Due Diligence Checklist: What Buyers Will Ask For

In 20 years of M&A work, I've never seen a deal close without at least one surprise during due diligence. The difference between a deal that survives the surprise and one that dies is preparation. Sellers who build a comprehensive data room before going to market close faster, at higher prices, and with fewer retrades than those who scramble to assemble documents after signing an LOI.

This isn't just a checklist. I'm going to walk you through what buyers are actually looking for in each category, why they ask for it, and which items kill deals most often. If you're planning to sell in the next 12-24 months, start assembling these materials now — not after a buyer asks.

Build the Data Room Before You Go to Market

A virtual data room (VDR) is a secure online repository where you store all diligence materials. Services like Datasite, Intralinks, or even a well-organized SharePoint or Google Drive work for deals under $25M. The point is: have everything ready before the first buyer signs an NDA.

Why? Three reasons. First, it signals professionalism — sophisticated buyers interpret a prepared data room as a sign that the business is well-managed. Second, it accelerates the process — a 60-day diligence period becomes 45 days when documents are already organized. Third, it prevents the "drip-drip" problem where buyers keep requesting more information, extending timelines and finding excuses to retrade.

Financial Due Diligence

This is the buyer's primary focus and where most of the diligence budget goes. They're hiring a quality of earnings firm to verify that your earnings are real, sustainable, and properly normalized.

• Tax returns (3-5 years): Federal and state. Buyers cross-reference these against your financials. Discrepancies between tax returns and internal P&Ls are the number one source of diligence questions.
• Financial statements (3-5 years): Audited or reviewed preferred. Compiled statements are acceptable for smaller deals. Monthly P&L, balance sheet, and cash flow statements for at least the trailing 24 months.
• Revenue detail: Revenue by customer, by product/service line, by month. The buyer is checking for customer concentration, seasonality, and revenue quality. If one customer is more than 15% of revenue, expect pointed questions.
• AR aging report: Current snapshot plus trailing 12-month trend. Buyers want to see collection patterns and identify bad debt risk. AR over 90 days gets heavily scrutinized.
• Accounts payable detail: Current balances and payment terms. Buyers check whether you're stretching payables to improve cash flow — a sign of liquidity stress.
• Debt schedule: All outstanding loans, lines of credit, equipment leases, and their terms. Include payoff amounts. These get paid at closing from proceeds.
• Capital expenditure history and projections: Buyers want to know what it costs to maintain the business. Deferred capex means they'll spend money post-close — and they'll deduct it from their offer.
• Owner compensation and add-backs: Every personal expense, above-market compensation, one-time cost, and discretionary item you want added back to earnings. The QofE firm will challenge each one.

What kills deals:Undisclosed related-party transactions, material discrepancies between tax returns and financials, or add-backs that don't hold up under scrutiny. If your $500K EBITDA drops to $350K after the QofE firm is done, the buyer will retrade by $600K-$900K (at a 4-6x multiple).

Legal Due Diligence

The buyer's legal team is looking for landmines — anything that creates liability the buyer would inherit.

• Corporate formation documents: Articles of incorporation, operating agreements, bylaws, amendments. The buyer needs to confirm who owns what and who has authority to sell.
• All material contracts: Customer agreements, vendor contracts, supplier agreements, distribution agreements. Buyers read these for change-of-control provisions (clauses that let the counterparty terminate if ownership changes).
• Lease agreements: Real estate leases are critical — especially remaining term, renewal options, and assignment provisions. A lease that can't be assigned or has less than 3 years remaining creates real problems.
• Litigation history and pending claims: Current lawsuits, threatened claims, regulatory actions, and historical settlements. Include insurance claims. Everything.
• Intellectual property: Patents, trademarks, copyrights, trade secrets. Proof of ownership and registration status. IP assignment agreements with employees and contractors.
• Permits and licenses: Business licenses, professional licenses, industry-specific permits, regulatory approvals. Many of these don't transfer automatically in an asset sale.

What kills deals:Undisclosed litigation is the single most common deal-killer in legal diligence. I've seen a $12M deal die because the seller "forgot" to disclose a $2M employment lawsuit. The buyer didn't walk because of the lawsuit itself — they walked because the seller wasn't forthcoming. Disclosure builds trust; surprises destroy it.

Operational Due Diligence

This is where buyers evaluate whether the business can run without you — the single most important question for any acquirer.

• Organizational chart: Who reports to whom. Where the gaps are. Whether there's a management layer between the owner and front-line employees.
• Key employee identification: Who are the 3-5 people you can't lose? Buyers will want retention agreements for these individuals as a closing condition.
• Standard operating procedures: Documented processes for core business functions. Even basic documentation signals that the business isn't entirely in the owner's head.
• Customer relationships: Who manages key accounts? Will customers stay post-acquisition? Buyers sometimes request permission to contact top customers — push this to after the purchase agreement is signed.
• Vendor relationships: Sole-source suppliers, exclusive arrangements, and volume-dependent pricing. If one supplier provides 60% of your product and there's no contract, that's a risk.
• Technology systems: ERP, CRM, accounting software, custom-built tools. Buyers need to understand what they're inheriting and what needs to be replaced.

What kills deals: Extreme owner dependency— when every customer relationship, every vendor negotiation, and every operational decision runs through the owner with no documented processes and no capable #2. Buyers won't pay full price for a business that falls apart when the owner leaves.

Human Resources Due Diligence

HR diligence has become increasingly important as employment law has gotten more complex. Buyers are looking for compliance risks that create successor liability.

• Employee roster: Name, title, hire date, compensation, benefits, employment status (full-time, part-time, contractor). Current and accurate.
• Contractor classifications: This is a minefield. If you're classifying workers as 1099 contractors who should be W-2 employees, the buyer inherits the risk. The IRS and state agencies are aggressively pursuing misclassification, with penalties that can reach $50,000+ per worker.
• Benefit plans: Health insurance, retirement plans (401k, pension), bonus structures, equity/phantom equity plans. Buyers need to understand ongoing benefit obligations and any unfunded liabilities.
• Employment agreements: Offer letters, employment contracts, non-competes, non-solicitation agreements, IP assignment agreements. Gaps here — especially missing IP assignments from developers or engineers — create real problems.
• Workers' compensation history: Claims history, experience modification rate (EMR). A high EMR signals workplace safety issues and increases insurance costs for the buyer.
• EEOC complaints and employment disputes: Current and historical. Even settled claims need to be disclosed.

What kills deals: Employee misclassification (treating employees as contractors) and key-man insurance gaps. If your top salesperson who manages 40% of revenue has no non-compete and no retention agreement, the buyer faces a real risk that this person leaves post-close and takes clients with them.

IT and Cybersecurity Due Diligence

This category barely existed 10 years ago. Today it's a standard part of every diligence process, and for good reason — a data breach or system failure can destroy a business overnight.

• Network architecture and infrastructure: On-premise servers, cloud services, SaaS subscriptions. Age and condition of hardware.
• Software licenses: Proof of valid licenses for all business-critical software. Using unlicensed software creates legal exposure the buyer doesn't want.
• Cybersecurity posture: Firewall configuration, endpoint protection, backup procedures, incident response plan. For businesses handling sensitive data (healthcare, financial services), this is scrutinized heavily.
• Data privacy compliance: HIPAA, PCI-DSS, SOC 2, GDPR — whatever applies to your industry. Buyers check for gaps that create regulatory exposure.
• Disaster recovery and business continuity: Backup frequency, recovery time objectives, tested restoration procedures. Buyers want to know that the business survives a server crash or ransomware attack.

Environmental Due Diligence

If your business involves real estate, manufacturing, chemicals, fuel storage, or any industrial process, environmental diligence is non-negotiable.

• Phase I Environmental Site Assessment: Required for any deal involving commercial real estate. Identifies potential contamination issues. If the Phase I flags concerns, a Phase II (actual soil and water testing) follows.
• Regulatory compliance history: EPA violations, state environmental citations, remediation orders. Environmental liability can exceed the value of the business itself — I've seen it.
• Hazardous materials handling: Storage, disposal, and transportation records. Manifests and certificates of disposal.
• Underground storage tanks: Past and present. Even decommissioned tanks can create liability if contamination was never fully remediated.

What kills deals: Environmental contamination is the one diligence finding that buyers almost never negotiate through. Unlike a financial retrade where the price adjusts, environmental liability is open-ended and potentially catastrophic. If a Phase II reveals contamination, most buyers walk. Period. If you know about potential environmental issues, address them proactively — a completed remediation with a no-further-action letter is manageable. An undisclosed contamination issue is a deal-killer.

The Preparation Timeline

Having advised dozens of sellers through this process, here's my recommended timeline for preparing your data room:

• 12-18 months before sale: Identify gaps in documentation. Fix classification issues (contractor vs. employee). Resolve any pending litigation. Get a Phase I if applicable. Address deferred maintenance.
• 6-12 months before sale: Engage a CPA for reviewed financial statements. Build the data room framework. Document key processes. Put retention agreements in place for critical employees.
• 3-6 months before sale: Populate the data room. Complete a sell-side quality of earnings report. Ensure all contracts, leases, and licenses are current. Prepare management presentation materials.
• At market launch: Data room should be 80-90% complete. The remaining 10-20% will be deal-specific items buyers request during diligence.

The Bottom Line

Due diligence isn't something that happens to you — it's something you prepare for. Every surprise the buyer finds during diligence costs you money, either through a direct price reduction or through eroded trust that makes every subsequent negotiation harder. The sellers who get the best outcomes are the ones who know their own weaknesses, have addressed what they can, and disclosed what they can't fix — before the buyer's team ever opens the data room.

Think of it this way: the buyer is going to find everything eventually. The only question is whether they hear it from you first — in a context you control — or discover it themselves, in a context that makes them question everything else you've told them.