Most acquisition deals that collapse don't fail because the business was bad. They fail because the buyer discovered something they weren't expecting — not necessarily a dealbreaker in isolation, but enough to erode confidence. Due diligence isn't about finding reasons to walk away. It's about entering negotiations with your eyes open and paying a price that reflects reality, not the seller's pitch.
Key Takeaways
- Always verify financial metrics against primary sources — bank statements and payment processor data, not seller-provided dashboards
- Technical and legal issues discovered late in a deal are the most expensive — investigate them early
- Founder dependency is the most underestimated risk in small startup acquisitions
Before You Start
Due diligence has a cost — your time, potentially an advisor's fees, and the relationship capital you spend asking hard questions. Run it on businesses you're genuinely serious about. A lightweight pass on financials and a call with the founder is fine for initial screening. The depth below is what you deploy once you've signed an LOI and you're moving toward a close.
Request everything in writing, via the platform's secure document channel. Verbal reassurances are worth nothing if they're wrong.
1. Financial Due Diligence
The starting point and the most commonly misrepresented area. Your goal here isn't to audit the business — it's to verify that the numbers you're paying for are real.
Revenue & Metrics
- Cross-reference MRR/ARR figures against actual bank statements or Stripe/payment processor exports — not the seller's dashboard
- Review 24 months of revenue history; look specifically for anomalies in the months leading up to listing
- Confirm how churn is calculated — there's significant room for methodology to flatter the number
- Validate CAC and LTV calculations; ask for the raw inputs, not just the outputs
- Check for deferred revenue, prepaid annual contracts, or one-time payments that inflate MRR
Expenses & Profitability
- Full P&L for the last two to three years — not just a summary
- Owner compensation, personal expenses run through the business, and other add-backs should be explicitly documented
- Infrastructure and tooling costs (cloud, SaaS subscriptions, APIs) — confirm these are sustainable at current scale
- Contractor or freelancer costs that a new owner would need to absorb
Cash & Liabilities
- Current cash balance and monthly burn rate
- Any outstanding loans, investor notes, or lines of credit
- Accounts payable and outstanding invoices — these become your problem at close
- Confirm tax filings are current; ask for the last two years of returns
Watch For
A sudden spike in revenue in the three months before listing is a significant red flag. Always trace the source. Legitimate growth is explainable; manufactured growth rarely survives scrutiny.
2. Technical Due Diligence
You don't need to be an engineer to run technical due diligence — but you do need someone who is. The cost of a technical review session is trivial compared to the cost of inheriting a codebase that requires six months of remediation before it can scale.
Codebase & Infrastructure
- Engage a technical advisor (or use your own engineer) to review code quality and architecture
- Identify technical debt and get a realistic estimate of what it would cost to address
- Confirm deployment and DevOps processes are documented, not tribal knowledge
- Review uptime history and any history of outages or SLA failures
- Assess whether the infrastructure can handle meaningful growth without a rebuild
Security & Compliance
- Data storage and handling practices — GDPR, CCPA, SOC 2 compliance where relevant
- History of security incidents or data breaches; ask directly and verify
- Third-party dependencies, open source licenses, and any GPL-licensed code that may restrict your use
- API key and credential management — hardcoded secrets in the codebase are a material risk
3. Customer & Market Due Diligence
Financials tell you what happened. Customer conversations tell you what's likely to happen next. This is where you get signal on churn risk, customer sentiment, and whether the business is genuinely beloved or just sticky.
Customer Validation
- Review the top 10–20 customer contracts and their renewal status
- Request three to five customer reference calls — and actually conduct them; the conversations are almost always revealing
- Review NPS scores and support ticket history for patterns
- Identify any customers flagged as at risk and understand why
Market Position
- Name the top three competitors and understand what the differentiation genuinely is — not just the seller's version of it
- Is the addressable market growing, flat, or contracting?
- Does the business have genuine moats — switching costs, network effects, proprietary data, or strong distribution?
"The goal of due diligence is not to find a reason to walk away. It's to confirm you're paying a fair price for what you're actually getting — and to understand exactly what you're taking on."
Michael Chen, Acquisitions Lead
4. Legal Due Diligence
Legal issues are the most expensive to fix post-acquisition. Most of what's below can be verified quickly if the seller is organised — and takes weeks to untangle if they're not.
- Company incorporation documents and full cap table — confirm there are no surprise shareholders or promised equity
- IP ownership: all code, content, and brand assets should be unambiguously owned by the company, not contractors or former employees
- Trademark and domain registrations — in the company's name, not the founder's personal name
- Existing customer contracts: review for unusual terms, auto-renewal clauses, change-of-control provisions, or exclusivity that would transfer to you
- Any pending or threatened litigation — ask directly and get it in writing
- Employee and contractor agreements — IP assignment clauses must be in place for everyone who has written code or created content
5. Team & Operations
This is where small startup acquisitions most often surprise buyers. If the business runs because the founder is extraordinary — their relationships, their instincts, their personal reputation — then you're not buying a business. You're buying a job, and a complicated one.
- Identify every key person and understand explicitly what happens to the business if they leave at close
- Is there a team, or is everything founder-run?
- Are all critical processes documented, or does the institutional knowledge live in someone's head?
- Review employment agreements, non-competes, and any earn-out arrangements carefully
- Ask the founder what they're doing after the sale — their answer tells you a lot about their commitment to a clean transition
Red Flags That Should Give You Pause
- Reluctance to provide bank statements or payment processor access — dashboards can be manipulated, primary sources cannot
- Metrics presented only in the seller's own format, with no way to independently verify the inputs
- Revenue concentrated in one or two customers — ask what their renewal conversation looks like right now
- All key customer relationships owned personally by the founder, with no team layer underneath
- Unresolved legal disputes, even minor ones — they have a way of becoming your problem
- Revenue that spiked in the quarter before listing with an explanation that doesn't fully add up
How to Use This Checklist
Don't treat this as a pass/fail test. Every business has imperfections. The question isn't whether issues exist — it's whether they're priced in, whether they're fixable, and whether you're the right person to fix them.
Use Acquirly's NDA and document request tools to manage the information flow. Keep a running record of what you've requested, what you've received, and what's outstanding. Organised buyers close better deals — sellers are more confident, negotiation is cleaner, and surprises are rare.
The work you put in before signing is the best investment you'll make in the acquisition.