Monsters in the Data Room: 6 Due Diligence Red Flags When Buying a Business

Related reading: EBITDA Addbacks Explained and Cash vs. Accrual: What a Seller's Books Hide.

TL;DR: The 6 Financial Due Diligence Red Flags

Most monsters in an acquisition aren't hiding in the purchase agreement. They're in the general ledger, the receivables aging, and the addback schedule.

These six financial due diligence red flags show up again and again when buying a lower middle market or Main Street business:

None of them automatically kills a deal. Most just need to be found, measured, and priced. That's the job of a Quality of Earnings analysis: Find them before closing, not after.

Something Is Lurking in the Books

I've analyzed more than 250 businesses over the years, and I've met a lot of monsters in data rooms. None of them were wearing costumes.

They look like a tidy addback schedule. A revenue line that grows every year. A seller who swears the biggest customer isn't going anywhere.

The monsters in this article are fictional. The problems behind them are not. Every one is drawn from something I've seen in an actual engagement.

For buyers of small and lower middle market businesses, the stakes are real. A discrepancy in the books might be a harmless bookkeeping mistake ... or it might be overstated earnings, a cash hole you'll have to fill after closing, or a business model that depends on one handshake.

The trick is telling the difference. Let's meet them.

1. The Ghost of Addbacks Past: Unsupported EBITDA Addbacks

The nonrecurring expense that keeps coming back.

Every QoE analyst has met this ghost. The seller hands over an adjusted EBITDA number and a long schedule of addbacks. Consulting fees. Legal bills. A big repair. Management fees. All of them "won't happen again."

So why are they in every year of the general ledger?

An expense doesn't qualify as an addback because it's unusual, discretionary, or labeled nonrecurring. The only question that matters: Does removing it give a truer picture of what the business will earn under new ownership?

A $25k consulting bill tied to a one-off project can be a fair adjustment. The same consultant billing $25k every year is a cost of doing business.

Owner compensation is the other favorite hiding spot. Swapping an owner's above-market salary for a market-rate replacement is reasonable. Adding back the entire salary, as if the work will do itself after closing, is not.

The math gets expensive fast. At 4.0x, a $50k addback that doesn't hold up is $200k of purchase price the buyer shouldn't be paying.

How to test EBITDA addbacks

Start with the general ledger, not the seller's schedule. Pull three or more years and look for the same vendors and the same account activity showing up again. Ask for invoices. Ask what each expense was actually for.

For owner adjustments, list what the owner does every week and price what it costs to replace that work. For "one-time" items, separate the truly isolated events from costs that are just lumpy in timing.

The goal is a number the buyer can actually expect to earn.

Bottom line: Putting an expense on an addback schedule doesn't make it nonrecurring.

2. Zombie Revenue: Reported Revenue That Doesn't Tie to Cash

The sales that won't stay dead.

Revenue is the first number most buyers look at, and growth is usually the headline in the CIM. But revenue showing up in QuickBooks doesn't mean a valid sale happened.

I've seen plenty of deals where the P&L and the bank statements tell two different stories. Sometimes the gap has a boring explanation: Receivables that haven't been collected yet, customer deposits, transfers between accounts. Other times it's duplicate invoices, sales with no support behind them, or revenue booked months before the work was done.

Here's the catch for smaller businesses. Most of them keep their books on a cash basis, or something close to it. A cash-basis P&L can't show you a revenue timing problem, because it only records money when it lands. You won't see that a big job was billed early, or that December's revenue really belongs to January, until someone converts the books to accrual.

And the reverse is true too. A legitimate sale might not turn into cash for 60 or 90 days. Cash that arrives early might be a customer deposit, which is a liability until the work is delivered.

So comparing total revenue to total deposits is a start. It isn't proof.

How to verify revenue quality

A proof of cash ties reported revenue to the sales ledger, the invoices, the bank deposits, and the change in receivables. For e-commerce businesses, payment processor reports from Shopify, Stripe, or PayPal give you independent third-party evidence.

Then look hard at the edges. Revenue booked in the last few weeks of a period. Manual journal entries to revenue accounts. Old receivables nobody is chasing. Credit memos issued right after year-end.

Not every unreconciled dollar is fake revenue. But every one needs an explanation.

Bottom line: Revenue on the books is a claim. Cash in the bank and collectible receivables are the evidence.

3. Frankenstein's Financials: Records That Don't Reconcile

Stitched together from spreadsheets, PDFs, handwritten notes, and God knows what.

You open the data room and find three versions of the 2024 income statement. None of them agrees with the tax return.

In owner-operated businesses, this is more common than it should be. QuickBooks for the books. Excel for the owner's "real" numbers. A separate spreadsheet for payroll or inventory. An outside CPA posting year-end adjustments that never make it back into the general ledger.

Each piece might make sense on its own. The problem is that nobody can explain how they fit together.

The result is a creature assembled from parts. Every part looks plausible. The whole thing doesn't walk.

For a buyer, that's more than an annoyance. If you can't trust the financial statements, you can't set an EBITDA baseline, read a trend, size working capital, or believe a projection.

How to reconcile inconsistent financial records

Pick a source of truth for each period. Get the trial balance, general ledger, financial statements, tax returns, and bank statements for the same periods.

Tie the statements to the GL. Then reconcile book income to taxable income. Some differences are normal (depreciation methods, timing items, tax-only adjustments). Others point to missing entries or misclassified accounts.

Bank reconciliations are your control. If recorded cash doesn't agree with what the bank says, everything built on top of it is suspect.

If the records are bad enough, stop. A bookkeeping reconstruction or a cash-to-accrual conversion has to come first. Running a QoE on books that don't reconcile just produces a well-formatted guess.

Bottom line: You can't measure the quality of earnings until you have numbers worth measuring.

4. The Working Capital Werewolf: Net Working Capital Swings Before Closing

The monster that transforms just before closing.

A business can post strong EBITDA and still leave its new owner short on cash the first month.

Net working capital is the operating money tied up in running the business: Receivables, inventory, and prepaids, less payables and accrued expenses. The exact definition comes from the purchase agreement, and it matters.

The werewolf shows up in the weeks before closing. The seller collects receivables aggressively, slows down vendor payments, and lets inventory run thin. The business looks flush. Then the buyer takes over, inherits the overdue bills, and finds a lot less in receivables to pay them with.

Other signs: Past-due payables piling up, an aging report that keeps getting older, and big swings in customer deposits or accrued expenses.

In a larger deal, the protection is a working capital peg. If the peg is $300k and the business delivers $240k at closing, the price usually drops $60k.

The scarier version: No peg at all

Most Main Street deals, and plenty of SBA deals, are structured as asset purchases. The seller keeps the receivables and pays off the payables. The buyer gets the equipment, the inventory, the customer list, and a working capital balance of roughly zero.

Nobody gets cheated in that structure. But the buyer has to fund payroll, rent, and supplies out of pocket until the first collections come in. If the business bills on 45-day terms and runs $150k a month in costs, that's a real number. Buyers who didn't size it, or didn't finance it, find out in month two.

How to analyze net working capital

Look at monthly balance sheets for at least the trailing twelve months, longer if the business is seasonal. Check the receivables aging, inventory quality, how fast vendors are actually getting paid, and accrued liabilities.

If there's a peg, that analysis sets it. Uncollectible receivables and obsolete inventory don't count at face value. Some items, like deferred revenue or past-due taxes, belong in debt rather than working capital. Write all of it into the purchase agreement so it doesn't become a fight after closing.

If there's no peg, use the same analysis to estimate how much cash the buyer needs on day one, and make sure the financing covers it.

Bottom line: EBITDA tells you whether the business makes money. Working capital tells you whether you can afford to run it the morning after closing.

5. Skeletons in the GL: Buried Expenses and Liabilities

Some things are buried for a reason.

The income statement is the summary. The general ledger is every transaction underneath it. That's where the skeletons are.

A big "Miscellaneous" account full of personal spending, related-party payments, or costs that belong somewhere else. Manual journal entries posted on December 31 with no support. A suspense account carrying the same balance for eighteen months. A liability that never got accrued.

Some of it is honest sloppiness. Some of it is weak controls. Once in a while, it's something worse.

The hard part is that the income statement can look perfectly normal while the GL underneath is a mess.

A classic: Routine operating costs getting capitalized onto the balance sheet. Repairs become "equipment." Software subscriptions become "intangibles." Every dollar moved off the P&L is a dollar added to EBITDA, and at 4.0x it's four dollars of purchase price.

Capitalization can be perfectly legitimate. What matters is whether the policy makes sense and whether it's applied the same way every year.

How to review the general ledger

Scan for unusual account names, large manual entries, and accounts whose activity suddenly jumps or disappears. Pay extra attention to entries posted near period-end, expenses sitting in balance sheet accounts, related-party names, and transactions with blank or vague memos.

Compare each account year over year. Tie significant balance sheet accounts to their supporting schedules.

Then trace every material finding through to EBITDA. A misclassification can leave net income untouched and still distort operating earnings, which is the number the buyer is paying a multiple on.

Bottom line: The income statement shows what management reports. The general ledger shows how they got there.

6. The Customer Concentration Reaper: Customer Concentration Risk

One customer away from the grave.

Nothing makes a business look safer than a big, loyal customer who's been around for twenty years.

Unless that customer is 60% of revenue.

Concentration isn't automatically a problem. Plenty of good manufacturers, specialty service firms, and B2B contractors live off a handful of accounts. The risk climbs when the relationship is informal, the contract is easy to walk away from, or the whole thing runs through the seller personally.

Take a $3 million business with $1.8 million coming from one customer. What happens when that customer cuts orders, reopens pricing, or just decides the new owner isn't their golf buddy?

History isn't a guarantee. A change of ownership is exactly the moment a big customer reconsiders, especially when the seller was the relationship. And it's common to learn in diligence that the largest account has no written agreement at all, or one that can be terminated on 30 days' notice.

How to assess customer concentration

Break revenue down by customer for every year in the review period. Look at trends, margins, contract terms, and retention for each of the top accounts.

Check profit too. A customer that's 40% of revenue and 15% of gross profit is a very different risk from one that's 40% of both.

Read the contracts for termination rights, renewal terms, pricing, exclusivity, and change-of-control clauses. Where the process allows, a coordinated customer call can tell you more than any document.

Find out who actually owns the relationship. A team, or one person who's about to retire?

Then run the downside. What do EBITDA and cash flow look like if that customer drops 25%? 50%? Leaves entirely? The answers belong in the price, the financing, and the structure (an earnout, seller financing, or a longer transition).

Bottom line: A handshake and twenty years of history are nice. They aren't a contract.

So You Found a Monster. Now What?

Finding a red flag doesn't mean you walk away. Most of them are manageable once you know how big they are.

An unsupported addback comes out of adjusted EBITDA, and the price follows. A working capital shortfall gets handled through the peg or the financing. Messy books mean more diligence, or a cleanup before the QoE can finish. Concentration and owner dependence may not change EBITDA at all, but they belong in the structure.

What matters is how big the problem is. A $10k bookkeeping error in a business making $2 million of EBITDA won't change anything. A $100k recurring expense wrongly added back, at 4.0x, is $400k of value that isn't there.

That takes judgment and a sense of materiality. Not every discrepancy is fraud, and not every finding deserves the same attention.

The Real Horror Story Starts After Closing

Diligence exists so you know what you're buying, and what it really earns, before you sign.

Some monsters turn out to be innocent mistakes. Some are real expenses dressed up as addbacks. A few are warnings about much bigger problems.

The only thing scarier than finding one in the data room is finding it after closing.

By then, it isn't a negotiating point anymore. It's your problem.

Frequently Asked Questions

What are the most common financial due diligence red flags when buying a business?

The six that show up most often in lower middle market and Main Street deals are unsupported EBITDA addbacks, reported revenue that doesn't tie to cash, financial records that don't reconcile, working capital that swings before closing, buried general ledger activity, and customer concentration. None of them automatically kills a deal, but each one needs to be found and measured before the price is final.

How do you tell if an EBITDA addback is legitimate?

Check whether the expense actually goes away under new ownership. Pull three or more years of the general ledger and look for the same vendor or account activity in every period. Ask for invoices and the business reason for each item. An expense that recurs, or an owner salary that will have to be replaced, isn't an addback.

Why doesn't a seller's revenue match the bank deposits?

Sometimes the reason is harmless: Uncollected receivables, customer deposits, or transfers between accounts. Sometimes it's duplicate invoices, unsupported sales, or revenue booked before the work was done. A proof of cash ties reported revenue to invoices, bank deposits, and the change in receivables so each difference has an explanation.

What is a working capital peg?

A working capital peg is the normal level of net working capital the seller agrees to deliver at closing. If the business delivers less than the peg, the purchase price usually goes down by the shortfall. Many Main Street and SBA asset deals have no peg at all, so the buyer has to fund operating cash from day one and should size that need before closing.

How much customer concentration is too much?

There is no single cutoff. The risk depends on the contract terms, the customer's share of gross profit as well as revenue, and whether the relationship belongs to a team or to the seller personally. Model what happens to EBITDA and cash flow if the largest customer drops 25%, 50%, or leaves, and reflect the answer in the price or the deal structure.

Should I walk away from a deal if diligence finds a red flag?

Usually not. Most findings are manageable once you know how big they are. An unsupported addback lowers adjusted EBITDA and the price. A working capital shortfall is handled through the peg or the financing. Concentration risk is often handled through an earnout, seller financing, or a longer transition.

When should a buyer get a Quality of Earnings report?

After the LOI is signed and before closing, while there is still time to adjust the price, the working capital terms, or the structure. A short pre-LOI screen can also catch obvious problems before you commit to exclusivity. See what a seller should give you before an LOI.