What diligence requests should you expect when selling your business?

Why diligence requests arrive in waves

A buyer is not asking for one universal folder. Requests usually expand as the buyer tests an initial understanding of the business, identifies gaps, and evaluates whether a proposed transaction can be completed on acceptable terms. Early questions may concern revenue, customers, owners, locations, employees, and major contracts. Later questions can become more granular, such as transaction-level sales data, supporting schedules, customer concentration, working-capital details, intellectual property ownership, or correspondence about a dispute.

Treat the request list as a controlled workflow rather than a demand to upload everything at once. The request itself should have a business reason, an accountable owner, a due date, a sensitivity level, and a response status. If a question is unclear, ask the buyer to identify the decision the information is intended to support. That clarification can prevent unnecessary disclosure and make the answer easier to review.

Financial and tax records

Financial requests often start with income statements, balance sheets, cash-flow information, bank statements, general ledgers, accounts receivable and payable aging, budgets, and explanations for unusual items. Buyers may also ask for reconciliations between management reporting and filed financial statements, details of owner compensation, add-backs, debt, leases, capital spending, inventory, and one-time costs. The goal is to understand how reported performance was produced and which assumptions should be tested.

Use the accounting system and filed or accountant-prepared records as the source of truth, then have the owner or controller explain differences rather than silently changing a schedule. The IRS says business books should clearly show income and expenses, and identifies supporting documents such as sales records, invoices, receipts, deposits, checks, payroll records, and asset records. Electronic records are subject to the same basic recordkeeping principles as paper records. [1] Do not label a management adjustment as normalized or recurring without documenting the basis and obtaining appropriate professional review.

A useful response pairs each summary with its underlying support and a short explanation of limitations. If a requested period is incomplete, say so. If the business uses a nonstandard metric, define it and reconcile it to the underlying records. Tax returns, tax correspondence, sales-tax filings, payroll-tax records, and notices may be sensitive, so coordinate disclosure with the relevant tax professional.

Customers, revenue, and commercial relationships

Expect questions about the customer list, revenue by customer or product, retention, renewals, backlog, pricing, discounts, refunds, concentration, sales pipeline, and the terms that make revenue repeatable or at risk. A buyer may ask to sample invoices, contracts, order forms, credit notes, and customer correspondence. The request may also cover channel partners, suppliers, and dependencies that affect delivery or margins.

The operations or commercial owner should prepare an index that explains the period, fields, and definitions. Check that customer names, account IDs, invoice totals, and reported revenue reconcile. Remove duplicate rows and flag estimates, canceled orders, disputed amounts, and incomplete periods. Do not send a raw export merely because it is easy to produce. Where identities or contact details are not needed, use codes, aggregation, or redaction and preserve a separate controlled mapping if counsel recommends it.

If the buyer is a competitor or the information is competitively sensitive, apply heightened controls. FTC guidance recommends sharing the least information needed, masking customer identities, aggregating competitive information, using redactions, and considering clean teams or independent consultants. It also recommends monitoring protocols and following destruction instructions if the process ends. [2] The right control depends on the facts and applicable legal advice, so involve counsel before sharing current prices, customer-specific terms, strategic plans, or other sensitive material.

Operations, people, and safety

Operational diligence can cover the organization chart, key-person dependencies, facilities, equipment, suppliers, production or service processes, quality controls, inventory, licenses, permits, insurance, cybersecurity practices, and business-continuity plans. Buyers want to know how the business functions without relying on one undocumented person or a process that cannot be transferred. Assign each topic to the manager who operates it, while one coordinator keeps the answer consistent.

Employment requests may include role and compensation summaries, benefit plans, contractor arrangements, employment agreements, incentive plans, turnover, open positions, policies, claims, and required workplace records. Protect personal information and provide aggregated or redacted data when individual identity is not necessary. OSHA explains that many employers with more than 10 employees must record qualifying work-related injuries and illnesses, subject to industry exemptions, and that other reporting and electronic-submission duties depend on the applicable rule. [3] Do not assume a federal recordkeeping statement answers every state or industry question.

For each operational answer, identify the record owner, the date last checked, and any known gap. If a key employee must explain a process, schedule that discussion deliberately rather than allowing unscheduled buyer contact to interrupt daily work. The owner should review statements about continuity, capacity, compliance, and future performance before they are released.

Contracts, legal matters, and intellectual property

Expect requests for material customer and supplier contracts, leases, loan documents, licenses, permits, insurance policies, guarantees, change-of-control clauses, exclusivity provisions, litigation, claims, threatened disputes, settlements, and government correspondence. Intellectual property requests may include registrations, assignments, licenses, open-source policies, domain ownership, inventions, software development agreements, and restrictions on use. The relevant documents may be spread across legal, finance, operations, and personal email accounts, so start with a source inventory.

A legal owner should classify each item as available, missing, expired, restricted, or requiring interpretation. Do not summarize a contract clause from memory when the buyer needs the signed document. Check amendments, renewals, side letters, waivers, and notices. If a document contains attorney-client communications or work product, do not make a privilege judgment casually. Ask qualified counsel how to handle it and what may be disclosed under the applicable law and transaction process.

The response should distinguish an existing obligation from a possible issue. It should also identify whether consent, notice, assignment, or third-party approval may be relevant without asserting that a particular legal result is guaranteed. Jurisdiction, contract language, transaction structure, and facts can change the analysis.

Technology, data, and security questions

Technology diligence may cover systems used to deliver the product or service, software ownership, hosting, vendor agreements, access controls, backups, incident history, data flows, privacy notices, and continuity procedures. Buyers may ask for architecture diagrams, policies, penetration-test summaries, vulnerability remediation, or evidence that the business can transfer accounts and licenses. The responsible technology owner should answer from current records and state what has not been tested.

Avoid handing over credentials, unnecessary personal data, secrets, or unrestricted production access. Use a controlled, read-only or redacted method where appropriate, and confirm who may access the material. If an answer depends on a vendor, identify the vendor record and ask the vendor or qualified adviser to confirm the relevant point. A checklist or automated extraction can help find missing documents, but a human owner must validate the result before disclosure.

A practical stopping condition is reached when the buyer's stated question is answered with the minimum necessary evidence, the source and date are recorded, and any exception is clearly described. If a tool produces uncertain matches or conflicting records, stop and resolve the conflict rather than presenting the output as verified.

Property, environmental, and regulatory exposure

For a business that owns, leases, operates, or formerly used property, expect questions about deeds or leases, zoning, permits, inspections, environmental reports, waste handling, notices, remediation, and known contamination. The scope depends on the business and property. EPA describes All Appropriate Inquiries as an evaluation of a property's environmental conditions and potential contamination liability, involving items such as interviews, historical and government records, visual inspection, data gaps, and a written report. [4] That federal framework is not a universal checklist for every sale, and state or local requirements may differ.

Assign property and regulatory questions to the facilities or compliance owner, then have the relevant professional review conclusions. Provide reports as they exist, including limitations, dates, and recommendations for additional investigation. Do not describe an environmental condition as cleared, harmless, or immaterial unless a qualified professional and the applicable facts support that statement. The same discipline applies to licenses, permits, inspections, and regulatory correspondence.

How to stage responses without losing control

A workable sequence is to prepare an internal request register, answer easy high-confidence items first, and hold sensitive or interpretive items for a defined review path. For every request, record the exact question, category, owner, source record, sensitivity, reviewer, submission date, buyer follow-up, and final status. Use a versioned response folder so the team can tell which file was provided and whether a later version superseded it.

At the start, confirm the confidentiality agreement, permitted recipients, download rules, retention or destruction terms, and whether the buyer is a competitor. Release high-level information before customer-level, employee-level, or competitively sensitive detail when the process allows. If the buyer changes scope, record the change rather than allowing an informal message to become an undocumented disclosure. Pause when a request seeks more data than its stated purpose requires, conflicts with a confidentiality restriction, or cannot be verified.

The business owner should approve factual representations about the company. Accountants, attorneys, tax professionals, environmental professionals, and technology specialists should handle issues that require their expertise. The owner should not promise that a record is complete, compliant, transferable, or free of risk unless the available evidence and qualified review support that wording.

A repeatable owner workflow

Use this five-step workflow for each new request: define the question, identify the source of truth, assign the accountable owner, verify and limit the response, and record what was sent. Define means translating a broad request into a specific period, entity, document, or data field. Source of truth means naming the ledger, contract repository, policy file, report, or other record that supports the answer. Accountability means one person owns completion even if several people contribute.

Verification includes checking dates, totals, definitions, amendments, duplicates, missing periods, and contradictions with earlier responses. Limiting means removing unnecessary personal or competitively sensitive information, applying the agreed access controls, and using a qualified reviewer where the issue is legal, tax, environmental, or technical. Recording means preserving the request, response, reviewer, date, version, qualification, and follow-up.

Acquivo is a software platform that delivers the entire sell-side M&A process, valuation, marketing materials, buyer matching, and deal management, on one platform for business owners, M&A attorneys, and boutique investment banks. Acquivo gives business owners the entire sell-side process an investment bank would run, as software, with no success fee. The software is user-operated. It does not represent the seller, provide legal or tax advice, negotiate for the seller, or approve disclosures. Use the workflow as a coordination framework and obtain professional advice for issues specific to the transaction.