
Financial due diligence in 2026: the working capital peg that quietly moves the price
Financial due diligence in 2026: 3 pillars, a 6-week timeline, the working capital peg that costs more than EBITDA, and the data room for financial due diligence.
A quality of earnings report, usually shortened to QoE, is an independent accounting analysis that tests whether a company's reported EBITDA reflects sustainable, repeatable cash earnings. It is the single most influential document in a private company sale, because the multiple gets applied to whatever number it produces.
The trap in every QoE is the add-back. Sellers arrive with a list of costs they consider exceptional, providers test whether the items genuinely will not recur, and 10 to 30 percent of the list does not survive. At a 6x multiple that arithmetic is brutal, which is why the seller who understands the eight adjustment categories in advance negotiates from a different position than the one who meets them in week four of exclusivity.
The provider will ask for general ledgers, bank statements, payroll registers, and contracts in numbered waves, and the same records will later be reviewed by a buy-side team and a lender. A data room for a quality of earnings review keeps each of those parties in its own scope with its own question thread. Section 8 covers the setup step by step.
A quality of earnings report answers a narrower question than most sellers expect. It does not ask whether the financial statements are correct in an accounting sense. It asks whether the earnings a buyer is about to pay a multiple of will still be there next year, under new ownership, without the current owner's discretionary choices propping them up. Everything in the report serves that question.
The mechanism is normalization. The provider starts with reported EBITDA, then works through the general ledger, bank statements, and transaction-level detail to identify items that distort the run rate in either direction. Owner compensation above or below market, personal expenses run through the business, one-time legal settlements, non-cash items, revenue recognized in the wrong period, and costs that will not exist post-close all get adjusted. What comes out the other end is adjusted EBITDA, and that number is what the multiple is applied to.
The report also does two things that sit adjacent to earnings but change the cash price just as much. It builds a net working capital analysis, usually based on a trailing twelve month average, which becomes the peg used at closing to determine whether the buyer owes more or the seller owes a refund. And it produces a debt-like items schedule, capturing accrued liabilities, deferred revenue, capital lease obligations, unpaid taxes, and similar items that reduce equity value on a cash-free debt-free basis. Sellers who focus only on the EBITDA number are frequently surprised by how much these two schedules move the wire amount.
Because the provider must be independent to be credible, the work is done by transaction advisory teams at accounting firms rather than by the company's own accountants. That independence is the whole point: a buyer's lender will lend against a third-party QoE and will not lend against the seller's internal calculation.
The most common misunderstanding in a lower middle market sale is that an audit makes a QoE unnecessary. It does not, and the two documents answer different questions. An audit provides an opinion on whether historical financial statements are fairly presented in accordance with an accounting framework such as US GAAP or IFRS. It is backward-looking, framework-driven, and concerned with compliance. It says nothing about whether earnings are repeatable.
A quality of earnings report is forward-leaning. It takes the historical numbers, audited or not, and rebuilds them into a run rate a buyer can underwrite. An audited company can still have poor earnings quality: revenue concentrated in one customer, margins propped up by a supplier rebate that expires next year, or a founder taking no salary. None of that breaches an accounting standard, and all of it changes the price.
The two also differ in depth and access. Auditors sample; QoE providers work through transaction-level detail on monthly data across 3 to 5 years, reconcile revenue to cash receipts, and interview management about specific line items. An audit reports on a fiscal year; a QoE reports on a trailing twelve month period ending as close to the transaction as possible.
| Dimension | Audit | Quality of earnings |
|---|---|---|
| Core question | Are the statements fairly presented? | Are the earnings sustainable and repeatable? |
| Orientation | Backward-looking, compliance-driven | Run-rate, transaction-driven |
| Period | Fiscal year | 3 to 5 years monthly, plus TTM |
| Output | Opinion on the financial statements | Adjusted EBITDA, NWC peg, debt-like items |
| Typical cost | Varies by size and framework | $25,000 to $200,000 |
| Who commissions it | The company, often annually | Seller pre-market or buyer post-LOI |
Almost every QoE finding falls into one of a handful of categories, and knowing them in advance is what separates a seller who defends their number from one who watches it erode. The eight below account for the large majority of adjustments in lower middle market reports. Note that adjustments run in both directions: a provider that only ever reduces EBITDA is not doing the job properly, and legitimate add-backs frequently increase the number.
The single largest source of friction is add-back rejection. Sellers propose add-backs for anything they consider non-recurring; providers test whether the item genuinely will not recur. A "one-off" legal expense that has appeared in three consecutive years is not one-off. Across buy-side engagements it is common for 10 to 30 percent of proposed add-backs to be disallowed, and on aggressive sell-side memoranda the proportion can be higher.
Knowing the category is only half the work. What determines whether an adjustment survives is the evidence behind it, and the evidence is a document the seller either has in the data room on day one or spends three weeks assembling under time pressure. The mapping below is what a sell-side adviser should walk through before the room opens.
| Finding | How it surfaces | Evidence that defends it |
|---|---|---|
| Add-back labelled one-off recurs annually | 3 to 5 years of monthly general ledger detail | Nothing defends it, so reprice or reclassify as maintenance spend |
| Owner paid below market | Payroll register compared with a market rate for the role | A third-party compensation benchmark for the position |
| Personal expenses in the business | Transaction-level review of travel, vehicles, and payroll | Invoices and a signed schedule tying each item to the owner |
| Revenue recognized in the wrong period | Revenue reconciled to cash receipts and delivery dates | Delivery documentation and the contract's acceptance terms |
| Related-party rent below market | Lease compared with comparable market rents | An independent rental valuation for the property |
| Pro forma annualization of a mid-year win | Run-rate schedule tested against actual monthly revenue | The signed contract plus 3 or more months of actual billings |
The pattern in that table is that every defensible adjustment is defensible because of a document. That is why the seller who assembles the general ledger, the payroll register, and the contract file before the engagement starts keeps more of their EBITDA than the seller who produces them one wave at a time.
Both sides now commission QoE reports, and the difference in purpose changes what the report is for. A sell-side QoE is prepared before the business goes to market, on the seller's instruction, so the seller can find and fix problems before a buyer does. Its value is control: the seller learns that $600,000 of proposed add-backs will not survive scrutiny while there is still time to either document them properly or reset price expectations, rather than discovering it six weeks into exclusivity when renegotiating is the only option left.
A buy-side QoE is commissioned by the buyer after the letter of intent, as part of broader financial due diligence. Its purpose is verification and, frankly, leverage. It tests the seller's numbers, sizes working capital, and hunts for debt-like items, and its findings are the primary evidence in any retrade. A buyer's lender will usually require one before funding.
A well-executed sell-side QoE does not eliminate the buy-side report, but it narrows it. Buyers who receive a credible independent report from a recognized provider often scope their own work more tightly, which shortens the exclusivity period and reduces the number of surprises. In practice, a sell-side QoE costing $25,000 to $50,000 in the lower middle market frequently pays for itself by removing a single mid-process repricing.
One consequence is that the same general ledger gets read three times by three parties with different incentives: the seller's provider, the buyer's provider, and the lender's credit team. They should not share a link, they should not see each other's questions, and none of them should be able to tell how long the others spent in the file. That is a permissions problem, not a filing problem, and it is the main reason a data room for a quality of earnings review looks different from a folder of PDFs.

Three teams read the same general ledger during a QoE. Each one should have its own link, its own scope, and its own question thread.
Pricing scales with revenue, entity count, and how clean the books are. A single-entity business with $10 million of revenue on accrual accounting and a competent bookkeeper is a very different engagement from a five-entity group on cash basis with intercompany transactions and no monthly close. Across the market, QoE fees run roughly $25,000 to $200,000, with the low end covering lower middle market sell-side reports and the high end covering complex, multi-entity, multi-jurisdiction buy-side engagements with tax and IT workstreams attached.
Timelines are more consistent than fees. National middle-market firms typically deliver in 3 to 6 weeks; a full engagement including tax coordination runs 4 to 8 weeks. The variable that most often extends the timeline is not the provider's capacity but the speed of the document requests. A provider waiting on a general ledger export or bank statements will simply stop, and every week of delay in a post-LOI exclusivity period is a week of leverage lost.
| Engagement type | Typical fee | Typical timeline |
|---|---|---|
| Lower middle market sell-side QoE | $25,000 to $50,000 | 3 to 5 weeks |
| Mid-market sell-side QoE | $30,000 to $100,000 | 4 to 8 weeks |
| Buy-side QoE, single entity | $40,000 to $90,000 | 3 to 6 weeks |
| Buy-side QoE with tax and IT diligence | $90,000 to $200,000 | 6 to 10 weeks |
Larkspur Industrial Coatings is a family-owned specialty coatings business with revenue of $18.6 million and reported EBITDA of $2.9 million. The founder wants to sell and his adviser recommends a sell-side QoE before the confidential information memorandum goes out. The engagement costs $42,000 and takes five weeks.
The provider asks for 3 years of monthly profit and loss data, the general ledger, bank statements, the accounts receivable and payable ageing, the customer contract file, and the payroll register. Larkspur's controller uploads 240 documents. The findings are mixed. On the positive side, the founder pays himself $95,000 against a market rate of $240,000 for the role, so normalizing compensation reduces EBITDA by $145,000, but a genuinely non-recurring $210,000 environmental remediation cost gets added back, along with $88,000 of personal vehicle and travel expenses that are properly documented.
The damage comes from two other places. The provider rejects a proposed $195,000 add-back for "one-time" equipment refurbishment that has appeared in each of the last three years, and it reclassifies $130,000 of revenue that was recognized in December but not delivered until February. Adjusted EBITDA lands at $2.73 million, not the $3.2 million the founder had in his head.
Worked scenario. Upward adjustments of $298K are outweighed by $470K of downward ones, which is how reported EBITDA of $2.9M becomes adjusted EBITDA of $2.73M.

Larkspur's controller uploads 240 documents into the data room for the quality of earnings review before the engagement starts, which is why it finishes in five weeks rather than eight.
At the 6.5x multiple the adviser expects, that difference is worth $3.1 million of headline price. Because the report arrives before the process starts, the founder resets his expectations, spends four months documenting the refurbishment cycle as genuine maintenance capital expenditure, and fixes the revenue cut-off. The business goes to market with a defensible $2.73 million of adjusted EBITDA, and the eventual buyer's own QoE moves it by less than $40,000. There is no retrade.
A QoE rarely kills a deal outright. What it does is move money between the parties through four separate mechanisms, and sellers who understand all four negotiate better than sellers who fixate on the EBITDA line. The first is the headline price: at a 6x multiple, every $100,000 of EBITDA removed cuts $600,000 from enterprise value. The second is the working capital peg, where a target set from a trailing twelve month average rather than a favourable month-end can move the closing wire by hundreds of thousands of dollars.
The third mechanism is debt-like items. Deferred revenue, accrued bonuses, unfunded pension obligations, capital leases, and unpaid sales taxes all reduce the equity price on a cash-free debt-free basis, and disputes over what counts as debt-like are among the most common late-stage arguments in a sale process. The fourth is structure. When a QoE identifies genuine uncertainty rather than a clear error, the usual resolution is not a price cut but an earn-out, an escrow, or a specific indemnity that shifts the risk back to the seller rather than repricing the whole deal.
A data room for a quality of earnings review is the most document-intensive room in a transaction and the one with the shortest fuse. The provider wants general ledgers, bank statements, payroll registers, customer contracts, and monthly management accounts across 3 to 5 years, requested in numbered waves as each answer produces the next question, and every day the request list sits unanswered is a day of exclusivity spent.
Papermark is a secure, fully customizable, and developer-friendly data room built for modern dealmakers, with page-by-page analytics, dynamic watermarking, and transparent pricing (open-source and self-hosting available).

A data room for a quality of earnings review, with the financial records in their own scoped folder set.
A QoE is not a normal diligence workstream. Four features of it make a dedicated room worth the setup. If you are still choosing a platform, our comparison of the best virtual data rooms covers pricing model, bidder management and compliance across the main providers.
The same records get read by three competing parties. The seller's provider, the buyer's provider, and the lender's credit team all work through the identical general ledger, and their interests are opposed. None of them should see the others' questions, and none should be able to infer from activity how long a rival team spent on the receivables ageing. One shared folder cannot do that; a data room for a quality of earnings review with a link per party can.
Requests arrive in waves, not as a list. A provider asks for the payroll register, reads it, then asks for the three bonus agreements it references. Across a five-week engagement a controller can easily be holding 60 open items at once, and an email thread that runs through the controller, the CFO, and two advisers loses items silently. The failure mode is not a dramatic one, it is a question answered twice, differently.
The financial records are the most sensitive files in the deal. Customer-level revenue detail and pricing schedules are exactly what a competitor would want, and in a broken process they end up on a laptop belonging to a buyer who walked away. View-only access and watermarking on the contract file are the standard answer.
Adjustments get disputed after the fact. When a working capital true-up is argued 60 to 90 days after close, the useful evidence is which schedule the provider opened, on what date, and for how long. A page-level log per visitor produces that in minutes.
The rest of this section is the practical build: five steps to a data room for a quality of earnings review that survives all four.
Almost every QoE first wave is the same, so build the folder and populate it before the provider is even appointed: 3 to 5 years of monthly profit and loss, balance sheet and cash flow, the general ledger and trial balance as exports rather than PDFs, bank statements for every operating account, receivables and payables ageing, the payroll register, and the top 20 customer contracts.
Automatic file indexing on the Data Rooms Plus plan numbers and maintains the index as documents arrive, which is what keeps the room's numbering consistent with the exhibit references in the final report. Larkspur's controller loaded 240 documents this way and the engagement closed in five weeks rather than eight.
The QoE provider needs deep access to the accounting records and no access at all to the legal folder, the employee files, or the buyer's own materials.
| Reviewer | Folders granted | Rights |
|---|---|---|
| Sell-side QoE provider | General ledger, bank, payroll, ageing, contracts | View and download |
| Buy-side QoE provider | Same financial folders, opened post-LOI | View and download |
| Lender credit team | Summary financials, ageing, covenant model | View only |
| Tax adviser | Tax returns, payroll, entity structure | View only |
| Seller's controller | All financial folders plus upload rights | Full control |
Granular file-level permissions are set per link rather than per user, and access is link-based, so no provider has to create an account. Each link carries its own email or domain allowlist, so a departing analyst at the advisory firm loses access when the allowlist changes rather than when someone remembers.

Permissions are set per link, so the QoE provider reads the general ledger and never sees the legal or employee folders.
Set the customer contract file and the revenue-by-customer schedules to view-only and turn on dynamic watermarking, which renders the viewer's email, IP address, and timestamp onto every page as it is displayed. Summary financials can stay downloadable, because a buyer's analyst genuinely needs to model from them.
Be honest about the limit. Once a file has been downloaded it is legally treated as read and no data room can recall it, which is precisely why download is switched off on the pricing schedules rather than merely discouraged, and why watermarking exists at all: it makes a leak attributable to a named viewer.

Watermarking the customer contract file is what most sellers ask for before agreeing to upload it at all.
This is where a QoE room earns its subscription. The Q&A module attaches each information request to the document that prompted it, with permissions controlling who sees which threads, so the buy-side provider never reads the sell-side provider's questions.
Request files lets the provider ask the controller for a missing general ledger export inside the room instead of by email, and new-document notifications tell them the moment it lands. On a five-week engagement, closing the loop on a request in an hour instead of a day is worth roughly a week of calendar.
Page-by-page analytics per visitor per session show exactly which schedules the QoE team reviewed and for how long. That is early warning as much as evidence: a provider who has spent forty minutes in the deferred revenue schedule is about to propose a debt-like item, and you have a week to prepare the counter-argument.

Page-by-page analytics show which financial schedules the quality of earnings team opened and how long they spent on each.
After the report lands, data room freeze makes the contents immutable and exports the room as an archived ZIP with a certificate. When the working capital true-up is settled 60 to 90 days after close, that archive is the record of what the provider was given and when.

Papermark is our #1 VDR provider for M&A transactions right now. In two deals we used custom branding, dynamic watermarking, and granular permissions.
Tyler
The Data Rooms plan is €99/month with a 7-day free trial and includes 3 team members, unlimited data rooms, unlimited documents with no file size limit, a custom domain, dynamic watermarking, NDA agreements, and granular file-level permissions. Data Rooms Plus at €249/month adds 5 team members, the Q&A module, the audit log, automatic file indexing, and SOC 2 Type II, which is the tier a QoE actually needs because the request waves run through Q&A. Premium at €549/month adds 10 members, API access, SSO, and whitelabeling.
Set against a QoE fee of $25,000 to $200,000, the room is a rounding error, and flat pricing means a five-week engagement generating 240 documents does not produce a per-page invoice the way legacy providers billing by page or gigabyte do.
No credit card required.