Small business due diligence in 2026: which owner add-backs actually survive?

Small business due diligence is the buyer's review of a company priced roughly between $500,000 and $10M, where the financials are unaudited, the owner is the business, and the seller has never run a process before. It is a different exercise from mid-market diligence, and treating it like one is how buyers overpay.

Quick recap

• Small business due diligence covers 9 areas: financial, tax, revenue and customers, owner dependence, employees, contracts and leases, licences and permits, legal, and assets.
• Main street businesses are valued on seller's discretionary earnings rather than EBITDA, because the owner's salary, vehicle, phone, travel, and family payroll all run through the accounts.
• Buy-side quality of earnings providers commonly disallow 10 to 30 percent of the add-backs a seller proposes, and at a 4x multiple every $50,000 disallowed removes $200,000 of price.
• A quality of earnings engagement on a $5M deal runs roughly $35,000 to $60,000, about 1 percent of the purchase price.
• In the US, SBA 7(a) loans cap at $5M per borrower and require a minimum 10 percent equity injection on a change of ownership; a seller note counts toward it only if held on full standby for at least 24 months.
• Customer concentration is the most common repricing trigger in small business deals, and any customer above 20 percent of revenue usually gets handled with an earnout or a holdback rather than with price alone.
• Owner dependence is measured by what breaks when the owner leaves: customer relationships, pricing authority, technical skill, and licences held in the owner's personal name.
• Most sellers arrive with 3 years of tax returns, a QuickBooks file, and no organised contracts folder, so the buyer's request list has to be sequenced rather than sent as a 200-line questionnaire.
• Leases, licences, and key customer contracts often contain change-of-control or assignment clauses, and in an asset sale each one needs consent that the seller must request.
• A data room for small business due diligence keeps the lender, the accountant, and the attorney on separate links over the same document set, from €99/month with Papermark.

Buying a small business is the only transaction where the buyer, the lender, the accountant, and the attorney all rely on the same three tax returns, and where the seller's own record-keeping is the binding constraint on the timetable. This guide covers the nine review areas, how to test add-backs and owner dependence, what the SBA lender needs and when, and how to run the whole thing without a shared Dropbox folder that everyone can see.

Small deals still have four counterparties, and one of them is your lender. A data room for small business due diligence gives each of them one scoped link instead of one shared folder. Section 9 covers the setup step by step.

Start 7-day data room trial

1. What small business due diligence actually covers

Small business due diligence is the confirmatory review a buyer runs between the signed letter of intent and closing, on a business that is usually owner-operated, usually unaudited, and usually being sold once in the owner's lifetime. The purpose is the same as in any deal: confirm that the earnings are real, that they will continue without the seller, and that nothing transfers with the business that the buyer has not priced.

What differs is the evidence. A mid-market target hands over audited statements, a board pack, a contract register, and a data room built by an advisor. A main street business hands over three years of tax returns, a QuickBooks file the bookkeeper maintains, a lease, and a filing cabinet. The buyer is not verifying an existing record so much as constructing one, and the diligence plan has to reflect that.

The second difference is the owner. In a mid-market business, management is a layer you assess. In a small business, the owner is frequently the sales function, the pricing authority, the technical expert, and the licence holder all at once. That means owner dependence is not one item on a checklist; it is the question the entire review is trying to answer, and every other finding is read in that light.

The third difference is the lender. Most small business acquisitions are financed, and in the United States that usually means an SBA 7(a) loan. The lender runs its own diligence in parallel, on its own timetable, and it will ask the seller for documents the buyer has already collected. Sequencing those requests so the seller is not asked for the same tax return three times is a real part of the job.

2. The 9 review areas

The nine areas below are the standard scope for a small business acquisition. On a $2M deal a buyer can reasonably work through all nine in four to six weeks with an accountant and an attorney. On a $500,000 deal the same list applies, but the depth in each area is proportionate.

Financial and tax come first, because everything else is read against the earnings number. Revenue and customers come next, because a business with one customer at 45 percent of revenue is a different asset from one with 400 customers, whatever the earnings say. Owner dependence, employees, and contracts follow, and licences and legal close the list.

Two of the nine deserve extra attention on almost every deal. Licences and permits, because a business operating under a licence held personally by the seller does not transfer that licence with the assets, and the buyer may need months and an examination to obtain their own. And assets, because a small business under a retiring owner is frequently under-maintained: vehicles at the end of their life, equipment past its service interval, and a first-year capital requirement nobody put in the model.

3. From tax returns to seller's discretionary earnings

Main street businesses are priced off seller's discretionary earnings, which is net profit before the owner's compensation and before the personal and one-off costs that run through a private company's books. The logic is that a new owner will not spend money the same way, so the buyer wants to know what the business produces before the current owner's choices.

The bridge from a tax return to that number is a list of add-backs, and it is where nearly every dispute in a small business acquisition begins. Sellers and brokers propose a generous list. Buy-side reviewers test whether each item genuinely will not recur under new ownership, and it is common for 10 to 30 percent of a proposed list to be disallowed. At the 3x to 4x multiples typical of main street deals, every $50,000 that fails the test removes $150,000 to $200,000 from the price.

The most valuable check in the whole review costs nothing: reconcile bank deposits to reported revenue for a sample of months. A cash-heavy business with reported revenue that does not tie to deposits has either unrecorded revenue, which the buyer cannot pay for because it cannot be financed or defended, or a bookkeeping problem, which is its own finding. Sellers occasionally volunteer the first as a positive. It is not one.

For anything above roughly $2M of purchase price, a formal quality of earnings engagement pays for itself. On a $5M deal that runs roughly $35,000 to $60,000, about 1 percent of the price, and it routinely finds adjustments worth several times that. It also gives the lender confidence, which matters when SBA underwriting is on the critical path.

4. Owner dependence and customer concentration

These are the two findings that most often change a small business deal, and neither one shows up in the financial statements.

Owner dependence is best measured by a simple question asked in four ways. Who do the customers call? Who sets prices and approves discounts? Who can do the technical work if the senior technician leaves? And whose name is on the licence the business operates under? A business where the answer to all four is the seller is not a business the buyer can run from day one, whatever the earnings are.

The remedies are structural rather than financial. A transition period of three to six months in which the seller stays on, a consulting agreement running twelve months at a defined rate, a non-compete with a real geographic and time scope, and a portion of the price deferred into a seller note that keeps the seller interested in the handover all address the same risk from different angles. A buyer who identifies owner dependence and then prices it at full multiple anyway has identified nothing.

Each counterparty gets its own link, so the lender's view of the room is not the accountant's view.

Customer concentration is measurable and therefore easier to argue about. Pull revenue by customer for three years, not one, because the shape over time matters more than the snapshot. A customer at 25 percent of revenue that has been at 25 percent for a decade under a written contract is a different risk from one that arrived eighteen months ago on a handshake. Then ask who at the customer holds the relationship, whether there is a contract, when it renews, and whether it contains a change-of-control clause.

The usual handling is structural too. Concentration above 20 percent typically gets addressed with an earnout tied to that customer's retention, a holdback released after twelve months, or a specific indemnity. What it should never get is silence, because concentration is the single most common reason a small business acquisition disappoints in year two.

5. Contracts, leases, and licences: what does not transfer

Most small business acquisitions are structured as asset purchases, which is good for the buyer on liabilities and bad for the buyer on continuity. In an asset sale, nothing transfers automatically. Every customer contract, supplier agreement, lease, and licence moves only if it can be assigned, and many require the counterparty's written consent.

The premises lease is usually the most urgent item, because a service business with a route-based customer base can move, and a restaurant, a gym, or a manufacturer generally cannot. Read the assignment clause, find out how much notice the landlord requires, and confirm the remaining term. A lease with 18 months left and no renewal option on a business whose entire value sits in its location is a diligence finding, not a formality, and the fix is negotiated with the landlord before closing rather than after.

Licences are the item most often discovered late. If the seller personally holds the contractor, liquor, health, or professional licence the business trades under, the entity does not hold it and the buyer cannot inherit it. In some trades that is solved by employing a qualified individual; in others the buyer has to qualify personally, which can take months. Ask on day one who holds every licence, in whose name, and what the renewal date is.

6. What the lender needs, and when

If the deal is financed, the lender is a full counterparty to diligence rather than a spectator. In the United States that usually means an SBA 7(a) loan, and the programme has hard parameters worth knowing before the letter of intent rather than after. The maximum loan is $5M per borrower, terms for a business acquisition typically run 10 years, and the borrower must inject at least 10 percent equity on a change of ownership. A seller note can count toward that injection, but only if it sits on full standby, meaning no payments of principal or interest, for at least the first 24 months.

The lender's own request list overlaps heavily with the buyer's but is not identical. It wants three years of business tax returns, interim financials, the buyer's personal financial statement and resume, the purchase agreement, the lease, and a debt service coverage calculation. It will also commission a third-party business valuation, and under SBA rules that valuation is required when the amount being financed exceeds a threshold set by the programme, which on most acquisitions means it happens.

The lender sees the financial and tax folders; the buyer's own model and valuation stay out of the lender's link.

Two practical points. First, lender timelines are usually the critical path, so start the loan application in parallel with diligence rather than after it. Second, the lender's credit file becomes part of a government-guaranteed loan record, so it should contain what the lender needs and nothing more. That is the practical argument for a data room for small business due diligence with scoped links, rather than a shared folder that also holds the buyer's valuation model and negotiating notes.

7. Worked scenario: buying Halstead Plumbing

Dana signs a letter of intent to buy Halstead Plumbing and Heating, a 22-year-old residential and light commercial contractor in a mid-sized US market. Revenue is $3.4M, the owner is 63 and retiring, and the asking price is $2.6M based on the broker's stated seller's discretionary earnings of $740,000, a 3.5x multiple. There are 14 employees, 9 vans, and a leased yard and workshop.

Dana's accountant reconstructs the earnings from three years of tax returns. The proposed add-back list totals $310,000. Owner salary of $145,000, owner health and retirement of $28,000, above-market rent of $22,000 paid to the owner's own property company, personal vehicle and travel of $19,000, a daughter on payroll at $46,000 for bookkeeping that takes ten hours a week, one-off legal fees of $27,000, and deferred equipment repairs of $23,000.

$310Kproposed add-backs

• Accepted in full173 · 56%

  Owner salary, health and retirement
• Accepted, replaced with market cost41 · 13%

  Above-market rent restated to market rent
• Partly disallowed46 · 15%

  Daughter's payroll: real work, but only 10 hours a week
• Disallowed50 · 16%

  Legal fees recurring in all 3 years, plus deferred repairs still owed

Worked scenario. $86K of the proposed list was disallowed or reduced, which is 28 percent, inside the 10 to 30 percent range buy-side reviewers commonly reject.

Adjusted earnings come out at $654,000 rather than $740,000. At the same 3.5x multiple that is $2.29M, and Dana renegotiates to $2.35M with the difference bridged by a larger seller note. Two other findings shape the structure. The largest customer, a property management company, is 24 percent of revenue on no written contract, so $180,000 of the price is held back for 12 months against its retention. And the master plumber licence the business trades under is held personally by the owner, so closing is conditioned on a licensed employee already on staff agreeing to a two-year contract.

Financing is a $1.7M SBA 7(a) loan, a $400,000 seller note on 24-month full standby, and $250,000 of Dana's own capital. Diligence runs through a room with 190 documents in eight folders, with separate links for the lender, the accountant, and Dana's attorney. The deal closes 88 days after the letter of intent.

8. Common mistakes in small business due diligence

The most common mistake is accepting the broker's earnings figure as the starting point. A confidential information memorandum is a marketing document, the add-back list inside it has not been tested by anyone, and 10 to 30 percent of it typically does not survive review. Rebuild the number from the tax returns yourself.

The second is sending the seller a 200-line request list on day one. An owner-operator who has never sold a business will simply stop responding, and the buyer reads the silence as evasiveness when it is overwhelm. Sequence the requests: financial and tax first, then customers and contracts, then licences and assets. Our due diligence checklist is a good source for the items themselves, but it is a superset, not a script.

The third is skipping the quality of earnings work to save money. On a $5M deal a $35,000 to $60,000 engagement is roughly one percent of the price and routinely finds adjustments worth many times that. It also strengthens the loan file.

The fourth is discovering licences and consents in the final week. Every assignment and every licence transfer has a lead time measured in weeks, and several of them run in parallel with the lender's underwriting. Ask on day one, not on day sixty.

The fifth is running the whole process through one shared folder. Four counterparties, one of them a lender whose file becomes part of a government loan record, should not all be looking at the same view that also contains the buyer's valuation model. The data room checklist covers how to structure this properly.

9. Data room for your small business due diligence

A data room for small business due diligence is smaller than a mid-market deal room and no less important, because the counterparty count is the same and the seller's own filing habits are usually worse. The buyer is not opening a room to impress anyone. The buyer is opening it so that three advisors and a lender can work from one organised set of documents instead of four inconsistent email threads.

Papermark is a secure, fully customizable, and developer-friendly data room built for modern dealmakers, with page-by-page analytics, dynamic watermarking, and transparent pricing (open-source and self-hosting available).

A small business acquisition room with one folder per review area, so permissions differ by folder rather than by document.

Why you need a data room for small business due diligence

Small deals are the ones most often run on a shared drive, and they are the ones where that choice causes the most trouble. There are four reasons a dedicated data room for small business due diligence earns its place. If you are still choosing a platform, our comparison of the best virtual data rooms covers pricing, permissions, and compliance across the main providers.

Four parties need four different views. The lender needs financials, tax returns, and the lease. The accountant needs the accounting folder and the bank statements. The attorney needs contracts, licences, and the litigation history. You need all of it plus your own valuation model, which none of the other three should see. A shared folder gives you one permission level for all four.

The seller has no system and you are building one. Documents arrive as photographs of paper, as email attachments, and as exports from an accounting package, over six weeks. A room with folders by review area turns that stream into a structure, and automatic file indexing keeps the index current as items land.

The lender's file is a regulated record. On an SBA-guaranteed loan, what the lender receives becomes part of the loan file. Giving the lender a scoped link containing exactly the documents it asked for is cleaner for everyone than granting access to a folder that also holds your negotiating position.

The disclosure record protects a first-time buyer most. Small business acquisitions are bought with personal guarantees. If a dispute arises after closing about whether the seller disclosed a customer loss or an open claim, a per-visitor audit log showing what was uploaded and when is the evidence. An inbox is not.

The rest of this section is the practical setup: five steps that handle all four.

Step 1: build the room by review area

Build the data room for small business due diligence with one folder per area from the table above: financial, tax, revenue and customers, owner and licences, employees, contracts and leases, legal, and assets. That structure is what makes scoped access possible later, and it doubles as the request list you send the seller.

Upload in bulk by dragging the folder tree in. Automatic file indexing on the Data Rooms Plus plan builds and maintains the index as documents arrive, which matters when the seller is sending items one at a time over six weeks.

Step 2: give each counterparty its own link

Granular file-level permissions are set per link rather than per user, so each counterparty gets one link carrying its own folder scope, email allowlist, and download rule. Access is link-based, so nobody creates an account, which matters when one of your counterparties is a 63-year-old seller's bookkeeper.

Permissions are set per link, so the lender and the attorney see different folders of the same acquisition room.

Step 3: protect the documents that name people

Payroll registers, employee files, and customer lists are the documents in a small business deal most likely to cause harm if they circulate. Set those folders to view-only and turn on dynamic watermarking, which stamps every page with the viewer's email, IP address, and timestamp as it renders.

Payroll and customer lists stay view-only and watermarked, so any leak is traceable to a named viewer.

The honest limit is worth stating: a downloaded file is legally treated as read, and no platform can recall it. That is why download is switched off on these folders rather than merely discouraged.

Step 4: collect the seller's documents through the room

Small business sellers do not upload to data rooms. They email attachments, and the buyer ends up re-filing everything by hand. Request files from visitors turns that around: send the seller a link that lets them upload directly into the right folder, so a tax return arrives where it belongs instead of in your inbox.

The Q&A module then keeps the follow-up questions attached to the document that prompted them, with permissions controlling who sees which threads, so the lender never reads your attorney's questions. The log exports for the closing file.

Step 5: read the analytics, then archive the room

Page-level analytics show which counterparty opened which document and for how long. On a small deal that is mostly a progress signal: a lender who has not opened the tax folder five days after receiving the link has not started underwriting, and you would rather know that now.

Analytics show whether the lender has actually started, which is usually the critical path.

After closing, data room freeze makes the room immutable and exports it as an archived ZIP with a certificate. On a deal bought with a personal guarantee, that archive is the record of exactly what the seller disclosed and when.

What it costs

The Data Rooms plan is €99/month with a 7-day free trial and includes 3 team members, unlimited data room visitors, unlimited data rooms, unlimited documents, custom domain, dynamic watermarking, NDA agreements, and granular file-level permissions. Data Rooms Plus at €249/month adds 5 team members, the Q&A module, the audit log, automatic file indexing, and SOC 2 Type II. Data Rooms Premium at €549/month adds 10 team members, AI redaction, full API access, SSO, and whitelabeling. Data Rooms Unlimited at €999/month removes per-seat charges entirely, so teams that add reviewers mid-deal pay one number regardless of headcount, and it carries every Premium capability including AI redaction. For a searcher looking at several targets a year, unlimited data rooms on one subscription means one room per target at no extra cost.

Set up your acquisition data room

No credit card required.

FAQ

Related resources

• Best virtual data rooms in 2026
• Papermark data room
• Quality of earnings
• Entrepreneurship through acquisition
• M&A due diligence checklist
• Buy-side due diligence
• Data room checklist for 2026