Due Diligence Checklist for Buying a Small Business: What to Request and When

That thing is whether the earnings survive the seller walking out the door. Every item on a real checklist is testing it.

Most checklists online are flat document dumps. Tax returns, leases, contracts, in no order, with no word on what any of it proves. That's how buyers spend diligence money confirming paperwork and miss the risk the paperwork was supposed to surface: the add-back that doesn't hold up, the customer who leaves with the seller.

What the checklist is for

A due diligence checklist for buying a small business is the ordered set of documents and tests you use to confirm the seller's earnings are real, transferable, and safe to finance. It runs in four phases (financial, legal, operational, customer), and each one tests a specific risk before money moves.

Everything the seller tells you is a claim until a primary document turns it into something you know, and diligence is the work of doing that one line at a time.

Here's the order logic. You're paying for the odds that profit keeps coming once you own the place, so the financial phase goes first, because every later phase prices off the number it produces. There's no point auditing customer contracts against an earnings figure you haven't proven.

Under all four phases sits one test. Strip out the seller's hours, relationships, and know-how, then ask what earnings are left, because those are the earnings you're actually buying.

And you'll definitely be rebuilding the number yourself: 86% of small business owners have no professional valuation or only a rough estimate. The figure you were handed probably came out of a conversation with the seller's accountant or a friend who sold a shop once.

One more thing before the list. Treat it as a tool for saying no. Its job is to give you specific, documented reasons to walk away while walking away still costs nothing.

Phase 1: Financial (check the number first)

Start where the price comes from. You're confirming the seller's discretionary earnings are real and that you can rebuild them from primary records.

1. Three years of tax returns plus the trailing twelve months of financials. Do the reported earnings match what was filed with the IRS? That's the one number a seller can't quietly pump up.
2. Monthly profit and loss statements for the same stretch. You're looking for smoothed revenue and one-time spikes, so read the P&L line by line instead of trusting the summary page.
3. The add-back schedule behind the asking SDE. Test every adjustment the seller used to lift earnings. The add-backs sellers claim are where an honest $320,000 becomes a hopeful $480,000.
4. Bank statements and merchant processor reports. Did the cash actually land? Deposits should tie to P&L revenue within a tight margin.
5. Receivables and payables aging. Is working capital healthy, or is the business floating itself on stretched vendor terms?
6. A quality-of-earnings analysis on any deal you're financing. A quality-of-earnings review has an outside accountant rebuild earnings from source data, so you and your lender are trusting the same number.

You walk out of this phase with one verified figure: the cash the business really throws off. Everything after it measures risk to that figure.

Phase 2: Legal and corporate

Now that the number's real, make sure it transfers without a liability riding along.

1. Formation documents, cap table, good-standing certificates. Who actually owns this thing, and are there silent partners or promised shares nobody wrote down?
2. Every material contract: leases, supplier agreements, financing, equipment. Look for change-of-control clauses, the ones that let a landord or supplier walk when ownership changes.
3. Litigation, liens, and judgments. Some liabilities survive the sale. A UCC search turns up debts the seller may not mention.
4. Licenses, permits, regulatory filings. Can the business keep operating legally under you without a lapse?
5. Employment agreements, contractor classifications, non-competes. Will the team stay, and is there a misclassified contractor who turns into a back-tax bill with your name on it?
6. Insurance policies and claims history. This is the real risk profile of the work, which isn't always the one in the sales deck.

Here's where deal structure pays for itself. The cleaner the entity, the more of this risk you can push back to the seller when you structure the financing and the purchase agreement.

Phase 3: Operational, or what runs without the seller

Generic checklists skip this phase, which is odd, since it's the one that moves the multiple.

This is the strip test from earlier, run line by line. Each item takes away one thing the seller personally supplies and asks whether the earnings still stand.

1. Written SOPs and process maps for the core work. Does the work live in the company or in the seller's head? If nothing's written down, you're buying their memory.
2. The org chart, plus who actually decides what. Does a manager run the floor, or does every exception go to the owner?
3. Software, systems, and a login inventory. Key-person risk hides in tools only the seller knows how to run.
4. Vendor and supplier terms. Did the business negotiate that pricing, or was it a personal favor to the owner?
5. The owner's real weekly hours and task list. This is the true cost of replacing them. The owner-dependence red flags you find here get priced straight into your offer.

The financials confirm the earnings. What you find in this phase sets the multiple on them, which is why it so often decides what the business is worth.

Phase 4: Customers and revenue

The last phase tests the risk that's hardest to verify and easiest to fake: is the revenue loyal to the business, or to the person leaving it?

1. Customer concentration, measured as revenue by top ten accounts. If one client is 40% of revenue, you're buying one relationship, not a customer base.
2. Contract terms, recurring revenue, churn history. Is revenue contractual and renewing, or does the owner win it fresh every month?
3. How customers came in and who they deal with. Do the accounts belong to the company, or to the founder's cell phone?
4. Customer tenure, and references where it makes sense. Have any key accounts already hinted they'd leave on a sale?
5. Pipeline and lead sources. Does new revenue come from a channel that repeats, or from the seller's personal network?

It goes last because it depends on everything above. You can't judge whether revenue lasts until you know the number's real, the contracts transfer, and the operation runs without the seller.

When relationships belong to the company, transition risk drops and the multiple climbs toward 3.5x. When they live with the seller, you price in the customers who'll leave when the founder does.

When to ask for what

You spend trust and money in stages. Ask for everything at once and you swamp the seller and burn cash before you know the deal's real.

• Before the LOI, top-line only. Two or three years of tax returns and a P&L summary, enough to confirm the asking price is in a defensible range before you commit time.
• At the LOI, the window opens. A signed letter of intent gets you exclusivity and the right to request the full file. The four phases formally start here.
• After the LOI, in phase order. Financial, legal, operational, customer, so you stop spending the moment the number doesn't verify.
• Confirmatory, right before close. The quality-of-earnings analysis and final lien and lease checks, which your lender and your own risk model both need.

So you don't pay for a quality-of-earnings analysis on a deal whose tax returns already don't tie. And you don't wear out a seller's patience asking for customer contracts before you know the business is worth chasing.

Every phase you clear is a checkpoint where the deal has to earn your money again. Run it this way and plenty of checklists end in a documented no, reached before the purchase agreement, while the only thing you've spent is a few weeks and some accountant hours.

FAQ

What documents do you need for due diligence?

You need three years of tax returns and financials, all material contracts and leases, corporate and lien records, documented SOPs and an org chart, and a customer concentration breakdown. Each maps to a phase: financial verifies the number, legal confirms it transfers, operational tests owner-dependence, and customer tests revenue durability.

How long does due diligence take when buying a small business?

Due diligence on a small business typically runs 30 to 60 days from a signed LOI to close, depending on deal size and how organized the seller's records are. A clean financial phase moves fast; a business with no documented systems or messy books stretches the operational and confirmatory stages well past 60 days.

What are red flags in small business due diligence?

The biggest red flags are deposits that do not tie to the reported revenue, add-backs that inflate SDE beyond what the tax returns support, and a single customer representing a large share of revenue. The deepest red flag is an owner who runs every decision and relationship personally, because that earnings stream may not survive their exit.

You cannot finance a number you have not verified, and you cannot verify it from a marketing deck.

Keystone, the diagnostic we're building for this, is closed until the build is done. Once it opens it will be free, and it will return three scores and a value range with the most likely figure locked, calibrated against 10 years of BizBuySell Insight Reports and 1.6M+ SBA 7(a) loan records, so you can see what diligence will read in a business before you write the check.

Join the waitlist at https://app.trykeystone.io.

For a live deal, Keystone Command ($199/mo, $1,990/yr) adds the Deal Analyzer, which tests the financing structure and affordability against the verified earnings your diligence produces.