Due Diligence for Buyers: What to Investigate Before You Sign the Purchase Agreement

By Hank FasthoffJuly 6, 2026

Due diligence is the investigation period between signing the letter of intent and committing to the purchase agreement. It's the buyer's opportunity to verify everything the seller has represented about the business, discover what the seller hasn't disclosed, and price the deal based on verified facts rather than projections and promises.

Most middle-market transactions allow 60 to 90 days for due diligence. Simple deals with organized records can close in 45 days. Complex transactions involving regulatory approvals, multi-state operations, significant IP portfolios, or environmental concerns can run 120 days or longer. However long the period runs, diligence is the buyer's last real opportunity to adjust the purchase price, negotiate specific indemnification, structure escrow holdbacks, or walk away. Everything the buyer doesn't find during diligence becomes the buyer's problem after closing.

Corporate and Organizational

Corporate diligence verifies that the entity exists, that the seller has the authority to sell it, and that the ownership is what the seller represented.

Review the target's organizational documents (certificate of formation, operating agreement or bylaws, all amendments), good standing certificates from the state of formation and every state where the entity is qualified to do business, the capitalization table (every equity holder, every outstanding option or warrant, every convertible instrument), board minutes and member/shareholder consents for the past three to five years, and all organizational charts showing subsidiaries, affiliates, and related entities.

What to watch for in this category includes discrepancies between the capitalization table and the purchase agreement (an equity holder who isn't a party to the sale, an outstanding option that would dilute the ownership being sold), lapsed good standing in states where the company does business (which can trigger penalties and affect the company's ability to enforce contracts in those states), and governance actions that weren't properly authorized (a prior sale, merger, or significant contract that required but didn't receive board or member approval).

Financial

Financial diligence verifies that the company's earnings, cash flow, and financial position are what the seller has represented. A quality of earnings (QoE) report prepared by a transaction CPA is the single most important financial document in any acquisition. Don't skip it.

Review three to five years of financial statements (audited, reviewed, or compiled), corresponding tax returns (reconciled against the financials), a normalized quality of earnings analysis identifying owner add-backs, one-time expenses, and non-recurring revenue, accounts receivable and accounts payable aging reports, working capital trends over the same period, a schedule of all outstanding debt (term loans, lines of credit, equipment financing, related-party loans), and capital expenditure history and deferred maintenance.

What to watch for includes EBITDA add-backs that don't survive scrutiny (personal expenses run through the business, one-time revenue treated as recurring, expenses that are "non-recurring" but recur every year), customer concentration (any single customer representing more than 20 percent of revenue is a risk, and the top three customers representing more than 50 percent is an extreme risk), declining revenue trends masked by one-time projects or contract wins, and working capital that fluctuates seasonally in ways the purchase price doesn't account for.

Tax

Tax diligence identifies unpaid tax obligations, filing deficiencies, and structural tax risks that the buyer could inherit.

Review all federal, state, and local tax returns for three to five years, sales tax registrations and filing history for every state where the company has nexus, payroll tax filings and compliance, property tax assessments and payment history, any ongoing audits, disputes, or correspondence with taxing authorities, and worker classification (whether workers classified as independent contractors should be classified as employees).

What to watch for includes unfiled returns or amended returns that suggest prior errors, sales tax nexus in states where the company hasn't been filing (an increasingly common issue for companies that sell online or have remote employees in multiple states), worker misclassification (the IRS and state agencies actively pursue companies that classify employees as independent contractors to avoid payroll taxes and benefits), and tax positions that depend on elections or entity classifications that may not survive the acquisition.

In an asset purchase, the buyer generally doesn't inherit the seller's tax liabilities (though tax liens that attach to purchased assets can follow the assets). In an equity purchase, every unpaid tax obligation comes with the entity.

Contracts

Contract diligence identifies the rights and obligations the buyer is acquiring (in an asset purchase) or inheriting (in an equity purchase), and identifies provisions that could affect the deal.

Review all material customer contracts (revenue above a defined threshold), vendor and supplier agreements, lease agreements (real property and equipment), loan agreements and security instruments, license agreements (IP licenses the company has granted and licenses it holds from third parties), partnership, joint venture, and referral agreements, and any contracts with related parties (owners, family members, affiliates).

What to watch for includes change-of-control provisions that give the counterparty the right to terminate or renegotiate if the company's ownership changes (in an equity purchase, this can mean losing a key customer contract on closing day), anti-assignment provisions that prohibit assignment without consent (in an asset purchase, contracts with anti-assignment language must be individually assigned with the counterparty's consent), auto-renewal provisions that lock the buyer into terms it hasn't evaluated, exclusivity or most-favored-nation provisions that restrict the buyer's post-closing operations, and verbal agreements with key customers or vendors that aren't documented (if a significant revenue relationship depends on a handshake rather than a written contract, the buyer has no enforceable right to that revenue after closing).

Intellectual Property

IP diligence confirms that the company owns (or has valid licenses to use) the intellectual property that drives the business.

Review all trademark, patent, and copyright registrations (federal and state), domain name registrations, IP assignment agreements from employees and contractors (confirming that work product was assigned to the company, not retained by the creator), license agreements granting the company the right to use third-party IP, license agreements granting third parties the right to use the company's IP, open-source software usage (if the company's product incorporates open-source components, the applicable open-source licenses may impose obligations on the buyer, including disclosure of source code under certain copyleft licenses), and any IP-related disputes, cease-and-desist letters, or infringement claims.

What to watch for includes IP held in a founder's name rather than the company's (one of the most common and most dangerous findings in private company acquisitions), missing assignment agreements from contractors who built key technology or created brand assets, trademarks used in commerce but never registered (common-law trademark rights are geographically limited and harder to enforce), expired or lapsed registrations that the company hasn't maintained, and open-source components embedded in proprietary software that could impose obligations on the buyer's use or distribution of the product.

Employment and Benefits

Employment diligence reviews the company's workforce, compensation structure, benefit obligations, and compliance with employment laws.

Review an employee roster with titles, hire dates, compensation, and classification (exempt versus non-exempt, employee versus contractor), all employment agreements, offer letters, and restrictive covenant agreements (non-competes, non-solicitations, NDAs), the employee handbook and written policies, benefit plans (health insurance, 401(k), pension, equity incentive plans) and funding status, pending or threatened employment claims (discrimination, harassment, wage-and-hour, wrongful termination), workers' compensation claims history, I-9 compliance, and OSHA compliance records.

What to watch for includes key employees without restrictive covenants (if the company's value depends on a few people and those people can leave and compete the day after closing, the buyer is paying for value that can walk out the door), unfunded benefit obligations (vested pension benefits, accrued PTO that must be paid out, deferred compensation arrangements), worker misclassification (employees treated as 1099 contractors, non-exempt employees treated as exempt), and owner dependency (if the owner personally manages every client relationship, signs every contract, and makes every decision, transitioning those functions to the buyer or retained employees takes longer and costs more than most buyers anticipate).

Litigation

Litigation diligence identifies pending, threatened, and potential legal exposure that could produce post-closing losses.

Review a schedule of all pending litigation (parties, claims, jurisdiction, status, estimated exposure), all threatened claims (demand letters, pre-suit correspondence, regulatory investigations), all settled litigation from the past five years (with copies of settlement agreements and any ongoing obligations), all government investigations, subpoenas, and regulatory enforcement actions, and all orders, injunctions, consent decrees, and judgments binding on the company.

What to watch for isn't just individual cases but patterns. A company with three employment discrimination claims over five years presents a different risk profile than one with thirty. A company that's settled multiple product liability claims may have a systemic defect that hasn't been remedied. Regulatory investigations deserve particular attention because they often signal exposure that hasn't been quantified in the financials and can produce fines, consent orders, or license revocations that fundamentally change the business.

Real Property and Environmental

Real property diligence reviews the company's owned and leased real estate and identifies environmental exposure.

Review all lease agreements (including amendments, extensions, and estoppel certificates), property tax records and assessments for owned property, surveys and title commitments for owned property, zoning and land use approvals, and Phase I Environmental Site Assessments (ESAs) for owned property and, in some industries, leased property.

What to watch for includes lease terms that don't survive the acquisition (a lease that terminates on a change of control can force the buyer to renegotiate at a higher rate or relocate), personal guarantees by the seller that need to be released at closing (the landlord may require the buyer to provide a replacement guarantee), and environmental contamination that creates CERCLA liability for the current owner regardless of who caused the contamination.

Insurance

Insurance diligence confirms that the company carries adequate coverage and identifies coverage limitations that could affect the buyer.

Review all insurance policies (CGL, professional liability, cyber, property, workers' comp, auto, umbrella, D&O), claims history for the past five years, any pending claims or known incidents that haven't been reported, and whether policies are occurrence-based or claims-made (claims-made policies require tail coverage after closing to protect against claims arising from pre-closing events).

What to watch for includes policies that can't be assigned to the buyer (most insurance policies are non-assignable, meaning the buyer must procure its own coverage), claims-made policies without tail coverage (if the seller's professional liability or cyber policy lapses at closing, claims arising from pre-closing events won't be covered), and mismatches between the company's insurance program and the indemnification obligations the buyer will be relying on in the purchase agreement.

Regulatory

Regulatory diligence reviews the permits, licenses, and regulatory approvals required for the company to operate.

Review all federal, state, and local business licenses and permits (with expiration dates and renewal requirements), industry-specific licenses and certifications, regulatory filings and compliance records, any correspondence with regulatory agencies indicating noncompliance or pending enforcement, and whether permits and licenses transfer to the buyer or require new applications.

What to watch for includes licenses that are non-transferable and require the buyer to apply independently (which can interrupt operations between closing and license issuance), expired permits that the company has been operating without (which can produce fines and back-dated compliance obligations), and industry-specific regulatory changes that could affect the business post-closing.

How Findings Translate Into Deal Terms

Every due diligence finding should produce one of five outcomes in the purchase agreement.

A purchase price adjustment reduces the price to account for a discovered liability or a valuation shortfall. If diligence reveals that EBITDA is $200,000 lower than represented, the purchase price should be adjusted accordingly.

A specific indemnification provision requires the seller to indemnify the buyer for a known risk that can't be quantified at closing (a pending lawsuit, a potential tax assessment, an environmental remediation obligation). Specific indemnities are typically excluded from the general indemnification basket and cap.

An escrow holdback reserves a portion of the purchase price in escrow to fund potential indemnification claims. If diligence reveals a significant risk that the seller can't resolve before closing, increasing the escrow amount (or extending the escrow period) provides the buyer a funded source of recovery.

A condition to closing requires the seller to resolve a specific issue before the buyer is obligated to close. If a key contract requires consent to assign and the counterparty hasn't provided consent, obtaining consent can be made a condition to closing.

A walk-away decision terminates the deal. Some findings are fundamental enough that no purchase price adjustment, indemnification, or escrow can adequately protect the buyer. Fraud, undisclosed litigation with existential exposure, or a regulatory violation that could result in license revocation may justify walking away.

Practical Recommendations

Start with the highest-risk categories. In most private company acquisitions, the categories that produce the most deal-affecting findings are financial (quality of earnings), contracts (change-of-control and assignment provisions), IP (ownership chain), and employment (key employee retention and worker classification). Investigate those first.

Hire a transaction CPA for the quality of earnings analysis. Your company's regular accountant understands your business. A transaction CPA understands acquisitions and knows how to identify the add-backs, adjustments, and trends that affect valuation.

Don't just collect documents. Read them and connect the findings across categories. A customer contract that represents 30 percent of revenue (financial finding) that contains a change-of-control termination right (contract finding) and is managed by one employee who has no restrictive covenant (employment finding) is a compound risk that no single category review would fully capture.

Translate every finding into a deal term. A finding without a corresponding protection in the purchase agreement is just information. A finding with a specific indemnification, escrow holdback, purchase price adjustment, or closing condition is protection.