet.

Quantifying owner dependency is not about distrust. It is about designing your first 100 days. If the seller is deeply embedded, negotiate accordingly: a longer transition (90–180 days vs. the default 60–90), a retention escrow, and earnout structures tied to revenue continuity.

43. Seller time audit — daily and weekly tasks documented. Ask the seller to keep a detailed time log for 2–4 weeks during diligence. Every task, every customer call, every vendor contact. Red flag: more than 40% of revenue-facing activity — customer calls, bids, relationship management — is performed personally by the seller with no backup.
44. Customer relationship mapping — who do customers call? Ask your reference-call customers: “Do you call [seller name] directly, or do you call the office?” The answer tells you exactly how sticky the relationship is to the person vs. the entity. Red flag: the majority of your top-5 accounts call the seller’s personal cell first.
45. Seller’s post-close plans. Where is the seller going? Are they retiring, starting something new, or staying in the industry? A seller who is entering a non-competing retirement is your cleanest exit. A seller who is “exploring options” is a risk. Red flag: vague post-close plans in an industry where the seller’s relationships are your primary revenue asset.
46. Transition plan — knowledge transfer and seller availability. Get a written transition plan with specific milestones, not a general statement of willingness. Red flag: seller willing to do “a few weeks” of handoff with no structured deliverables — weeks become days when a retiring seller has a new routine.
47. Key employee retention risk assessment. Beyond the seller, which 2–3 employees, if they left in the first 90 days, would materially disrupt operations? Do they have incentives to stay? The EBIT Community playbook recommends retention bonuses of 15–25% of annual comp for operations managers and key technicians when dependency is confirmed. Red flag: no retention bonus or stay agreement in place for employees who are functionally irreplaceable in the short term.

Due Diligence Budget: What to Expect to Spend

First-time buyers often underestimate diligence costs and then skip the QoE or skip legal review to save money. That trade-off has a non-linear downside. Spending $50,000 in diligence on a $1M acquisition is a 5% insurance premium on a levered asset. Missing a $100K liability or discovering a customer concentration issue post-close is a capital event that can wipe out two years of distributions.

Cost ranges are based on current QoE firm pricing and independent legal counsel rate surveys. Individual costs vary by firm, deal complexity, and geography. The SBA 7(a) lender may require additional review scope; confirm before engaging your QoE firm to avoid duplication.

What Happens When You Find a Red Flag

A red flag is not automatically a reason to walk. It is a reason to reprice, restructure, or get more information. The decision logic:

• Quantifiable financial discrepancy (items 1–12): Adjust the purchase price downward by the verified EBITDA delta, or walk if the seller will not negotiate.
• Customer concentration (items 25–30): Restructure the deal — escrow 10–15% of purchase price for 18 months, tied to customer retention milestones.
• Contract assignment issues (items 35–37): Make written assignment consent a closing condition. Do not close without it.
• Key-man risk (items 43–47): Negotiate a longer seller transition, a seller-financed note (aligns incentives), and retention bonuses for the top 2–3 employees at 15–25% of annual comp.
• Legal/litigation risk (items 38–41): Get a legal opinion on exposure. If unresolved, consider representations and warranties insurance or an escrow holdback sized to the claim.
• Working-capital gap (item 42): Ensure the purchase agreement specifies the target NWC peg and a 60–90-day true-up mechanism. A missing peg is a blank check the seller can cash at close.

Deal protection structures for mid-market SMB transactions typically include escrows of 5–15% of purchase price held for 12–18 months, and earnouts tied to 15% customer retention targets or specific operational milestones, per the EBIT Community playbook.

Frequently Asked Questions

What documents should I request immediately after signing an LOI?

Send a formal diligence request letter covering Track 1 of this checklist within 48 hours of signing the LOI: 36 months of bank statements, 3 years of federal tax returns, the seller’s add-back schedule, accounts receivable aging, and the current debt schedule. Simultaneously, start interviewing QoE firms — the best ones book 2–3 weeks out. The financial track gates everything else: you cannot negotiate customer concentration risk without a verified revenue base, and you cannot size a retention escrow without a confirmed EBITDA number. Your action step: send the Track 1 document request today, before any other diligence activity.

How do I find a Quality of Earnings firm for an SMB acquisition?

For deals in the $300K–$2M range, look for CPA firms with specific SMB M&A QoE experience rather than Big 4 affiliates whose minimum fees will exceed the deal’s logic. Good starting points: your business broker’s referral list (brokers work with QoE firms regularly and know turnaround times), the SBA lender’s preferred vendor list for SBA-financed deals, or attorney referrals from M&A-focused law firms. Get at least two bids — scope and price vary significantly. Ask each firm: what is your turnaround time from full document access to draft delivery? The answer should be 3–4 weeks. Your action step: request three firm referrals from your business broker or M&A attorney this week.

What is a normal due diligence cost for a $1M deal?

For a $1M SDE deal, budget $35,000–$55,000 total: roughly $15,000–$22,000 for the QoE engagement and $12,000–$20,000 for legal diligence (entity review, contract review, IP confirmation, purchase agreement drafting). This is a 3.5–5.5% insurance premium on your acquisition. Buyers who skip the QoE to save $18,000 on a $1M deal are taking unquantified earnings risk — the Yale SOM research shows a 5–20% EBITDA delta is common before any legal or operational issues surface. The diligence spend is almost always the highest-ROI dollars in the transaction. Your action step: line-item the diligence budget before you sign the LOI so it does not come as a surprise during exclusivity.

What is a working capital peg in a business acquisition?

A working capital peg is the agreed target level of net working capital (current assets excluding cash, minus current liabilities excluding debt) that the seller must deliver at close. It is negotiated as part of the purchase agreement and typically set at a trailing 12-month average to normalize for seasonality. If the actual NWC at close is below the peg, the purchase price is adjusted downward by the difference — this is the “true-up.” Without a peg, the seller has an incentive to draw down receivables and delay payables in the weeks before close, handing you a business with degraded liquidity on day one. Working-capital disputes are among the top three post-close litigation sources in SMB acquisitions. Your action step: confirm the NWC peg language is in the purchase agreement before your attorney returns a redline — it is easier to add before signing than to litigate afterward.

How long should due diligence take for a $500K–$1.5M SMB acquisition?

Plan for 45–75 days from LOI to close for a well-documented business in this range, with all five diligence tracks running in parallel. The financial track — bank reconciliation plus QoE — typically drives the timeline, since QoE firms need 3–4 weeks once they have document access. If you are using SBA 7(a) financing, add 2–4 weeks for lender underwriting that runs in parallel. Rushing diligence to preserve seller goodwill is one of the most common first-time buyer mistakes. A seller who will not give you adequate time is either hiding something or will be a difficult transition partner post-close. Either outcome is worth slowing down for.

Do I need a Quality of Earnings report for every deal, or only larger ones?

At $500K SDE and above, a QoE from an independent CPA is worth the $15,000–$25,000 cost in almost every case — the report frequently finds EBITDA variances that save more than it costs. Below $500K SDE, you can sometimes replace a full QoE with a more limited agreed-upon procedures (AUP) engagement from a CPA, plus your own thorough bank-statement reconciliation. The SBA 7(a) program, the most common financing route for SMB acquisitions, does not mandate a QoE, but lenders underwriting above $500K often require their own financial review — which overlaps substantially with the QoE scope. Confirm with your lender what they need before hiring your own firm, to avoid duplicating work.

What is the single most common post-close surprise for first-time acquirers?

Key-man revenue erosion. Not fraud, not hidden liabilities — just the quiet reality that 30–40% of revenue was stickier to the seller’s personal relationships than to the business entity. It rarely shows up in the financials or the legal review. It shows up 90 days post-close when two customers do not renew and you realize the seller had been calling them personally every quarter. The mitigation is in Track 5 of this checklist: rigorous customer reference calls asking directly about their relationship with the seller versus the company, and a seller transition agreement with specific deliverables rather than a casual handshake arrangement.

Your Next Step: Start With the Financial Track

If you have signed an LOI and are reading this business acquisition due diligence checklist as a first-time buyer, your immediate next action is to send a formal diligence request letter to the seller covering items 1–12 of Track 1 — and to begin interviewing QoE firms today. The financial track gates everything else: you cannot negotiate on customer concentration without knowing the verified revenue base, and you cannot size a retention escrow without a confirmed EBITDA number. Do not wire money until every item on this list has a status — either resolved, priced into the deal structure, or formally accepted as a known risk. That discipline is what separates operators who acquire assets from those who acquire problems.

Once you close, the operational work begins. The lean operator AI stack post covers day-one efficiency tools for new owners — but get the diligence right first.

This post is general information, not legal, financial, or tax advice. Every acquisition is unique. Retain qualified legal counsel, a licensed CPA, and appropriate advisors before executing any business acquisition transaction.