An owner signs a letter of intent at a number both sides call fair, and in the same signature grants the acquirer 60 to 90 days of exclusivity. From that moment, the competition that produced the price is suspended. What follows is confirmatory due diligence: eight parallel workstreams, several hundred document requests, and a team of accountants, attorneys, and consultants paid to test every claim the company has made about itself. The deals that close on their original terms are not the ones where diligence found nothing. They are the ones where diligence found nothing the acquirer did not already know.
What Diligence Is For
Diligence has three jobs, and knowing which one a request serves changes how an owner experiences the process.
First, verify the story. The CIM made specific claims: the revenue is durable, the margins are real, adjusted EBITDA is what the schedule says it is. The acquirer priced those claims at the LOI, and its board, lenders, and investors will not take the CIM’s word for them. Diligence tests each claim against source documents.
Second, price the risk. Most findings do not kill deals; they get priced, through the headline number, through structure (escrow, earnout, seller note), or through the purchase agreement’s risk allocation. A confirmed risk is a negotiating input, not a verdict.
Third, plan the ownership. A meaningful share of the request list is not about whether to buy but about how to operate afterward: integration sequencing, key-employee retention, day-one working capital, systems migration. Owners often read these requests as intrusive. They are usually the most benign items in the folder.
Diligence is also heavier in the lower-middle market than it was a decade ago. Quality of earnings work, once reserved for larger transactions, now shows up on both sides of most deals above roughly $2 million of EBITDA; lenders verify more than they did in the cheap-money years; and acquirers who buy for a living have institutionalized what they check. Representations and warranties insurance played a part as well: RWI appeared in roughly two-thirds of the larger private-target deals the ABA studied in 2025 (Chapter 13 has the numbers), and because insurers cover only what has been properly diligenced its rise raised standards across the market, even though RWI rarely pencils below roughly $20-25 million in enterprise value and most lower-middle-market deals still allocate risk through traditional escrows and indemnities (Chapter 13 covers those mechanics).
Key point. Diligence speed is deal momentum. Every week a document request sits unanswered pushes the close date, and time is the deal’s enemy: another month of exclusivity is another chance for a soft sales month, a lost customer, or cold feet. Chapter 17 treats momentum as a negotiating force; diligence is where it is won or lost.
The Eight Workstreams
Under exclusivity the acquirer’s advisors divide into parallel teams, and their findings feed each other: the claims history in the insurance file corroborates what the operations team saw on the shop floor, and a shaky ERP undermines confidence in every number the financial team touches. For each workstream below: what gets requested, what the team is looking for, and what it most often finds. Appendix D reproduces a full document checklist organized the same way.
Financial and Quality of Earnings
The request: three to five years of monthly financial statements, trial balances, bank statements, accounts receivable and payable agings, customer-level revenue and margin detail, and documentation for every add-back on the adjusted EBITDA schedule. The QoE team is asking one question: are the earnings real? It performs a proof of cash, reconciling reported revenue and profit to actual bank activity; reviews revenue recognition against delivery; rebuilds margins customer by customer; and tests each add-back against evidence. If the schedule says the company earns $2.85 million rather than the $2.4 million it reports, as with Meridian Industrial Services in Chapter 6, every line of that bridge gets verified. Common findings: add-backs that do not survive, revenue cut-off errors around period ends, margin concentrated in two or three accounts, and a TTM trend softer than the CIM presented.
Tax
The request: federal and state income tax returns, sales and use tax filings, payroll tax filings, and a schedule of every state where the company has employees, property, or meaningful sales. The team is looking for exposures that follow the business: unremitted sales tax in states where the company has economic nexus but never registered (an exposure that commonly follows the assets under successor liability rules, even in an asset deal), payroll tax compliance, and S-corporation cleanliness, since a defective election or disproportionate distributions can unwind assumed tax treatment. Common findings: nexus created years ago by remote employees or out-of-state work, taxable services invoiced without tax, and returns that deduct the owner’s personal expenses, which cuts both ways in the add-back discussion.
Legal
The request: every material contract, entity organizational documents, litigation history, IP registrations and assignments, permits and licenses. The team is reading for three things: assignability (anti-assignment and change-of-control clauses in customer, supplier, and lease agreements), litigation and dispute exposure, and chain of title on intellectual property, particularly anything built by outside contractors. Common findings: top customer contracts that require written consent to assign, key agreements that exist only as unsigned drafts or expired renewals, handshake arrangements documented nowhere, and software or designs developed by contractors who never signed an assignment.
Commercial
The request: the full customer list with multi-year revenue by account, pipeline and backlog detail, pricing history, and churn data, followed late in the process by carefully staged customer reference calls and market checks. The team is testing whether the revenue is durable and whether the relationships belong to the company or to the owner personally. Common findings: concentration higher than presented once related entities are grouped under a common parent, backlog padded with verbal awards, and customer calls that reveal the owner is the relationship.
Operations
The request: equipment lists with maintenance records, facility leases, capacity and utilization data, safety and environmental records, and supplier agreements. The team is looking for deferred capital expenditure (equipment run past its useful life flatters EBITDA today and bills the next owner tomorrow), capacity constraints that contradict the growth story, and compliance liabilities. Common findings: a fleet or machine base whose average age implies a catch-up capex bill in the first two years of new ownership, and a critical input with a single supplier and no qualified alternative.
Human Resources
The request: the org chart, an employee census with compensation and tenure, independent contractor agreements, benefit plan documents, the handbook, and any non-compete or non-solicit agreements. The team is looking for contractor misclassification, overtime exposure from employees wrongly classified as exempt, key-employee flight risk, and unrecorded liabilities such as accrued PTO or promised bonuses. Common findings: contractors of eight years’ standing who work exclusively for the company on its schedule and equipment, and no retention or non-solicit agreements with the two employees who actually hold the customer relationships.
Technology and Cyber
The request: a systems inventory, software license documentation, security policies, incident history, and backup and recovery procedures. The team is looking for unlicensed software (the acquirer inherits the audit risk), the reliability of the systems that produced the financial data, security posture, and single points of failure. Common findings: license counts short of actual seats, core systems running unsupported versions, administrative credentials held by one person, and backups that exist but have never been test-restored.
Insurance
The request: current policy schedules, five years of loss runs, claims history, and workers compensation experience modifiers. The team is looking for coverage gaps relative to the company’s actual risk profile (cyber and employment practices liability are the usual absentees), claim patterns that corroborate operational findings, and whether liability policies are written claims-made, which requires tail coverage at closing. Common findings: limits unchanged since the company was half its size, and a loss run that tells a safety story management did not.
The table below compresses the eight workstreams into the version worth keeping on one page.
| Workstream | What they ask for | Common landmines |
|---|---|---|
| Financial / QoE | Monthly financials, bank statements, agings, add-back support | Struck add-backs, cut-off errors, EBITDA that does not tie to cash |
| Tax | Income, sales/use, and payroll filings; state footprint | Unregistered nexus, S-corp defects, successor liability |
| Legal | Contracts, entity records, litigation, IP assignments, permits | Anti-assignment clauses, contractor-built IP never assigned |
| Commercial | Customer-level revenue, backlog, pricing; customer calls | Hidden concentration, owner-held relationships, soft backlog |
| Operations | Equipment and maintenance records, capacity, safety, suppliers | Deferred capex, single-sourced inputs, compliance gaps |
| HR | Census, contractor agreements, benefits, non-competes | Misclassified contractors, overtime exposure, flight risk |
| Technology / cyber | Systems inventory, licenses, security, incident history | Unlicensed seats, one-person systems, untested backups |
| Insurance | Policy schedules, loss runs, comp modifiers | Coverage gaps, claims-made tails, outgrown limits |
The Red Flags That Reprice or Kill
Most findings get priced and papered. A short list of them reprices deals hard or ends them outright, and every one can be self-diagnosed before an acquirer diagnoses it for you.
EBITDA that does not tie to cash. The single deadliest finding, because it poisons every other number. What it looks like in practice: the proof of cash cannot reconcile reported revenue to bank deposits; receivables grow much faster than revenue year after year; unbilled revenue accumulates on the balance sheet; reported EBITDA is strong while the cash balance never moves and distributions do not explain the gap. Self-diagnosis: take last year’s adjusted EBITDA, subtract capex, debt service, owner distributions, and the change in working capital, and compare what remains to the change in your bank balance. If you cannot get close, an acquirer will not either, and acquirers price unexplained gaps as if the worst explanation is true.
Revenue recognition surprises. Annual contracts billed upfront and booked as revenue the month invoiced; percentage-of-completion estimated by feel rather than by cost; a December revenue spike every year followed by a hollow January. Self-diagnosis: if customers prepay and no deferred revenue appears on your balance sheet, your TTM earnings are overstated on an accrual basis, and the restatement will move price at the multiple. Restating $200,000 of EBITDA in a 5.0x deal is a $1 million repricing.
Concentration worse than represented. The CIM says the top customer is 18% of revenue; diligence groups three accounts under a common parent and finds 31%, or reruns the analysis on gross profit and finds the real dependence. Self-diagnosis: group your customer list by ultimate parent entity and recompute concentration on gross profit, not just revenue. If the answer surprises you, present it yourself, framed and mitigated, before it is discovered.
Undisclosed liabilities. Threatened but unfiled litigation, warranty obligations, side letters granting customers return rights or price protection, verbal bonus promises to key staff. These surface through customer calls, employee interviews, and accrual reviews, and the damage is doubled on discovery: the liability itself, then the credibility question of what else went unmentioned.
Misclassified workers. Any contractor who works substantially full-time, only for you, on your schedule and your equipment will be treated by an acquirer as employee exposure, with back taxes, back overtime, and penalties attached. The same review catches salaried employees doing non-exempt work. Even in an asset deal, the exposure shapes price, escrow, or both.
IP the company does not own. The estimating tool a contractor built years ago with no written assignment; trademarks used but never registered; a patent or license held in the owner’s name rather than the company’s. Acquirers pay for what the company owns, and discovering that it owns less changes what they pay.
Change-of-control consents. In an asset sale nearly every contract must be assigned, so every anti-assignment clause activates, and a top customer asked for consent has just been handed leverage: it can demand pricing concessions, rebid the work, or simply sit on the request while the closing waits. Self-diagnosis: read the assignment and change-of-control clauses in your 10 largest customer contracts this week. Chapter 15 covers fixing what you find while there is still time to fix it.
Legitimate Repricing vs. Tactical Retrading
Every price reduction during exclusivity arrives wearing the same clothes: “based on diligence findings, we need to revisit valuation.” Some of those sentences are honest and some are predatory, and owners need to tell them apart in real time. Three tests do most of the work.
New facts or new appetite? A legitimate repricing traces to something the acquirer learned that differs from what was represented. If $300,000 of add-backs did not survive verification, the earnings basis fell, and at the agreed multiple the price falls with it; the acquirer can show the math, line by line. A tactical retrade cites what was already known (the concentration disclosed in the CIM, rediscovered in week 10) or something no document can rebut: integration risk, market conditions, the investment committee.
Is there math? Legitimate repricing is itemized, documented, and tied to the valuation basis, and it is reversible in principle: prove the add-back and the dollars come back. Tactical retrading is a round number, aggregated from small grievances, and resistant to itemization, because its real basis is the acquirer’s belief about your alternatives.
When did it arrive? Real findings surface when the workstream reaches them, commonly in the middle weeks of exclusivity, and serious acquirers raise them promptly. A repricing that appears only days before closing, when the owner is exhausted, committed, and presumed to be out of options, is a bet about leverage, not a discovery.
The defense is mostly built before exclusivity begins: certainty screening at the LOI stage, an acquirer whose references confirm it closes at its letter, and competition kept credibly in reserve. Chapter 17 covers retrade defense in the wider negotiation context.
The advisor’s view. In our experience, retrading is a habit, not an event: the firms that do it tend to do it on every deal, and the pattern is discoverable in advance. Before recommending exclusivity, we ask acquirers how their last several closed deals compared to their LOIs, and we call owners who sold to them. Reputation is the cheapest diligence an owner ever runs.
The Data Room
The data room, the indexed virtual repository where every diligence document lives, is the first management artifact an acquirer handles under exclusivity, and it gets read as evidence. A room that mirrors the request list, uses consistent naming, and keeps every contract together with all of its amendments says the company is run the way the CIM claims. A room assembled in a panic says the opposite, and acquirers extend the inference to everything they cannot see.
Three practices separate strong rooms from weak ones. Completeness against an index: Appendix D contains a full checklist organized by the eight workstreams, and an owner who cannot readily produce most of it is not ready for market. Staged disclosure: not everything belongs in the room on day one; customer names, employee compensation, and pricing detail are commonly held for later phases or restricted access, so that the most sensitive data reaches a competitor-acquirer only when the deal is nearly certain. Question-and-answer discipline: one written log, numbered questions, versioned answers, because verbal responses to diligence questions have a way of becoming disputed memories, and the record of what was disclosed feeds the disclosure schedules that Chapter 13 explains.
Surviving Diligence as an Owner
Owners who come through diligence intact follow three rules, and none of them is complicated.
Respond fast. In most lower-middle-market processes, the binding constraint is not the acquirer’s team; it is the owner’s ability to produce documents while running the company. Requests answered in days keep four workstreams moving; requests that sit for two weeks stall all of them and push the close into another month of risk. Turnaround time is also read as a signal: slow answers on financial requests, in particular, get interpreted as reluctance. Chapter 15’s preparation program is, in large part, this chapter’s request list handled a year early.
Disclose early. Bad news ages terribly. A problem disclosed on day one is context: it gets priced calmly, often structured around, sometimes waved off. The same problem discovered in week nine is a credibility event that reprices more than itself, because it forces the acquirer to re-verify everything it had taken on trust. Owners consistently overestimate the cost of honest disclosure and underestimate the cost of discovery.
Common pitfall. An owner learns mid-process that a major customer is putting its work out to bid and says nothing, hoping the RFP resolves before closing. The acquirer’s customer calls surface it in week nine. The repricing that follows is larger than the account is worth, because the acquirer no longer trusts what it cannot independently verify, and diligence that was nearly finished starts over.
Keep running the business. The TTM keeps moving during exclusivity, and a soft quarter is the one repricing trigger no one can argue with. Delegate document production to your advisor and your controller, keep your own calendar pointed at customers and pipeline, and treat the company’s performance through closing as the final exhibit in the data room, because the acquirer certainly will.
The Bottom Line
- Diligence has three jobs: verify the story, price the risk, and plan the ownership; expect eight workstreams running in parallel for 60 to 90 days.
- The deadliest finding is EBITDA that does not tie to cash: run your own proof of cash before an acquirer runs theirs.
- Legitimate repricing arrives mid-process with line-item math; tactical retrading arrives late, vague, and round-numbered, and reference-checking acquirers before exclusivity is the cheapest defense.
- The data room is a competence signal: indexed, complete, and current tells the acquirer the company matches its CIM.
- Problems disclosed on day one get priced; problems discovered in week nine get punished.
- Diligence speed is deal momentum, and momentum closes deals (Chapter 17).