Buyers of private companies run eight diligence workstreams before closing: financial (anchored by a quality of earnings analysis), tax, legal, commercial, operational, IT and cybersecurity, HR and benefits, and environmental. Confirmatory diligence typically runs 60 to 90 days from the signed letter of intent, and diligence findings are the leading reason signed deals die. Sellers who commission sell-side diligence and build a complete data room before going to market close faster and give up less in renegotiation.
The eight workstreams buyers run
Due diligence is the buyer's verification period. It usually begins after both sides sign a letter of intent (LOI), a short, mostly non-binding agreement on price and structure that grants the buyer exclusivity, meaning the seller agrees not to talk with other buyers for a set window. During that window the buyer's accountants, lawyers, and consultants test every assumption behind the price.
Financial: the quality of earnings review
The centerpiece is the quality of earnings (QoE) analysis, an accountant's study of whether reported EBITDA (earnings before interest, taxes, depreciation, and amortization) reflects the sustainable run rate of the business. A QoE is not an audit; it is narrower and deal-focused. The QoE team ties revenue to bank deposits, tests revenue recognition, and challenges every add-back, meaning the adjustments a seller makes to reported earnings for one-time or owner-specific costs. An owner salary of $400,000 against a market replacement cost of $200,000 supports a $200,000 add-back. A claimed one-time marketing expense that recurs every year does not.
Financial diligence also sets the net working capital peg: the normal level of receivables, inventory, and payables the business needs to operate, typically calculated as an average of normalized working capital over the trailing twelve months. At closing, actual working capital above or below the peg adjusts the price dollar for dollar, which is why the peg negotiation can move as much money as the multiple debate.
Tax
Tax diligence covers federal and state income tax returns, payroll tax deposits, and, increasingly, state sales tax exposure. A company selling into many states may have nexus (a taxable connection) in states where it never filed, creating liability that survives closing. Buyers also verify entity-level items such as the validity of an S corporation election and whether workers treated as 1099 contractors could be reclassified as employees. Structure questions, chiefly asset sale versus stock sale, get resolved here because they determine who bears historical tax exposure.
Legal
Counsel reviews formation documents, the capitalization table (the record of who owns what), minute books, and every material contract. Two items get special attention. First, change-of-control provisions: clauses that let a customer, lender, or landlord terminate or demand consent when ownership changes. Second, intellectual property assignment: proof that the company actually owns work created by founders and contractors. Lawyers also run UCC lien searches for undisclosed secured debts and review litigation, permits, and regulatory compliance.
Commercial
Commercial diligence tests whether revenue will still be there after closing. Buyers analyze customer concentration (the revenue share of the largest accounts), retention and churn, pricing history, and the sales pipeline. Heavy dependence on one or two customers is among the most common valuation problems in smaller deals; buyers respond with price cuts, earnout structures, or walk-aways. Customer reference calls usually come near the end of diligence, after the buyer is otherwise committed, because sellers resist exposing customers to deal risk any earlier.
Operational
Operational diligence covers facilities, equipment condition, capacity, supply chain, and key vendor dependence. Buyers estimate deferred capital expenditures (capex), the machine replacements and facility repairs an owner postponed, because deferred capex is effectively a hidden addition to the purchase price. They also map processes that exist only in the owner's head, a key-person risk that shapes transition-services and employment terms.
IT and cybersecurity
Buyers inventory systems, verify software licenses, and review data privacy compliance for the states and customer contracts that apply. They ask for security policies, penetration test results, and the company's incident history, because an inherited breach becomes the buyer's breach. Cyber review is now standard even for small industrial companies, which routinely field questionnaires about ransomware controls, backups, and cyber insurance.
HR and benefits
HR diligence starts with a census of employees and contractors, compensation, and tenure, then moves to retention risk for the people who matter most after closing. Benefit plans get technical review: 401(k) plans are checked for compliance failures, self-insured health plans for unrecorded claims, and paid-time-off accruals for balance sheet impact. Worker classification and wage-and-hour compliance round out the list because both can create successor liability.
Environmental
Environmental diligence matters whenever real estate or manufacturing is involved. The standard tool is the Phase I Environmental Site Assessment (ESA): a records review, site inspection, and interview process performed under the ASTM E1527-21 standard. A compliant Phase I satisfies the EPA's all appropriate inquiries rule, which preserves a buyer's defenses to federal cleanup liability under CERCLA, the Superfund statute. EPA rules require the inquiry to be conducted or updated within one year before acquisition, with several components refreshed within 180 days. A Phase I that flags concerns leads to a Phase II, which involves actual soil or groundwater sampling.
Typical document requests
Buyers usually deliver a request list of several hundred items in the first week of exclusivity. The table below shows representative first-round requests by workstream.
| Workstream | Representative document requests |
|---|---|
| Financial | Monthly financial statements (3 years), general ledger detail, revenue by customer, receivables aging, bank statements |
| Tax | Federal and state returns (3 to 5 years), sales tax filings by state, payroll tax records, entity elections |
| Legal | Formation documents, cap table, material contracts, litigation history, UCC lien searches, permits and licenses |
| Commercial | Customer concentration schedules, pipeline reports, pricing history, churn data, market studies |
| Operational | Facility leases, equipment lists and maintenance records, top vendor contracts, capacity and capex plans |
| IT and cybersecurity | Systems inventory, software licenses, privacy policies, penetration test results, incident history |
| HR and benefits | Employee and contractor census, offer letters and non-competes, benefit plan documents, 401(k) testing, handbook |
| Environmental | Prior Phase I or Phase II reports, environmental permits, storage tank records, hazardous material procedures |
How long diligence takes
Most lower-middle-market LOIs grant 60 to 90 days of exclusivity, and well-run deals close within that window; complex deals routinely need extensions. Sequencing matters. QoE fieldwork starts immediately because its findings drive price, while confirmatory legal work and third-party consents concentrate in the final weeks. Timelines also vary sharply by buyer type. In Axial's study of 2025 deals that died after a signed LOI, transactions involving senior lenders averaged 159 days under exclusivity before breaking, while family-office deals averaged 37 days.
The biggest timeline driver a seller controls is response speed. A buyer waiting two weeks for receivables detail loses momentum, and lost momentum is dangerous: financing commitments expire, and business performance during a long diligence period becomes its own diligence issue.
Deal-killers: what actually ends signed deals
Axial's 2025 Dead Deal Report analyzed 75 lower-middle-market transactions that died after a signed LOI. Non-QoE diligence findings (undisclosed legal or compliance problems, customer concentration, contract issues) were the leading cause at 25.3 percent, followed by QoE EBITDA discrepancies at 21.3 percent, failed renegotiations at 14.7 percent, seller decisions to withdraw at 13.3 percent, financing constraints at 10.7 percent, and business underperformance during diligence at 8.0 percent. In one deal in that sample, the buyer's QoE work surfaced EBITDA discrepancies of roughly $265,000 to $594,000 against the marketed figure.
Issues that do not kill a deal still cost money. Findings that survive to closing show up as price cuts, escrows (purchase price held back to cover post-closing claims), or earnouts (price paid only if future targets are hit). SRS Acquiom's lower-middle-market data shows virtually all such deals carry at least one escrow, with a median general indemnification escrow of 12.5 percent of transaction value, and seller representations that usually outlast the 15-month median survival period seen across the broader private-deal market. More than a third of lower-middle-market buyers insist on an earnout.
How sellers prepare: sell-side diligence and a clean data room
Sellers control more of this process than most assume. Sell-side due diligence means hiring your own QoE firm before going to market to find the problems a buyer will find, on your own timeline. RSM notes that sell-side work improves speed to closing, lets a seller address buyer concerns before they surface, and reduces the risk of the deal being renegotiated on the buyer's findings; private equity firms now frequently require it of portfolio companies before a sale. A sell-side QoE also lets the seller frame the working capital peg discussion rather than react to the buyer's math.
The second lever is the data room, the organized online repository holding every document a buyer will request. Practical rules:
- Build the folder structure around the eight workstreams above before the first buyer meeting, and populate it from the buyer's perspective.
- Support every EBITDA add-back with invoices, payroll records, or contracts. An add-back without documentation is an add-back a buyer rejects.
- Fix cheap problems early: sign missing IP assignments, cure delinquent state registrations, and resolve contractor classification questions before a buyer prices them.
- Disclose known problems early and with context. Problems discovered late read as concealment and get priced accordingly.
- Keep monthly financials closing on schedule throughout the process. Late or deteriorating numbers during exclusivity is itself a deal-killer.
Sell-side platforms such as Bankerly.ai standardize this preparation by assembling the QoE package, data room structure, and diligence-ready deliverables before buyers arrive.
This article is educational information about market practice, not legal, tax, or accounting advice. Terms vary by deal; consult qualified M&A counsel and tax advisors about your specific transaction.
Sources
Frequently asked questions
- What do buyers look at during due diligence when buying a business?
- Buyers work through eight areas: financial records (a quality of earnings review of EBITDA and working capital), tax filings, legal contracts and corporate records, commercial factors like customer concentration, operations and equipment, IT and cybersecurity, employees and benefit plans, and environmental exposure where real estate or manufacturing is involved. Expect a request list of several hundred documents across those categories in the first week.
- How long does due diligence take when selling a company?
- Most letters of intent grant 60 to 90 days of exclusivity, and well-prepared deals close within that window. Financial diligence starts immediately; confirmatory legal work concentrates in the final weeks. Timelines stretch when sellers respond slowly or new issues surface. In Axial's 2025 broken-deal data, exclusivity averaged about 37 days for family-office buyers versus 159 days for deals involving senior lenders.
- What is a quality of earnings report and do I need one to sell my business?
- A quality of earnings (QoE) report is an accountant's analysis of whether reported EBITDA reflects the sustainable earnings of the business, testing revenue, add-backs, and working capital. It is not an audit. Buyers almost always commission one. Sellers are not required to, but a sell-side QoE finds problems before buyers do, supports the asking price, and reduces renegotiation risk; private equity owners frequently require one before a sale.
- What are the most common reasons deals fall apart during due diligence?
- In Axial's 2025 Dead Deal Report covering 75 broken letters of intent, the leading causes were non-financial diligence findings such as legal, compliance, and customer concentration issues (25.3 percent), EBITDA discrepancies found in quality of earnings work (21.3 percent), failed renegotiations (14.7 percent), seller withdrawals (13.3 percent), financing constraints (10.7 percent), and business underperformance during diligence (8 percent).
- What documents should be in a data room before going to market?
- Three years of monthly financial statements, tax returns, general ledger detail, revenue by customer, all material contracts and leases, corporate formation records and the cap table, employee census and benefit plan documents, insurance policies, IT and security policies, and any environmental reports. Organize folders by diligence workstream, support every EBITDA add-back with documentation, and keep financials current throughout the process.
Considering a sale in the next few years? See what a prepared process looks like.
Keep reading