Due Diligence Checklist for Buying a Small Business: What to Request and When

The short version

• A due diligence checklist for a small business is not a document dump; it is a sequenced test of whether the seller's earnings are real and survive the seller leaving.
• The order matters: financial first, then legal, then operational, then customer, because every later phase prices off the number you verify in the first.
• The gap between an owner-dependent business at 1.65x and an owner-light one at 3.5x is $555,000 on a $300,000-SDE business, and operational diligence is where you find which one you are buying.
• Below: the four phases, what each request is really testing, and when to ask for it.

A due diligence checklist for buying a small business is not a stack of files you collect. It is a sequence of tests, and each item on it is testing one thing: whether the number survives the seller walking out the door.

Most checklists you find online are flat document dumps. They list tax returns, leases, and contracts with no order and no statement of what any of it proves.

That is how buyers waste diligence dollars confirming paperwork while missing the risk the paperwork was supposed to surface. The discipline is simpler than the list looks.

Diligence is the work of converting the seller's claims into verified knowns, one line at a time. Everything the seller tells you is a claim until a primary document turns it into something you actually know.

Verify before you trust the number. Then verify whether that number depends on the person selling it to you.

Treat the checklist as a refusal instrument, not a formality. Its job is not to complete the deal; its job is to give you specific, documented grounds to walk away while walking away is still free.

What a due diligence checklist actually does

A due diligence checklist for buying a small business is the ordered set of documents and tests a buyer uses to confirm the seller's earnings are real, transferable, and safe to finance. It runs in four phases, financial, legal, operational, then customer, each testing a specific risk before money moves.

The reason for the order is cash flow. A buyer is not paying for last year's profit; they are paying for the probability that profit continues once they own it.

So the financial phase comes first because every later phase prices off the number it produces. There is no point auditing customer contracts against an earnings figure you have not yet proven is real.

The guardrail underneath all four phases is one sentence. Verify before you trust the number, and treat every clean-looking document as a claim until a primary source confirms it.

Underneath that sits one test the whole sequence is built to run. Strip out the seller's hours, the seller's relationships, and the seller's institutional knowledge, then ask what earnings survive.

What survives that strip is what you are actually buying. The financial phase tells you the number is real; the residual-value test tells you how much of it is yours once the seller is gone.

This matters because 86% of small business owners have no professional valuation or only a rough estimate. The number you were handed was likely built from a conversation, not a verified model, so you rebuild it from primary documents.

Phase 1: Financial diligence (verify the number first)

Start where the price comes from. The financial phase confirms that the seller's discretionary earnings are real and that you can reconstruct them yourself from primary records.

1. Three years of tax returns plus the trailing twelve months of financials. Tests whether the reported earnings match what was filed with the IRS, the one number a seller cannot quietly inflate.
2. Profit and loss statements, monthly, for the same period. Tests for revenue smoothing and one-time spikes; learn to read the P&L line by line rather than trust the summary.
3. The add-back schedule behind the asking SDE. Tests every adjustment the seller used to lift earnings, because the add-backs sellers claim are where an honest $200,000 becomes a hopeful $300,000.
4. Bank statements and merchant processor reports. Tests whether the cash actually landed; deposits should tie to the revenue on the P&L within a tight margin.
5. Accounts receivable and payable aging. Tests whether the working capital is healthy or whether the business is funding itself on stretched vendor terms.
6. A quality-of-earnings analysis on any deal worth financing. A quality-of-earnings review is the confirmatory financial test, where an outside accountant rebuilds the earnings from source data so a lender and a buyer trust the same number.

The output of this phase is one verified figure: the cash the business actually throws off. Every later request measures the risk to that figure, not the figure itself.

Phase 2: Legal and corporate diligence

Once the number is real, confirm it transfers without a liability riding along with it. The legal phase tests whether what you are buying is clean and assignable.

1. Entity formation documents, cap table, and good-standing certificates. Tests who actually owns the business and whether there are silent partners or unissued promises.
2. All material contracts, including leases, supplier agreements, financing, and equipment. Tests for change-of-control clauses, the ones that let a landlord or supplier walk when ownership changes.
3. Outstanding litigation, liens, and judgments. Tests for liabilities that survive the sale; a UCC search surfaces debts the seller may not volunteer.
4. Licenses, permits, and regulatory filings. Tests whether the business can legally keep operating under your ownership without a lapse.
5. Employment agreements, contractor classifications, and any non-competes. Tests whether the team stays and whether a misclassified contractor is a back-tax liability waiting on you.
6. Insurance policies and claims history. Tests the real risk profile of the work, not the version on the marketing deck.

The legal phase is where a deal structure earns its keep. The cleaner the entity, the more of this risk you can push back onto the seller when you structure the financing and the purchase agreement.

Phase 3: Operational diligence (what runs without the seller)

This is the phase generic checklists skip, and it is the one that moves the multiple. Operational diligence tests how much of the business is a system and how much of it is the owner.

This is the residual-value test run line by line. Each item below strips one thing the seller personally supplies and asks whether the earnings still stand without it.

1. Documented SOPs and process maps for core operations. Tests whether the work lives in the company or in the seller's head; if there is nothing written, you are buying their memory.
2. The org chart and a clear read on who makes which decisions. Tests whether a manager runs the floor or whether every exception routes to the owner.
3. Software, systems, and login inventory. Tests for key-person dependencies hidden in tools only the seller knows how to run.
4. Vendor and supplier relationships and terms. Tests whether pricing was negotiated by the business or granted personally to the owner as a favor.
5. The owner's actual weekly hours and task list. Tests the real cost of replacing them; the owner-dependence red flags you find here are what a buyer prices straight into the offer.

Hold one number against this phase. An owner-dependent business transacts near 1.65x SDE and an owner-light one near 3.5x, a $555,000 spread on a $300,000-SDE business.

That spread is not set by the financials. It is set by what you find in operational diligence, which is why this phase, not the tax returns, often decides what the business is worth.

Phase 4: Customer and revenue diligence

The last phase tests the hardest risk to verify and the easiest to fake: whether the revenue is loyal to the business or to the person leaving it. Customer diligence confirms the earnings will still be there a year after close.

1. Customer concentration, measured as revenue by top ten accounts. Tests fragility; if one client is 40% of revenue, you are buying one relationship, not a customer base.
2. Contract terms, recurring revenue, and churn history. Tests whether the revenue is contractual and renewing or won fresh every month by the owner.
3. How customers were acquired and who they deal with. Tests whether accounts belong to the company or to the founder's cell phone.
4. Customer tenure and a sample of references where appropriate. Tests loyalty and whether key accounts have already signaled they may leave on a sale.
5. The pipeline and lead sources. Tests whether new revenue comes from a repeatable channel or from the seller's personal network.

This phase is last because it depends on everything above it. You cannot judge whether revenue is durable until you know the number is real, the contracts transfer, and the operation runs without the seller.

When the relationships belong to the company rather than the owner, the transition risk drops and the multiple climbs toward 3.5x. When they live with the seller, you price for the customers who leave when the founder does.

When to request each phase

Diligence is not one event. You spend trust and money in stages, and requesting everything at once both overwhelms the seller and wastes your spend before you know the deal is real.

• Before the LOI, top-line only. Two or three years of tax returns and a P&L summary, enough to confirm the asking price is in a defensible range before you commit time.
• At the LOI, open the window. The signed letter of intent grants you exclusivity and the right to request the full file; this is when the four phases formally begin.
• Post-LOI, in phase order. Financial first, then legal, then operational, then customer, so you stop spending on the rest the moment the number fails to verify.
• Confirmatory, before close. The quality-of-earnings analysis and final lien and lease confirmations, the checks your lender and your own risk model both require.

The sequence protects your money in two directions. You do not pay for a quality-of-earnings analysis on a deal whose tax returns already do not tie, and you do not waste a seller's patience requesting customer contracts before you have confirmed the business is worth pursuing.

The sequence also protects your right to refuse. Every phase you pass is a checkpoint where the deal has to re-earn your money, and a checklist run this way ends as often in a documented no as in a close.

FAQ

What documents do you need for due diligence?

You need three years of tax returns and financials, all material contracts and leases, corporate and lien records, documented SOPs and an org chart, and a customer concentration breakdown. Each maps to a phase: financial verifies the number, legal confirms it transfers, operational tests owner-dependence, and customer tests revenue durability.

How long does due diligence take when buying a small business?

Due diligence on a small business typically runs 30 to 60 days from a signed LOI to close, depending on deal size and how organized the seller's records are. A clean financial phase moves fast; a business with no documented systems or messy books stretches the operational and confirmatory stages well past 60 days.

What are red flags in small business due diligence?

The biggest red flags are deposits that do not tie to the reported revenue, add-backs that inflate SDE beyond what the tax returns support, and a single customer representing a large share of revenue. The deepest red flag is an owner who runs every decision and relationship personally, because that earnings stream may not survive their exit.

---

You cannot finance a number you have not verified, and you cannot verify it from a marketing deck.

The free Keystone diagnostic gives you three scores and an estimated sale price, calibrated against 10 years of BizBuySell Insight Reports and 1.6M+ SBA 7(a) loan records. You see what a buyer's diligence will read in a business before you write the check.

Get your three scores and an estimated sale price, free, at app.trykeystone.io.

For a live deal, Keystone Pro ($199/mo, $1,990/yr) adds the Deal Analyzer, which tests the financing structure and affordability against the verified earnings your diligence produces.