A business due diligence checklist for buying a company is the working document a buyer uses, over roughly 30 to 90 days before closing, to verify that the target is what the seller says it is and to surface liabilities that would otherwise transfer with the deal. The categories below cover what to collect, what to reconcile against what, and where the largest risks tend to sit. Work through them in parallel rather than in sequence; issues in one area almost always ripple into others.
Corporate Records and Ownership
Confirm the target’s legal existence with the formation filings on record with the Secretary of State: Articles of Incorporation for a corporation, Articles of Organization for an LLC. Then pull the internal governance documents. Bylaws or an operating agreement govern voting rights, management authority, and how major decisions get approved, and those rules define what a buyer is actually purchasing.
Get the full minute books. Board and shareholder minutes should record every material corporate action: officer elections, stock issuances, approval of major contracts, authorization of prior transactions. Reconcile the minutes against a current capitalization table listing every security holder, ownership percentage, and outstanding stock certificate or membership interest. Gaps between the minute book and the cap table point to unauthorized issuances or unresolved ownership disputes.
Shareholder agreements, buy-sell agreements, and voting agreements often contain transfer restrictions, rights of first refusal, and drag-along or tag-along provisions that constrain what happens when ownership changes hands. If the target has subsidiaries or holds interests in other entities, collect formation and governance documents for each one.
Change-of-Control Provisions
Change-of-control clauses appear in almost every category of business agreement, from commercial contracts to credit facilities. In financing documents, they almost universally trigger mandatory prepayment or an event of default when ownership shifts. Triggers vary. Some activate when more than 50% of voting equity changes hands; others set the threshold as low as 20%. Board composition changes and sales of substantially all assets can also qualify. Identifying every agreement that carries one of these clauses is among the highest-priority tasks in the whole review, because a single missed provision can unwind a key contract or accelerate millions in debt on closing day.
Financial Statements and Bank Records
Ask for at least three years of historical performance data: audited or reviewed income statements, balance sheets, and cash flow statements. If the company has never been audited, unaudited financials with internally prepared management reports are the starting point, but buyer advisors will scrutinize them harder. Pull bank statements covering the same period so reported revenue can be cross-checked against actual deposits. Large gaps between the two suggest aggressive accounting or something worse.
Detailed accounts receivable and accounts payable schedules show the timing of cash inflows and upcoming obligations. Aging reports are particularly telling: a business that looks profitable but carries a large bucket of receivables past 90 days has a collections problem that will hit cash flow. Collect documentation for all outstanding debt, including promissory notes, lines of credit, and loan agreements, so the buyer knows the total leverage being inherited and the repayment terms.
Tax Returns and Compliance
Gather federal and state tax returns for at least the prior three years, along with any correspondence from taxing authorities. Non-compliance penalties scale quickly. For a standard corporate return filed late, the IRS imposes a penalty of 5% of the unpaid tax per month the return is overdue, up to 25%. For returns due after December 31, 2025, the minimum penalty is $525 or 100% of the unpaid tax, whichever is less. Partnership and S corporation returns carry a separate per-partner or per-shareholder penalty of $255 per month for up to 12 months, so a 10-member partnership filing a year late faces over $30,000 in penalties before interest.1Internal Revenue Service. Failure to File Penalty Look for open audits, notices of deficiency, or tax liens, and verify that payroll tax deposits have been made on time.
Quality of Earnings
An audit confirms that financial statements follow generally accepted accounting principles. A quality of earnings report goes further, stripping away one-time events, non-recurring income, and owner discretionary spending to show what the business actually earns on a sustainable basis. Common adjustments include normalizing owner compensation to market rates (an owner paying herself $80,000 when the replacement cost for her role is $250,000 flatters EBITDA significantly), removing personal expenses run through the business, and smoothing out unusual swings in travel, insurance, or maintenance. If the seller has not commissioned a quality of earnings report, a serious buyer will insist on one. The findings often move the purchase price more than any other single document in the data room.
Liens and Security Interests
Before assuming you are buying free-and-clear assets, run UCC lien searches to identify security interests filed against the company’s property. Under UCC Article 9, lenders perfect their security interests by filing a financing statement, and those filings are public record. For corporations and LLCs, search at the Secretary of State’s office in the state of formation using the exact legal name from the formation documents. For sole proprietors, search in the state of the individual’s principal residence using the name on the driver’s license. Run searches under former business names and in multiple states when the company has relocated or changed its name.
Results will list every creditor claiming a security interest in company assets, including blanket liens covering everything the business owns. Compare filings against the debt schedule the seller provided. Any lien that does not match a disclosed loan is a problem. Also check for federal and state tax liens, judgment liens, and mechanic’s liens against any real property. Clearing or subordinating these encumbrances before closing is typically a condition of the purchase agreement.
Physical Assets and Intellectual Property
Tangible asset verification starts with a complete inventory of real property holdings checked against recorded deeds and title reports. Gather equipment leases and review each for monthly cost, remaining term, and whether the lessee has a purchase option at expiration. For owned equipment, depreciation schedules and maintenance records help assess remaining useful life. A business that shows healthy earnings but has deferred maintenance on critical equipment is hiding a future capital expenditure.
Patents, Trademarks, and Copyrights
Collect registration certificates for all active patents, trademarks, and copyrights. The USPTO now issues electronic trademark registration certificates under digital seal, which serve as proof of registration.2United States Patent and Trademark Office. Receiving Your Trademark Registration Verify that the registered owner on each certificate is actually the target company rather than an individual founder or a related entity. Check expiration and renewal dates: a trademark registration that lapses during transition can leave the buyer without brand protection. For patents, confirm the remaining term and review any licensing agreements that grant third parties rights to use the technology.
Software and SaaS Subscriptions
Many SaaS subscriptions are licensed under terms that restrict transfer. Compile a full inventory of every software application the company uses, including both sanctioned enterprise tools and unsanctioned applications employees adopted on their own. For each subscription, review the vendor agreement and service level agreement to determine whether the license survives a change of ownership or requires vendor consent. Check for vendor security certifications like SOC 2 or ISO 27001, especially on any platform that processes customer data. Domain name registrations, social media accounts, and proprietary codebases should be verified for ownership and documented with transfer instructions.
Commercial Contracts and Customer Relationships
Revenue stability depends on contractual relationships. Gather master service agreements with major customers alongside active vendor and supplier contracts. Joint venture agreements, licensing arrangements, and franchise or distribution agreements belong on the same list. For each contract, capture the parties, effective date, renewal terms, and termination clauses. Assignment and change-of-control language matters enormously: many commercial contracts require the counterparty’s written consent before the agreement can transfer to a new owner. Without that consent, the contract terminates on closing, and the revenue walks out the door.
Non-disclosure agreements and settlement agreements from past disputes reveal both confidentiality constraints the buyer will inherit and the company’s litigation history. Non-compete agreements with former employees or business partners may restrict the acquired company’s ability to operate in certain markets. Document every material contract in a single schedule that flags the ones requiring third-party consent, so those conversations start early.
Customer Concentration
Revenue spread matters as much as revenue size. If a single customer accounts for more than 10% of total revenue, most buyers treat that as a concentration risk. Above 20%, expect a valuation discount. A single customer generating 30% or more can stall or kill a deal outright, because losing that one relationship post-closing could crater the business. Analyze concentration across the top three, five, and ten customers, and review contractual terms governing each. Short-term or at-will contracts with major customers amplify the risk.
Litigation, Claims, and Regulator Correspondence
Hidden liabilities surface most often here. Collect a complete list of pending lawsuits, threatened claims, and governmental investigations involving the company, its subsidiaries, and any officer or director. Include jurisdiction, parties, nature of the claim, and any estimated exposure. Obtain copies of court orders, injunctions, judgments, and consent decrees currently binding the company. Document past settlements, including amounts and any ongoing obligations like non-disparagement or behavioral covenants.
Review regulator correspondence, including warning letters, notices of violation, and subpoenas. A company with no pending litigation but three FDA warning letters in two years presents a different risk profile than its clean docket suggests. Verify which claims insurance covers, and cross-reference them against the policies below. Uninsured or underinsured claims hit the purchase price hardest.
Insurance Policies and Loss History
Obtain every active insurance policy: general liability, property, directors and officers, auto, workers’ compensation, professional liability, and any environmental or product liability coverage. For each, note coverage limits, deductibles, named insureds, and exclusions. The goal is to identify gaps. A manufacturer with no product liability coverage, or a company with D&O insurance that excludes claims arising before the policy inception date, both represent significant exposure.
Request loss run reports from each carrier covering at least the prior five years. Loss runs list every claim filed against each policy with paid amounts and open reserves. A pattern of frequent workers’ compensation claims signals workplace safety problems and probable premium increases. For any claims-made policy, determine whether tail coverage is needed to protect against claims arising from pre-closing conduct that surface after the deal closes. Tail coverage can be expensive; the purchase agreement should allocate the cost between buyer and seller.
Employees, Benefits, and Compensation
Start with a current organizational chart and a full employee roster showing titles, hire dates, and compensation. Collect employment agreements, offer letters, and any side arrangements promising bonuses, severance, or equity. Benefit plans governed by ERISA warrant careful attention: the statute sets minimum standards for retirement and health plans in private industry and imposes fiduciary responsibilities on anyone who manages plan assets.3U.S. Department of Labor. Employee Retirement Income Security Act of 1974 Get the plan documents, summary plan descriptions, and most recent Form 5500 filings. ERISA requires plan-related records to be retained for at least six years after the applicable Form 5500 filing deadline, so a company that cannot produce them has a compliance problem.
Contractor Classification
Independent contractor agreements deserve close scrutiny. The IRS uses a multi-factor test examining behavioral control, financial control, and the relationship between the parties to determine whether a worker is an employee or an independent contractor.4Internal Revenue Service. Topic No. 762, Independent Contractor vs. Employee If a company has misclassified employees as contractors, the business can be held liable for the employer’s share of unpaid employment taxes plus the employee’s share that was never withheld.5Internal Revenue Service. Worker Classification 101 – Employee or Independent Contractor Review every contractor agreement and assess whether the actual working relationship matches the classification on paper. This is one of the most common sources of post-closing tax liability in smaller acquisitions.
Executive Severance and the Golden Parachute Trap
Severance arrangements for senior executives can trigger harsh tax consequences in an acquisition. If a change-of-control payment to a key employee equals or exceeds three times that person’s average annual compensation over the prior five years, the entire excess above the base amount becomes a non-deductible “excess parachute payment” for the company.6Office of the Law Revision Counsel. 26 USC 280G – Golden Parachute Payments On top of the lost deduction, the executive receiving the payment owes a 20% excise tax on the excess amount.7Office of the Law Revision Counsel. 26 USC 4999 – Golden Parachute Payments Any employment or severance agreement entered into within one year before the ownership change is presumed contingent on that change unless the company can prove otherwise by clear and convincing evidence. Identify these arrangements early. Restructuring them before closing can save both sides significant money.
Stock option and equity incentive plans need a separate schedule showing shares subject to outstanding awards, vesting schedules, and exercise prices. Determine how many options accelerate upon closing, because accelerated vesting can trigger additional parachute payment calculations and affect the fully diluted share count used to compute the per-share purchase price.
Environmental Site Conditions
If the acquisition involves real property, especially commercial or industrial sites, environmental due diligence is not optional. Under CERCLA, a current property owner can be held liable for the full cost of cleaning up contamination even if a prior owner caused it. The only way to qualify for liability protection as an innocent landowner or bona fide prospective purchaser is to conduct “all appropriate inquiries” before acquiring the property.8U.S. Environmental Protection Agency. Superfund Landowner Liability Protections
In practice, that means commissioning a Phase I Environmental Site Assessment that complies with ASTM International Standard E1527-21 or, for rural and forestland properties, ASTM E2247-23.9U.S. Environmental Protection Agency. Brownfields All Appropriate Inquiries The Phase I must be completed before closing. If it identifies recognized environmental conditions, a Phase II involving soil and groundwater sampling typically follows. Phase I costs generally run $1,500 to $6,000 depending on property size and location. Skipping the assessment does not just create risk; it forfeits the statutory defense entirely.
Beyond site contamination, review environmental permits, hazardous waste disposal records, and correspondence with environmental regulators. Outstanding notices of violation or consent orders can carry remediation costs that dwarf the purchase price of a small business.
Data Privacy and Cybersecurity
Data practices are a liability category that barely existed a decade ago and now regularly reshape deal terms. If the target company has made privacy promises to its customers, federal law requires the company to honor those claims, and even without specific promises, businesses have an obligation to maintain security appropriate to the nature of the data they hold.10Federal Trade Commission. Privacy and Security A data breach discovered after closing is the buyer’s problem.
Start by identifying what personal data the company collects, where it is stored, and who has access. Determine whether the business is subject to sector-specific rules. Financial institutions face requirements under the Gramm-Leach-Bliley Act, companies handling children’s data must comply with COPPA, and businesses using consumer credit reports have obligations under the Fair Credit Reporting Act.10Federal Trade Commission. Privacy and Security If the company transfers data between the EU and the United States, verify compliance with the EU-U.S. Data Privacy Framework.
On the technical side, inventory the company’s digital attack surface, review its security tools and incident response capabilities, and evaluate whether the environment has been compromised. Ask for documentation of the last penetration test, the most recent security audit results, and the written information security policies. A company that cannot produce any of these is telling you something important about how it treats data protection.
Permits, Licenses, and OSHA Records
Catalog every industry-specific license and permit the company holds, with expiration dates and any conditions attached to renewal. Many permits are not automatically transferable upon a change of ownership. Some require a new application; others need prior approval from the issuing agency. If the business cannot operate without a specific permit and that permit cannot transfer, the deal structure may need to shift from an asset purchase to an equity purchase to preserve the license.
Workplace safety records show both regulatory risk and operational culture. Request the OSHA 300 logs (recordable injuries and illnesses), OSHA 301 incident reports, and OSHA 300A annual summaries for at least the prior five years, which is the minimum retention period. Review documentation for required safety training, including hazard communication, lockout/tagout procedures, and equipment-specific certifications. A company with a high injury rate faces potential OSHA citations and rising workers’ compensation premiums that will hit the buyer’s operating costs after closing.
Data Room Setup and Timing
The investigation runs out of a virtual data room that serves as the central repository for every document on the checklist. Files are organized by category in a logical folder structure, with granular access permissions so each team member sees only what their role requires. Dynamic watermarking on sensitive files deters unauthorized sharing and creates an audit trail. The seller populates the data room; the buyer’s team reviews it.
A review team of legal, financial, and operational professionals works through the room systematically, comparing records against each other and against third-party sources. They look for inconsistencies: a contract that contradicts the board minutes, a revenue figure that does not match the bank deposits, a debt obligation that never appeared on the balance sheet. As gaps emerge, the team generates a deficiency list, the seller supplies missing documents or explanations, and open questions get resolved before the purchase agreement is signed.
Most reviews take 30 to 90 days. Complex transactions with multiple subsidiaries or international operations run longer. Rushing this phase to meet an arbitrary closing deadline is one of the most expensive mistakes a buyer can make. Issues missed during due diligence do not disappear; they become more expensive to fix after you own the company.
How Findings Shape the Purchase Agreement
Every issue uncovered feeds directly into the representations and warranties the seller makes in the purchase agreement. The seller represents the accuracy of its financial statements, the status of its litigation, the ownership of its assets, and dozens of other factual assertions. If any of those later prove false, the buyer recovers losses through the indemnification provisions.
Indemnification terms get negotiated based on what due diligence revealed. General representations typically survive 12 to 24 months after closing, with caps commonly set at 10% to 20% of the purchase price. Fundamental representations covering equity ownership, asset title, and corporate authorization often survive more than five years and may carry uncapped liability. A deductible-style “basket” usually prevents claims until losses exceed 0.5% to 1% of the purchase price. The thoroughness of the review directly determines how well these provisions protect the buyer: a risk you never identified cannot become a representation, and a representation that was never made cannot be indemnified.