The Complete M&A Due Diligence Checklist (Buy-Side and Sell-Side)

Most M&A due diligence checklists on the internet are one of two things: a generic 15-item list written for a first-year business school student, or a 400-page Big Four framework built for public-company transactions. Neither is useful for the actual Houston lower-middle-market deals that make up the vast majority of M&A activity in Texas.

This checklist is what we actually work through on transactions in the $1M-$15M enterprise value range — the deals that happen every week between family-owned Houston businesses and strategic acquirers, PE-backed platforms, and independent sponsors. It's structured to be usable from both sides: buyers use it to know what to request; sellers use it to know what to prepare.

Bookmark it, share it, print it. It's the piece of writing we get the most requests for.

How to use this checklist

Every diligence request category below has three parts: - What to request (buyer perspective) / What to prepare (seller perspective) - Why it matters (what risk this category is trying to reduce) - Priority tier (Tier 1 = mandatory for any deal; Tier 2 = mandatory above certain size or complexity; Tier 3 = situational)

Scale the depth of diligence to the deal size. A $2M enterprise value deal does not need the same diligence intensity as a $10M deal — the diligence cost has to make sense against the deal size. A rigorous QoE report costs $15K-$25K; that's proportionally reasonable on a $5M+ deal and probably not on a $1.5M deal.

Category 1 — Financial diligence

Tier 1 (every deal): - Three years of monthly financial statements (P&L, balance sheet, cash flow statement) - Three years of federal and state income tax returns - Trial balance and general ledger detail for the most recent 12 months - Bank statements for the trailing 12 months - Accounts receivable aging as of the most recent month-end - Accounts payable aging as of the most recent month-end - Bank reconciliations for the trailing 12 months - Chart of accounts with mapping to the P&L structure - Owner add-back schedule with supporting documentation for each add-back - Compensation detail for all employees earning above the median - Related-party transactions (loans, leases, service agreements with owner-related entities) - Sales tax returns and payment records for the trailing 24 months - Fixed asset ledger with dates, cost basis, and depreciation methodology

Tier 2 (deals above ~$3M enterprise value): - Quality of earnings report by an independent accounting firm - Working capital analysis with proposed target working capital calculation - Revenue by customer for the trailing 36 months - Revenue by service/product line for the trailing 36 months - Analysis of one-time gains, losses, and unusual items - Detail on any capitalized expenses vs. what should have been expensed - Deferred revenue schedule and recognition policy - Inventory count records and valuation methodology (if inventory is material) - Purchase price allocation from any prior acquisitions

Tier 3 (situational): - Financial model with 3-5 year projections - Cost accounting detail for manufacturing businesses - Percentage-of-completion accounting detail for construction/project businesses - Segment reporting if the business operates in multiple lines

Category 2 — Legal diligence

Tier 1: - Corporate structure and organizational documents (articles, bylaws, operating agreements) - Capitalization table showing all ownership interests - Board and shareholder meeting minutes for the trailing 3 years - All active contracts (customer, vendor, employment, lease, licensing) - Change-of-control provisions in material contracts - Non-compete and non-solicit agreements with employees - Employment agreements with the top 10 employees - Independent contractor agreements - Real property leases and any owned property documentation - Equipment leases above material thresholds - IP assignment agreements from every employee who created code, designs, or other IP - Trademarks, patents, copyrights, and domain name registrations - Insurance policies (general liability, professional liability, workers comp, cyber, auto, umbrella) - Litigation and dispute history for the trailing 5 years - Regulatory correspondence with state/federal agencies - Confidentiality obligations from prior transactions or diligence processes

Tier 2: - Attorney-generated diligence summary and legal opinion - Environmental compliance history - Data privacy compliance (state privacy laws, industry-specific regulations) - Export control and sanctions compliance (if any international operations) - Franchise or dealer agreements (if applicable) - Consent requirements for the specific transaction structure being contemplated

Category 3 — Operational diligence

Tier 1: - Organizational chart with roles, tenure, and reporting relationships - Standard operating procedures for core delivery processes - Facility condition assessment and deferred maintenance list - Equipment inventory with age, condition, and replacement schedule - Vendor list with categorization by criticality - Backup vendors identified for critical single-source dependencies - Business continuity and disaster recovery plans - Safety record (OSHA logs, incident reports for trailing 3 years) - Insurance loss run for trailing 5 years

Tier 2: - Time studies or productivity metrics for key operational processes - Capacity utilization analysis - Quality control procedures and defect/return rates - Customer complaint log and resolution patterns - Service level agreements (internal) documenting operational commitments

Category 4 — Commercial diligence

Tier 1: - Customer list with revenue, tenure, and contract status - Top-20 customer analysis (concentration, contract expirations, renewal rates) - Sales pipeline as of most recent snapshot - Sales process documentation (lead sources, conversion metrics, sales cycle length) - Marketing spend breakdown and channel attribution - Competitive landscape assessment - Pricing history and margin analysis by customer/product line

Tier 2: - Customer interviews (with a subset of top customers, seller-approved) - Market research on industry trends and outlook - Third-party market study for larger transactions - Win/loss analysis on lost deals over the trailing 12 months

Category 5 — Human resources diligence

Tier 1: - Employee census (all employees with role, tenure, comp, benefits eligibility) - Employment policies and handbook - Payroll register for trailing 12 months - Benefits summary (health, retirement, PTO, other) - Workers compensation claims history - Discrimination or harassment complaint history - Terminations for cause in the trailing 3 years - Independent contractor classification review - Immigration compliance (I-9s, any visa sponsorship obligations)

Tier 2: - Retention risk analysis for top 5-10 employees - Compensation benchmarking against market rates - Union or labor organizing history (if applicable) - Post-close retention plan and communication strategy

Category 6 — Tax diligence

Tier 1: - Federal income tax returns for trailing 3 years - State income tax returns for all states where business operates - Sales and use tax returns and audit history - Payroll tax filings and any past-due amounts - Franchise tax filings - Property tax history and current assessments - Any current or historical tax audits or examinations - Nexus analysis for states where the business has activity but may not have filed

Tier 2: - Tax attribute analysis (NOLs, credits, basis) - Purchase price allocation analysis for the specific transaction structure - Section 338(h)(10) or 336(e) election analysis (if applicable) - International tax exposure (if applicable) - Estate and gift tax history (if related to a family-owned business)

Category 7 — IT and systems diligence

Tier 1: - Inventory of all business-critical software systems - Ownership of software (licensed vs. developed in-house) - Data storage and backup practices - Cybersecurity policies and incident history - Email and communication system architecture - Website and e-commerce platform ownership

Tier 2: - Third-party IT audit or penetration testing results - Data privacy compliance assessment - Cloud services vendor contracts and SLA review - Custom software architecture documentation - Technical debt assessment for buyers planning system consolidation

Category 8 — Environmental and regulatory diligence

Tier 1: - Environmental permits and compliance history - Hazardous materials use, storage, and disposal records - Underground storage tank documentation - Regulatory correspondence with EPA, TCEQ (Texas Commission on Environmental Quality), and any other relevant agencies

Tier 2: - Phase I Environmental Site Assessment for any owned real property - Phase II ESA if Phase I identifies concerns - Industry-specific regulatory compliance assessment (DOT, FDA, licensing boards, etc.) - Environmental litigation or enforcement history

The seller's disclosure schedule (mirror of the above)

For sellers, the same categories become a disclosure schedule attached to the purchase agreement. Everything a buyer identifies during diligence, the seller must accurately represent in the disclosure schedule. Misrepresentations become breach-of-representation claims, which trigger the indemnification and escrow mechanics in the definitive agreement.

The practical implication: sellers should assemble their data room in the same categories, in the same order, and cross-check that what's disclosed to the buyer matches what's represented in the agreement. A good sell-side advisor manages this cross-check as a core deliverable, because the alternative — an inconsistency between data room contents and disclosure schedule — is the source of most post-close indemnification disputes.

How to prioritize by deal size

Deals under $2M enterprise value: Financial Tier 1 + Legal Tier 1 + light Operational Tier 1. Skip QoE unless the earnings quality is genuinely uncertain. Full-scope diligence at this size costs proportionally too much.

Deals $2M-$5M: Add QoE report, Commercial diligence Tier 1, HR Tier 1. Legal Tier 2 selectively based on complexity. This is the sweet spot for structured but scaled diligence.

Deals $5M-$15M: Full Tier 1 across all 8 categories plus Tier 2 selectively based on the business (heavy Tier 2 for asset-heavy businesses, environmental, regulated industries). Third-party specialists engaged (environmental consultant if warranted, tax attorney for complex structures).

Deals above $15M: Everything Tier 1 and Tier 2. Multiple third-party specialists. Formal purchase price allocation analysis. Often includes rep and warranty insurance underwriting requirements.

Common diligence mistakes

Underestimating the time. Full diligence on a $5M deal typically takes 6-8 weeks in the data room. Buyers who assume 3 weeks routinely miss things or accept incomplete diligence findings.

Under-scoping the QoE. A QoE that only looks at the trailing 12 months misses seasonality and trends. A proper QoE covers 24-36 months.

Skipping customer interviews. For any deal above ~$3M, direct conversations with 3-5 top customers (with the seller's permission and coordination) surface information no data room can.

Waiting for a deal-breaking finding. Many diligence findings should trigger price renegotiation rather than deal termination. Buyers who treat every negative finding as a walk-away trigger miss deals; buyers who never renegotiate on findings overpay.

Sellers who slow-play the data room. Sellers who delay diligence responses signal something is being hidden. The best sell-side outcomes come from proactively populated data rooms where the buyer's diligence is faster than expected — the buyer walks away impressed and negotiates more favorably.

How Northbridge manages diligence

We treat diligence as a specific deliverable within a larger transaction engagement. On the buy side, we build the data request list, manage the diligence timeline, coordinate any third-party specialists (QoE firm, environmental consultant, tax attorney), and translate diligence findings into concrete negotiation positions on the definitive agreement.

On the sell side, we help assemble the data room in the categories buyers will actually request in the sequence they'll actually request them, coordinate the response to buyer diligence requests, and manage the disclosure schedule cross-check against the purchase agreement.

If you're planning a Houston buy-side or sell-side transaction in the next 12 months and want help thinking through diligence scope specifically — either the buyer's request list or the seller's data room prep — that's a productive scoping conversation to have now.

For related reading: the buy-side process from thesis to close (which places diligence within the broader transaction arc), the 12-month pre-sale readiness checklist (which frames the seller-side prep work), and how to read an EBITDA multiple (which explains why QoE findings translate directly to enterprise value).

Frequently Asked Questions

How long does M&A due diligence take?

Full diligence on a Houston lower-middle-market deal ($3M-$10M enterprise value) typically takes 6-8 weeks from data room access to substantive completion. Faster (3-4 weeks) is possible on smaller deals with clean data rooms and cooperative sellers; slower (10-14 weeks) is common when environmental issues, complex financials, or landlord/consent complications surface.

What are the main categories in a due diligence checklist?

Eight major categories: Financial (P&Ls, taxes, AR/AP, QoE), Legal (corporate docs, contracts, IP), Operational (facility, equipment, safety), Commercial (customers, sales pipeline, pricing), Human Resources (employees, benefits, retention), Tax (returns, nexus, audit history), IT/Systems (software, cybersecurity), and Environmental/Regulatory (permits, compliance).

Do I really need a Quality of Earnings report?

For deals above $3M enterprise value, almost always yes — the QoE typically identifies adjustments worth several times its cost. For deals $2M-$3M, needed if the accounting is complex or add-backs look aggressive. Below $1M, usually the cost proportion doesn't work. QoE catches revenue recognition issues, add-back overstatement, and working capital gaming that can otherwise cost you enterprise value at close.

What's the difference between buy-side and sell-side diligence?

Buy-side diligence is the buyer verifying what the seller represents — testing claims, requesting evidence, identifying risks. Sell-side diligence is the seller disclosing what buyers will verify — assembling data rooms, preparing supporting documentation, cross-checking disclosures against the definitive agreement. The categories are the same; the direction and purpose differ.

How much does M&A due diligence cost?

Direct costs vary by deal size and complexity. QoE reports run $10K-$75K depending on deal size. Legal diligence typically runs $15K-$50K. Environmental Phase I ESA (if needed) is $3K-$8K. Overall buy-side diligence costs for a $5M deal typically run $40K-$80K total; sell-side prep is less. These are dwarfed by the value the diligence protects or unlocks.

What are the most common due diligence findings?

Working capital normalization issues, customer concentration risk, add-back documentation gaps, deferred maintenance, IP assignment gaps (employees who created code/designs without signed IP agreements), sales tax nexus exposure, employment classification issues (independent contractors misclassified as employees), and environmental compliance gaps at owned facilities. Most translate to price adjustments rather than deal termination.