Buying a Business Online: Due Diligence Checklist & Red Flags (2026)

Red flag: Significant one-time project revenue masking declining recurring subscription or service income, or unexplained large revenue spikes/drops.

Ask: Can you provide detailed monthly revenue breakdowns by service type for the past three years, specifically separating recurring from one-time project revenue?

Red flag: CAC significantly exceeding LTV, indicating an unsustainable marketing spend or poor customer retention.

Ask: What are your average customer acquisition costs, and how do you track the lifetime value of your customers across different acquisition channels?

Red flag: Critical software licenses expiring or non-transferable, leading to immediate substantial re-platforming costs.

Ask: Please provide a complete list of all mission-critical software, platforms, and SaaS subscriptions, including their contract terms, costs, and transferability.

Red flag: Large, fluctuating contractor expenses that are critical to daily operations and could signal a misclassified employee risk or dependency on a single individual.

Ask: Can you provide detailed payroll records and a breakdown of all contractor expenses for the last two years, along with the nature of their services?

Red flag: Undocumented custom code, reliance on outdated technologies, or a 'sole developer' who holds all institutional knowledge.

Ask: Please provide an overview of your entire technology stack, including custom code, third-party integrations, and available technical documentation.

Red flag: High customer churn rates, long resolution times, or an over-reliance on the owner for all customer interactions.

Ask: Describe your standard operating procedures for customer support, service delivery, and issue resolution, including average response times and customer satisfaction metrics.

Red flag: No established CRM or marketing automation, or an underutilized system with no clear strategy for lead nurturing and client engagement.

Ask: What CRM and marketing automation platforms do you use, and can you share an overview of your current marketing funnels and lead management processes?

Red flag: Lack of clear, trackable KPIs, no analytics platform integrated, or data showing significant performance declines not addressed by management.

Ask: What are the core KPIs you track for business performance, and what analytics platforms do you use to monitor these metrics?

Red flag: An intensely competitive market with no discernible moat, or a niche that is rapidly shrinking due to technological shifts.

Ask: Who are your primary competitors, and what unique value proposition distinguishes your business in the market?

Red flag: More than 10-15% of total revenue derived from a single client, creating significant dependency and risk if that client leaves.

Ask: Can you provide a client roster showing the percentage of revenue contributed by your top 10 customers over the past two years?

Red flag: Negative online reviews, unaddressed customer complaints, or a weak/non-existent social media presence or SEO performance.

Ask: What is your strategy for managing online reputation and brand presence, and what tools do you use to monitor these?

Red flag: The business appears to have plateaued with no clear avenues for future growth without significant capital injection or re-invention.

Ask: What growth avenues do you see for this business in the next 3-5 years, both geographic and service-offering wise?

Red flag: Key software, algorithms, or brand assets not fully owned by the business, or difficulty in securing full IP transfer.

Ask: Please provide documentation proving ownership of all intellectual property, including trademarks, copyrights, and custom code, and confirm their transferability.

Red flag: Lack of clear data privacy policies, history of data breaches, or non-compliance with relevant regulations that could result in heavy fines.

Ask: What measures are in place to ensure compliance with data privacy regulations like GDPR, CCPA, and industry-specific acts?

Red flag: Ambiguous SLAs, onerous penalty clauses, or contracts that are easily terminable without cause by clients.

Ask: Can I review samples of your standard client contracts and any existing Service-Level Agreements with key customers?

Red flag: Lack of proper employment agreements, unenforceable non-competes, or critical staff not bound by confidentiality.

Ask: Do you have standardized employment and contractor agreements, and do they include appropriate confidentiality and intellectual property clauses?

Red flag: No documented processes, reliance on tribal knowledge, or an owner who has not delegated critical tasks.

Ask: Can you outline your proposed knowledge transfer plan for all critical operational systems, client relationships, and technological infrastructure?

Red flag: Significant staff turnover risk post-acquisition, especially among critical development or client-facing roles.

Ask: What incentives or assurances can be put in place to ensure the retention of key team members post-acquisition?

Red flag: No defined plan for introducing the new owner to clients, risking client churn due to uncertainty.

Ask: How do you propose we communicate the change of ownership to existing clients to ensure a smooth transition and retention?

Red flag: Critical vendor contracts non-transferable or expiring soon, requiring immediate renegotiation.

Ask: Please identify all critical vendors and partners, and describe the process for formally transferring these relationships and accounts.