Due Diligence Checklist for Small Business Sellers
Prepare financial and legal documents before the LOI to defend your sale price.
The signed letter of intent arrives and the seller exhales. The hard part is over. In most transactions, that exhale is premature. The evidence from completed deals points elsewhere: most business sales that fall apart do so during due diligence, not at the term-sheet stage. This piece is a checklist for that critical interval. It covers what buyers request across financials, legal, HR, customer data, technology, and tax, and how a seller who assembles each category before the LOI is signed protects valuation and keeps the deal alive.
Why deals die after the LOI, not at the negotiating table
The letter of intent fixes the headline price and most of the structure. What it does not fix is the factual foundation underneath those numbers. Diligence is where claims meet documentation, and where the gap between the two determines whether the price holds, slips, or evaporates entirely.
The structural reason so many sales die at this stage is straightforward. Sellers spend their careers running businesses, not preparing them for scrutiny. The result is a reactive posture: documents assembled under pressure, add-backs left undocumented, contracts unfiled or signed in the owner's personal name. All of it matters when a buyer begins testing whether the business is what the seller represented it to be.
Every gap a buyer discovers after LOI becomes one of three things: a downward price adjustment, an expanded escrow holdback, or a broken deal. The seller who prepared in advance controls the narrative around each one. The seller who did not prepare watches the narrative be written for them, one document request at a time.
That is the thesis this checklist argues: diligence is a process sellers can control before it starts. Preparation is not courtesy to the buyer. It is the seller's primary instrument of price defense.
How AI tools have changed what buyers can find, and how fast
The diligence environment has shifted in ways that make selective disclosure and incremental preparation far riskier than they once were. Buyers now run AI tools across data rooms and document sets, extracting patterns, cross-referencing inconsistencies, and flagging anomalies at a speed and depth that manual review could not approach. A gap that once required a sharp junior associate to notice might now surface in the first automated pass.
The seller-side implication is direct. A well-indexed, machine-readable data room signals process quality and operational maturity. It is no longer just a courtesy to the buyer. It is a valuation input: a buyer who can move through the material quickly, without friction, treats the target as a well-run business and proceeds accordingly.
Emerging NDA language now addresses AI-specific risk before any data room goes live. Provisions restrict uploading confidential documents into public AI tools, limit systems that retain data for model training, and require written consent before AI enters the diligence process. The downside of unpreparedness is sharper than it used to be.
The financial documents that form the core of every diligence request
Financial diligence is the foundation on which buyers rebuild every valuation conclusion. Quality and internal consistency matter more than presentation polish. A buyer's analysts will forgive an unglamorous chart of accounts. They will not forgive a TTM P&L that does not reconcile to the tax returns, or a general ledger that was recoded in the middle of the period and produces trend signals that do not hold up to scrutiny.
The core statements form the spine of every request. Buyers use it to identify seasonality, trend reversals, and the smoothness of revenue recognition. Quarterly-only data signals weak financial controls. They ask for a trailing-twelve-month P&L updated monthly from the moment the owner decides to sell, because a stale TTM forces buyers to estimate and discount. They ask for three years of general-ledger detail in CSV or Excel format with consistent chart-of-accounts coding across all years, since mid-year recoding creates false trend signals that buyers flag immediately. And they ask for three years of federal, state, and local tax returns, including all schedules, reconciled line-by-line against the financial statements. Unexplained book-to-tax differences create credibility damage that compounds through the rest of diligence.
One narrative anchor runs through this entire category: the owner add-back. Buyers interrogate every one of those adjustments. The add-back that dies is a round number the seller remembered. Repeat that distinction across dozens of adjustments, and it is often where the gap between seller-presented earnings and buyer-adjusted earnings opens up. It is the single most negotiated line item at the purchase-agreement stage, and it deserves its own preparation effort.
Where independently audited financials exist, they are the gold standard and should be included. Reviewed financials are valuable. Compilation-only financials help the narrative but do not reduce buyer-side quality-of-earnings costs, because the buyer's firm will still rebuild the numbers regardless.
Why working capital deserves its own preparation effort before the LOI is signed
Working capital determines the cash-in-business peg that anchors the purchase-price adjustment mechanism. That peg is one of the largest negotiation items in any transaction, and sellers who cannot document their historical working-capital levels negotiate blind. The dynamic is unforgiving. Buyers build the working-capital peg from the seller's own data. The documents are the same ones already covered: monthly AR aging by customer for three years in 0–30, 31–60, 61–90, and 90-plus day buckets, monthly AP aging by vendor for the same period, inventory detail including valuation method, obsolescence reserve, and turn rate, and a seasonality analysis showing the normal cash the business requires at different points in its cycle.
One caution follows directly. Sellers who manage receivables and payables aggressively in the months before close to show more cash will be caught when buyers cross-reference aging trends across the 36-month snapshot set. This is specifically what buyers look for, and the attempt reads as manipulation rather than performance.
Legal and corporate records buyers request before any wire is sent
Legal diligence opens with a signal. Buyers treat the state of a company's corporate records as a proxy for how the business is run. Disorganized or incomplete legal files create doubt that is hard to recover from, even when the underlying business is sound.
The change-of-control clause is the most visceral illustration of a legal gap turning into a catastrophe. Every customer agreement, supplier agreement, distribution or reseller agreement, and partnership or joint-venture agreement must be reviewed for provisions that allow a counterparty to terminate when ownership transfers. Sellers must identify these clauses in advance and either obtain consent from the counterparty before going to market or disclose the risk clearly. Discovery post-LOI almost always produces a price reduction or deal collapse.
The rest of the list follows. Loan agreements, security agreements, guarantees, and UCC filings tell the buyer what encumbrances exist on the business's assets before structuring the purchase. Intellectual property requires registrations, applications, assignments, and licenses in and out, with confirmation that IP created by employees or contractors is formally assigned to the company. Environmental matters apply only to some businesses and are noted as applicable rather than detailed.
What ties this category together is that the buyer is not checking boxes. They are testing whether the seller's representations hold. A missing minute book says something else entirely.
Tax exposure that surfaces in diligence and how sellers can find it first
Tax liabilities discovered by the buyer during diligence do not disappear. They become escrow holdbacks and indemnification claims against the seller for months or years after closing. Sellers who surface them in advance can price and structure around them rather than absorbing them as surprises.
The document list starts with federal, state, and local income and franchise tax returns for three to five years, including all schedules. It extends to the full audit history and any open audits, assessments, or correspondence with tax authorities, sales-and-use tax returns, payroll tax filings and deposit records, property tax filings, and any tax elections, net-operating-loss carryforwards, credits, or unusual tax positions. Transfer-pricing documentation is required where related entities exist.
One item deserves explanation for non-specialist readers: the nexus analysis. A business can owe sales tax in states where it has never filed simply by selling there above a threshold, whether through remote sales or the presence of employees. This is one of the most frequently overlooked buried liabilities in lower-middle-market businesses, and the seller should run the analysis before the buyer does.
Worker classification cuts across categories. And the asset-versus-stock purchase decision carries materially different tax outcomes for both sides. Sellers should model both structures, and any applicable tax elections, before signing a letter of intent, not after.
HR and people risks that buyers probe and sellers routinely underestimate
People diligence surfaces two distinct risks. The first is legal exposure from misclassified workers and missing agreements. The second is operational risk from a business whose knowledge and relationships live entirely in the founder's head. Both reduce valuation if the buyer finds them during review, and sellers routinely underestimate both.
Contractor classification deserves its own audit before diligence begins. Every 1099 relationship should be tested against current classification standards, because reclassification exposure flows through both the HR and tax categories and compounds. A misclassified contractor is not an HR problem. It is a payroll tax liability, a benefits liability, and a penalty exposure, all at once.
The owner-dependency problem is the harder one. Sellers who spend the twelve to twenty-four months before sale building documented systems and a management layer that can operate without them arrive with a materially stronger valuation argument. The owner-transition plan, how long the seller will remain post-close, what they will hand over, and what happens to the relationships they hold, is a core diligence question, not a post-LOI afterthought.
Customer concentration and commercial data that buyers examine before committing
Customer concentration is the commercial risk buyers check earliest, because it is the single variable most likely to make a business's revenue disappear after the owner who held those relationships departs. The analysis starts with revenue by customer for three years, showing both the snapshot and the trend. The trend matters as much as the level.
The thresholds are practical rather than absolute. Any single customer representing more than roughly 10 to 20 percent of revenue is considered a concentration risk, with 20 percent or above triggering serious valuation discounts and deal-structure changes. The legal section already covered those clauses. Here they compound with concentration risk, because a supplier termination that is also a single-source dependency is operationally catastrophic in a way that a diversified supplier base is not.
Backlog and pipeline data rounds out the commercial picture: contracted future revenue, work in progress, and the conversion rate from pipeline to closed business. If you can show a diversifying customer base, the largest customer's revenue share declining over three years, and new customer additions replacing departures, you have a factual argument against concentration discounts. Sellers who cannot show this should expect the conversation and prepare a credible explanation.
Technology, cybersecurity, and data privacy items buyers now examine as standard
Technology and cybersecurity diligence is no longer limited to software companies. Buyers across every industry now audit the seller's systems, licenses, and data-handling practices, because gaps in any of these categories create post-close liability that lands on the buyer. Many small-business sellers are surprised by this. They assume the IT audit applies only to technology companies. It does not.
The systems and software inventory starts with a complete list of software applications, hosting arrangements, and cloud services the business depends on. Open-source components used under restrictive licenses, GPL or AGPL, create obligations on the acquirer and must be identified. Source code repositories and documentation are required where proprietary software exists, as are third-party integrations and API dependencies that could break or require renegotiation post-close.
Cybersecurity posture matters even for companies without a security team. Any past data breaches must be disclosed with documentation of what occurred and what remediation steps were taken. Undisclosed breaches discovered post-close are indemnification events. Current security practices, access controls, patch management, and backup and recovery documentation round out the request.
Data privacy compliance follows. Sellers should document their compliance posture under GDPR, CCPA, and any sector-specific data-privacy rules that apply to their industry and customer base. The practical message is simple: inventory the software, review the licenses for transferability, and document any past incidents before diligence begins.
How the quality-of-earnings review fits into a seller's preparation strategy
A sell-side quality-of-earnings review tests the seller's own financials the way a buyer's QoE firm will. It finds the adjustments, reconciliation gaps, and add-back weaknesses before they become the buyer's negotiating leverage. The logic is the same as every other category in this checklist: the party who surfaces the issue first controls the framing.
The stakes are larger than a single line item. The gap between a seller's presented EBITDA and the QoE-adjusted EBITDA can be material, and since valuation is a multiple of that EBITDA figure, even a modest discrepancy compounds into a six- or seven-figure price adjustment at the table, or a broken deal. The QoE cost was a small fraction of that difference on any business with significant EBITDA.
The strongest objection deserves acknowledgment. A sell-side QoE also produces the add-back schedule that buyers will interrogate. When the seller's own advisors have already stress-tested and documented each adjustment, the buyer's QoE firm has fewer undefended targets, and the negotiating dynamic shifts.
How to build a data room that signals seller quality before diligence starts
A data room's organization communicates seller credibility before a buyer reads a single document. A well-indexed, consistently named, version-controlled room tells the buyer that the seller runs a well-managed business. A folder of files named "final-v3-USE-THIS" tells a different story.
The practical framework is simple. Use a file naming convention that is date-first with descriptive labels: 2024-Q4-Balance-Sheet, not final-revised2. Designate one person, the seller, CFO, or advisor, to manage all uploads. Multiple uploaders produce duplicate versions that undermine buyer confidence.
Staged disclosure protects the seller's most sensitive material. Release sensitive customer lists, employee compensation detail, and proprietary operational information only after LOI is signed and the NDA has been reviewed for AI-use restrictions. A seller who has worked through it and organized it well arrives at the LOI as the kind of counterparty buyers want to close with quickly, rather than one they treat with caution.
When to start, how to sequence, and where professional guidance changes the outcome
Timing determines whether this checklist is a transformation tool or a salvage operation. At twenty-four months out, the work is financial cleanup: ensure monthly P&Ls are current and reconciled, start building documented processes, and reduce owner dependency. At twelve months out, review all material contracts for change-of-control provisions, complete the contractor-classification audit, run the nexus analysis, and begin customer diversification if concentration is high. At three months out, update TTM financials, brief key employees on transition, and finalize the add-back schedule with supporting documentation.
For sellers on a compressed timeline, distressed, forced, or opportunity-driven exits, a focused six-month sprint on the highest-priority items delivers most of the value. The QoE, contracts review, and data room assembly are the three items that move outcomes most. The full checklist is a triage instrument when it cannot be a full preparation plan.
The owner who works through this checklist alone faces a significant organizational and analytical burden. Professional guidance changes the outcome precisely where judgment is required rather than effort. The owner who starts this checklist today is the owner who controls their exit rather than reacting to it.
