Due Diligence on a Company: What to Check Before a Deal

On this page: express check in a day · real vs painted revenue · the OSINT layer: people behind the company · seller red flags · share deal or asset deal · what to do with a risk · cost and timelines · FAQ

I check companies and their owners for a living, and nearly every "I bought a business and got a nasty surprise" story is built the same way: the buyer looked at a polished pitch deck and management accounts, not at what sits in open registries and in the seller's biography. Lawyers keep dissecting the same template case — someone buys a ready-made company running a café for roughly €20k and inherits with it supplier and rent debts running to hundreds of thousands. None of those numbers were in the deck. All of them were sitting in public sources before signing.

This article is about looking the right way. Not "hire an auditor" — you already know that — but what to check with your own hands, where the line runs between self-screening and professional work, and how each finding turns into leverage at the table.

If you're vetting a one-off supplier or customer rather than buying a business, you need a more tactical procedure — covered in how to check a counterparty before a deal. Here the subject is buying a company or a stake in it, where you inherit its entire history.

What due diligence is, and how it differs from an audit#

Due diligence is a comprehensive check of a target company before a transaction: buying a business, taking a stake, an M&A deal, an investment. The goal is to remove uncertainty — understand the real financial condition, find hidden liabilities, and judge whether claims will land the moment you close.

People keep confusing it with an audit, though the two do different jobs:

• An audit confirms that the financial statements are accurate and prepared to standard. It looks backward, "by the rules."
• Due diligence is broader and always tailored to a specific deal. It hunts not for "correct bookkeeping entries" but for the buyer's risks: hidden debts, earnings quality, clean title to assets, litigation tails, and — the part almost nobody writes about — who actually stands behind the company.

Put simply: an auditor tells you the statements are fine. Due diligence tells you that behind the formally clean statements sits a guarantee on someone else's loan, and the main "customer" is a firm owned by the seller himself.

Types of due diligence and what each one checks#

A full check breaks into streams. The exact set depends on the business, but the base frame is this:

The first five are the standard any advisory firm will offer. The last layer — checking people, not paperwork — usually gets done by no one, and it's the one that most often exposes the very thing the deal was set up to hide. More on it below.

Express due diligence yourself: filter out a toxic asset in a day#

The first advice every article gives is "hire professionals." It's right, but it's not first. Before paying hundreds of thousands for a full DD, any buyer can spend a few hours on a first-pass screen from open sources — and decide whether this asset is even worth paying to check. A toxic deal is often visible at this level.

Here's a reproducible route by tax ID (INN/OGRN for Russian entities). Everything is free:

1. "Transparent Business" (FTS) + the company extract (pb.nalog.ru) — how fresh the registration is, frequent director/address changes, "unreliable data" flags, director disqualification, charter capital, activity codes vs the real business.
2. GIR BO (bo.nalog.ru) — official accounting statements for several years, free. Revenue, profit, assets, payables and receivables over time. The first "painting" indicator (see below).
3. Arbitration case file (kad.arbitr.ru) — every lawsuit where the company is claimant or defendant. Look for bankruptcy petitions, large recoveries, tax disputes.
4. Bailiff enforcement database (FSSP) (fssp.gov.ru) — outstanding debts and asset seizures.
5. Fedresurs / EFRSB (fedresurs.ru) — notices of bankruptcy, pledges, leasing, and creditors' intent to file for bankruptcy.
6. Movable-property pledge register (Federal Notary Chamber) (reestr-zalogov.ru) — whether equipment or shares are pledged; the real-estate register (Rosreestr) for property and encumbrances.
7. Rospatent (fips.ru) and the State Registration Bulletin (vestnik-gosreg.ru) — brand and IP rights, notices of reorganization, liquidation, capital reduction.
8. Aggregators for speed — "Za Chestny Biznes" (zachestnyibiznes.ru), Rusprofile: they quickly surface a director's and owner's links to other legal entities. For cross-border targets, add OpenCorporates and the relevant Companies House. Paid tools like SPARK and Kontur.Focus dig deeper, but the free set is enough to filter.

The filter rule. If this level surfaces bankruptcy petitions, a "fan" of director changes, unreliable-data flags, zero reporting against claimed turnover, or a "mass" director sitting on dozens of firms — the asset is red, and you can stop before the expensive DD. An express filter doesn't replace a full check, but it saves you those hundreds of thousands on an already-dead deal.

Real revenue or painted: financial DD with your own eyes#

Sellers systematically overstate revenue and profit and understate costs — not out of malice, it's the rules of the game. Your job is to value the business by cash, not by the pitch deck. Formally this is Quality of Earnings: how much of the reported profit is actually recurring and backed by money.

Five checks you can run by hand#

1. An independent benchmark. Download the official statements from GIR BO for 3–4 years and compare them against the "management accounts" the seller is proud of. A gap between the two is the first trigger. Caveat: GIR BO reflects Russian accounting standards and, for micro-businesses on special tax regimes, is thin or even understated — there, bank statements matter more.
2. The main test — cash vs revenue. Match revenue from the P&L against actual receipts in the bank statements and against the "cash flow from operating activities" line. Real revenue converts to money. If revenue grows while operating cash flow stays flat or negative — the profit exists only on paper.
3. Receivables and their trend. Compute days sales outstanding (receivables ÷ revenue × 365) year over year. If it balloons while revenue rises, sales are booked but the money isn't there: premature revenue recognition, or "selling on credit" to yourself.
4. Source documents on a sample. For the top 10–20 deals, pull the full chain: contract → invoice → acceptance act → bank receipt. A break in the chain is a sign of a painted sale.
5. Related parties. Through SPARK, Kontur.Focus or Casebook, check whether the largest "customers" are affiliated with the seller. Revenue looped back to his own companies, or concentrated on one or two clients, is the easiest kind to paint.

Markers of painted revenue#

• a revenue spike in the 2–3 months before the sale;
• revenue rising while cash flow is flat;
• ballooning receivables;
• revenue concentrated on affiliated buyers;
• abrupt changes to discounts and bonuses at period end;
• a surge of returns right after the reporting date;
• cash gaps at a formally profitable company.

If revenue is in doubt, don't value the business on it. Use net assets, or discount future flows on a pessimistic scenario. The rule is simple: a business's value rests on cash flow, not on revenue.

The OSINT layer: check people, not just the legal entity#

This is the main line separating a professional check from a checklist off the internet. Everyone checks the company — the registry, litigation, statements. Almost no one checks the people behind it, though risk in a deal is always personal. OSINT — intelligence from open sources — adds a digital layer to the paper DD: hidden affiliations, undisclosed related-party deals, reputation that never appears in audited statements.

Beneficiaries and nominees#

The task is to establish the ultimate beneficial owner — the individual who really controls the business or owns more than 25% (the threshold banks build their AML procedures around). The route: the ownership chain in the registry plus profile cards in "Za Chestny Biznes" and Rusprofile — who else is an owner or director elsewhere. A nominee director gives himself away by a "fan" presence across dozens of firms, frequent turnover, and an owner who, in the meeting, is vague on basic numbers and defers to "my manager who'll explain everything." That same behaviour is one of the most reliable markers of a technical entity — how to spot one and what it costs the buyer is covered in shell company red flags.

Then check the people as individuals, not just as a company:

• personal bankruptcy of founders — kad.arbitr and EFRSB;
• personal debts and seizures — FSSP;
• "serial bankrupts" and traces of asset-stripping before the sale;
• affiliation through shared addresses, phones, joint ownership and relatives — for example, when the seller is simultaneously the largest counterparty of the company being sold.

Reputation and sanctions#

• Sanctions and watchlist screening of beneficiaries and top managers. Here the 50% rule applies: if sanctioned persons own 50% or more of a company (in aggregate, directly or indirectly), it is itself treated as blocked, even without a separate listing. The rule speaks to ownership, not control, and OFAC publishes no dedicated list for it — you have to trace the chain yourself.
• Adverse media — investigations, court scandals, labor violations, press coverage.
• Leaks and social media — employee reviews on culture, turnover and payroll delays; signals that never show up in the numbers.

Automated platforms gather this quickly, but the correlation and false-positive filtering still fall to an analyst — on common names and handles there are plenty of false hits. This is exactly the work we do under intelligence and vetting of a company and its beneficiaries: we check people, not paperwork. The flip side of the same coin is what's visible about you and your company from open sources — worth reading the digital footprint of a principal and how to check if your data was breached.

Red flags in the seller's behavior#

Faking the reporting is easier than sitting calmly through a check. So the seller's behavior is an early detector, often more honest than the documents. No single signal is a verdict, but two or three together are a reason to stop.

• Rushing and pressing urgency — "only today," "there's another buyer." A classic move to compress the check.
• Restricting access to documents — no source records, bank statements or contracts before the preliminary agreement is signed.
• A revenue spike in the 2–3 months before the sale — almost always an artificial pre-sale bump.
• Insisting on cash settlement and "grey" elements of the deal.
• Fresh re-registration, a director or shareholder change, a move to another region right before the deal — an attempt to reset history or shake off creditors.
• The owner is vague on basic numbers or redirects to a manager — a sign of a nominee, or that what's being sold isn't what's being run.
• Willing to give a guarantee letter but avoids representations in the contract — which, as we'll see, is not the same thing at all.

A behavioral flag isn't a reason to walk immediately. It's a reason to intensify the check on that specific vector and push the risk into the price structure.

Share deal or asset deal: where the debts stay#

A critical fork most guides skip. It decides whether you inherit someone else's problems.

• Buying a stake (share deal) — you get the business with its whole history: debts, unperformed contracts, tax tails, and the risk of subsidiary liability for past actions. For a company acquisition the three-year tax lookback matters (anti-avoidance risk under Russian Tax Code Art. 54.1), along with bankruptcy petitions and voidable deals — asset-stripping before the sale can be challenged, but that becomes your headache.
• Buying assets (from a sole proprietor, or via a carve-out) generally doesn't drag the seller's obligations with it. But it demands a separate check of title to each asset: who really owns it, whether there's a pledge or encumbrance.

Practical upshot: buy a company and the defense is built around the tax and litigation tail — representations plus a price holdback. Buy assets and the focus is clean title. These are different checks, and confusing them is expensive.

Found a risk — now what: price, representations, escrow, earn-out#

The value of due diligence isn't the list of risks; it's that each finding converts into a decision — and into leverage at the table. There are, essentially, four options.

1. A price cut by the amount of the risk, or by the discounted probable loss — when the risk is quantifiable and likely.
2. Representations and warranties (Russian Civil Code Art. 431.2; "reps" in international M&A) plus indemnity (Art. 406.1). The seller answers in money if a hidden debt or claim fires. This is the pivotal point, and here's why.

Why a guarantee letter doesn't protect you, but representations do#

A seller's guarantee letter about debts is a one-sided document, and its legal force is ambiguous: a court may treat it as a representation under Art. 431.2, or may not recognize a clear duty to compensate behind it. Don't rely on that lottery. The reliable path is to write representations straight into the contract — clean title, no hidden debts, no third-party claims. For inaccurate representations in a commercial deal, the law presumes the seller knew of them: the buyer doesn't have to prove that knowledge. The right construction isn't "the seller wrote a letter," but "the contract has representations plus indemnity plus a price holdback."

3. Deferred payment. Escrow — part of the price held by an independent agent, released after a warranty period or when no claims have surfaced. In global practice, 10–20% of the price is held for 12–24 months against the tax and litigation tail (the share is usually lower on large deals). Earn-out — part of the price tied to the business's future metrics; here it's essential to build in protection against KPI gaming on both sides.
4. Conditions precedent, or walking away — fix the breach before closing, or exit if the risk can be neither priced nor transferred.

This is the stage where DD findings turn into money. By practitioners' estimates, a significant share of deals surface material discrepancies, and the resulting price correction is often measured in tens of percent. Settling through an independent guarantor is escrow and deal support; structuring cross-border deals and compliance, when foreign jurisdictions and sanctions risk enter the chain, is the finance and compliance side.

Cost, timelines, and when to call in professionals#

Reference points from audit firms (they depend heavily on scale, so ranges):

• Express analysis — around 80–120 person-hours, from a few tens of thousands of rubles and 1–2 weeks; largely what's described above in the self-screening block.
• Full DD — 200–300 person-hours, from hundreds of thousands to millions of rubles, 4–6 weeks.
• A separate check usually pays off on deals from a few tens of millions of rubles; below that, a self-run express screen is enough.

What's changed this year: AI-powered virtual data rooms have become the 2026 norm. Documents are auto-classified, key terms and risks surfaced, and multilingual search runs across contracts. Vendors building these platforms (V7 Labs, for one) estimate the routine part of the check speeds up by 60–80%. For the buyer that means the mechanical part of DD gets cheaper, while value shifts to where a human is needed — interpreting findings and checking the people behind the company.

When to call in professionals, no question: a complex tax history, a cross-border structure, a dispute over earnings quality, signs of asset-stripping or nominee ownership. The express filter clears out the obviously dead deals; anything that passes the filter and is worth serious money deserves a full check.

FAQ#

Can I run due diligence myself?#

Partly, yes. An express screen from open registries — the company extract and "Transparent Business," GIR BO, kad.arbitr, FSSP, Fedresurs — any buyer can do in a day. That's enough to filter out a toxic asset before hiring consultants. A full check of tax, earnings quality, legal cleanliness and the people behind the company needs professionals.

How does due diligence differ from an audit?#

An audit confirms the reporting is accurate to standard. Due diligence is broader and tailored to the specific deal: it hunts for risks that surface for the buyer after closing — hidden debts, earnings quality, title defects, and who really stands behind the company.

How much does due diligence cost and how long does it take?#

Roughly: express — 80–120 person-hours, from a few tens of thousands of rubles and 1–2 weeks; full — 200–300 person-hours, from hundreds of thousands to millions of rubles and 4–6 weeks. Cost depends on the size of the business; a separate check usually pays off on deals from a few tens of millions of rubles.

What do I do with the risks I find?#

Turn them into the deal: cut the price by the amount of the risk, add representations (Civil Code Art. 431.2) and indemnity, and hold back part of the price via escrow or tie it to an earn-out. A found risk isn't cause for panic — it's leverage at the table.

Does a seller's guarantee letter protect me from hidden debts?#

Barely. Its legal force is ambiguous — a court may or may not treat it as a representation. What works is representations and indemnity written into the contract itself, plus a price holdback via escrow.

---

Checking a company before a deal is, above all, a check on people and money — not a retelling of the registry. Start with the one-day express screen: it's free and clears out the obviously dangerous deals. Anything that passes the filter and is worth serious money deserves a deeper look — we run those checks, including the layer a standard audit never reaches: beneficiaries, management, and reputation.