Due Diligence on a Company: What to Check Before a Deal

Due diligence on a company is a managed investigation of a business before you buy into it or invest — not "is the reporting accurate" (that's an audit), but "what exactly am I buying and which risks surface after closing." Buyers check five layers: finances, tax, legal cleanliness, operations, and the people behind the company. The part standard guides skip: you can spot half of the toxic deals in a single day from free registries — before paying consultants a cent.

I check companies and their owners for a living, and nearly every "I bought a business and got a nasty surprise" story is built the same way: the buyer looked at a polished pitch deck and management accounts, not at what sits in open registries and in the seller's biography. Lawyers keep dissecting the same template case — someone buys a ready-made company running a café for roughly €20k and inherits with it supplier and rent debts running to hundreds of thousands. None of those numbers were in the deck. All of them were sitting in public sources before signing.

This article is about looking the right way. Not "hire an auditor" — you already know that — but what to check with your own hands, where the line runs between self-screening and professional work, and how each finding turns into leverage at the table.

The subject here is buying a company or a stake in it, where you inherit its entire history. The sources below are US ones, with the UK equivalent where it differs. If the company is Russian, the registries are entirely different — that route is covered in how to check a Russian company.

What due diligence is, and how it differs from an audit#

Due diligence is a comprehensive check of a target company before a transaction: buying a business, taking a stake, an M&A deal, an investment. The goal is to remove uncertainty — understand the real financial condition, find hidden liabilities, and judge whether claims will land the moment you close.

People keep confusing it with an audit, though the two do different jobs:

• An audit confirms that the financial statements are accurate and prepared to standard. It looks backward, "by the rules."
• Due diligence is broader and always tailored to a specific deal. It hunts not for "correct bookkeeping entries" but for the buyer's risks: hidden debts, earnings quality, clean title to assets, litigation tails, and — the part almost nobody writes about — who actually stands behind the company.

Put simply: an auditor tells you the statements are fine. Due diligence tells you that behind the formally clean statements sits a guarantee on someone else's loan, and the main "customer" is a firm owned by the seller himself.

Types of due diligence and what each one checks#

A full check breaks into streams. The exact set depends on the business, but the base frame is this:

The first five are the standard any advisory firm will offer. The last layer — checking people, not paperwork — usually gets done by no one, and it's the one that most often exposes the very thing the deal was set up to hide. More on it below.

Express due diligence yourself: filter out a toxic asset in a day#

The first advice every article gives is "hire professionals." It's right, but it's not first. Before paying tens of thousands for a full DD, any buyer can spend a few hours on a first-pass screen from open sources — and decide whether this asset is even worth paying to check. A toxic deal is often visible at this level.

Here's a reproducible route for a US company, with the UK equivalent at the end. Almost all of it is free:

1. The state business registry (Secretary of State) — in the state of formation and in every state where the company is registered to do business: formation date, status, registered agent, officers or managers, amendments and name changes. Delaware, where many companies are formed, shows the basics for free and charges $10–$20 for status and filing history. A fresh entity, a string of officer or registered-agent changes, or a lapsed status are the first flags.
2. UCC filings — searched through the same Secretary of State: who has lent against the company's equipment, receivables or inventory. A blanket lien in favor of a lender nobody mentioned is a hidden debt in plain sight.
3. Courts — PACER for federal cases and bankruptcy (free if you stay under $30 a quarter), plus the state and county court portals where the company operates: lawsuits as plaintiff or defendant, judgments, collection cases.
4. Liens and real estate — the county recorder for federal and state tax liens, judgment liens and mortgages; the assessor's records for who actually owns the property the business runs from.
5. SEC EDGAR — full filings for a public company; for a private one that raised money under Regulation D, the Form D: the amount raised and the names of executive officers, directors and promoters.
6. Intellectual property — the USPTO trademark and patent search: whether the brand you're paying for is registered, and to whom. Quite often it's the founder personally, not the company.
7. Licenses and complaints — the state licensing board for regulated trades; for consumer-facing businesses, complaints with the state attorney general and the Better Business Bureau.
8. UK targets — Companies House covers most of the above in one free place: officers and their other appointments, filed accounts, the charges register (the UK's equivalent of UCC liens) and the register of people with significant control. For other countries, OpenCorporates points you to the national registry — note that since 2023 it requires an account, and commercial users need a subscription.

Paid databases — Dun & Bradstreet, LexisNexis and similar — dig deeper, but the free set is enough to filter.

The filter rule. If this level surfaces a bankruptcy filing, a string of officer changes, a lapsed status, liens or judgments nobody disclosed, or an officer who sits on dozens of unrelated entities — the asset is red, and you can stop before the expensive DD. An express filter doesn't replace a full check, but it saves you the cost of one on an already-dead deal.

Real revenue or painted: financial DD with your own eyes#

Sellers systematically overstate revenue and profit and understate costs — not out of malice, it's the rules of the game. Your job is to value the business by cash, not by the pitch deck. Formally this is Quality of Earnings: how much of the reported profit is actually recurring and backed by money.

Five checks you can run by hand#

1. An independent benchmark. A private US company publishes no statements, so the benchmark is its filed tax returns. Ask for three to four years of returns and have them confirmed against IRS transcripts — the seller authorizes the request on Form 4506-C, the same route SBA lenders use. Then compare them with the "management accounts" the seller is proud of. A gap between the two is the first trigger. For a UK company, the accounts filed at Companies House play this role, though small companies file only abridged versions — there, bank statements matter more.
2. The main test — cash vs revenue. Match revenue from the P&L against actual receipts in the bank statements and against the "cash flow from operating activities" line. Real revenue converts to money. If revenue grows while operating cash flow stays flat or negative — the profit exists only on paper.
3. Receivables and their trend. Compute days sales outstanding (receivables ÷ revenue × 365) year over year. If it balloons while revenue rises, sales are booked but the money isn't there: premature revenue recognition, or "selling on credit" to yourself.
4. Source documents on a sample. For the top 10–20 deals, pull the full chain: contract → invoice → acceptance act → bank receipt. A break in the chain is a sign of a painted sale.
5. Related parties. Through state registries, UCC filings and the officers' other companies, check whether the largest "customers" are affiliated with the seller. Revenue looped back to his own companies, or concentrated on one or two clients, is the easiest kind to paint.

Markers of painted revenue#

• a revenue spike in the 2–3 months before the sale;
• revenue rising while cash flow is flat;
• ballooning receivables;
• revenue concentrated on affiliated buyers;
• abrupt changes to discounts and bonuses at period end;
• a surge of returns right after the reporting date;
• cash gaps at a formally profitable company.

If revenue is in doubt, don't value the business on it. Use net assets, or discount future flows on a pessimistic scenario. The rule is simple: a business's value rests on cash flow, not on revenue.

The OSINT layer: check people, not just the legal entity#

This is the main line separating a professional check from a checklist off the internet. Everyone checks the company — the registry, litigation, statements. Almost no one checks the people behind it, though risk in a deal is always personal. OSINT — intelligence from open sources — adds a digital layer to the paper DD: hidden affiliations, undisclosed related-party deals, reputation that never appears in audited statements.

Beneficiaries and nominees#

The task is to establish the ultimate beneficial owner — the individual who really controls the business or owns 25% or more (the threshold US banks build their customer due diligence around). The US has no public register of beneficial owners, so the route is indirect: officers and managers in state filings, the registered agent, related persons on a Form D, the names that come up in UCC filings and lawsuits — and who else each of them is an officer of. For a UK entity, the public register of people with significant control does much of this for you. A nominee director gives himself away by a "fan" presence across dozens of firms, frequent turnover, and an owner who, in the meeting, is vague on basic numbers and defers to "my manager who'll explain everything." That same behaviour is one of the most reliable markers of a shell entity; for Russian companies, how to spot one and what it costs a buyer is covered in Russian shell company red flags.

Then check the people as individuals, not just as a company:

• personal bankruptcy of founders — PACER;
• personal judgments and liens — county court and recorder records;
• "serial bankrupts" and traces of asset-stripping before the sale;
• affiliation through shared addresses, phones, joint ownership and relatives — for example, when the seller is simultaneously the largest counterparty of the company being sold.

Reputation and sanctions#

• Sanctions and watchlist screening of beneficiaries and top managers. Here the 50% rule applies: if sanctioned persons own 50% or more of a company (in aggregate, directly or indirectly), it is itself treated as blocked, even without a separate listing. The rule speaks to ownership, not control, and OFAC publishes no dedicated list for it — you have to trace the chain yourself.
• Adverse media — investigations, court scandals, labor violations, press coverage.
• Leaks and social media — employee reviews on culture, turnover and payroll delays; signals that never show up in the numbers.

Automated platforms gather this quickly, but the correlation and false-positive filtering still fall to an analyst — on common names and handles there are plenty of false hits. This is exactly the work we do under intelligence and vetting of a company and its beneficiaries: we check people, not paperwork. The flip side of the same coin is what's visible about you and your company from open sources — worth reading the digital footprint of a principal and how to check if your data was breached.

Red flags in the seller's behavior#

Faking the reporting is easier than sitting calmly through a check. So the seller's behavior is an early detector, often more honest than the documents. No single signal is a verdict, but two or three together are a reason to stop.

• Rushing and pressing urgency — "only today," "there's another buyer." A classic move to compress the check.
• Restricting access to documents — no source records, bank statements or contracts before the preliminary agreement is signed.
• A revenue spike in the 2–3 months before the sale — almost always an artificial pre-sale bump.
• Insisting on cash settlement and "grey" elements of the deal.
• Fresh re-registration, a director or shareholder change, a move to another region right before the deal — an attempt to reset history or shake off creditors.
• The owner is vague on basic numbers or redirects to a manager — a sign of a nominee, or that what's being sold isn't what's being run.
• Willing to give a guarantee letter but avoids representations in the contract — which, as we'll see, is not the same thing at all.

A behavioral flag isn't a reason to walk immediately. It's a reason to intensify the check on that specific vector and push the risk into the price structure.

Share deal or asset deal: where the debts stay#

A critical fork most guides skip. It decides whether you inherit someone else's problems.

• Buying a stake (share deal) — you get the business with its whole history: debts, unperformed contracts, tax tails, and liability for past actions. The tax lookback matters: the IRS generally has three years to reassess a return, six if income was substantially understated, and no limit for fraud. Add lawsuits in progress and transfers a court could unwind — asset-stripping before the sale can be challenged, but that becomes your headache.
• Buying assets (from a sole proprietor, or via a carve-out) generally doesn't drag the seller's obligations with it — with exceptions courts apply when the buyer assumes liabilities, when the deal is a merger in all but name, when the buyer is a mere continuation of the seller, or when the sale was a way to dodge creditors. It also demands a separate check of title to each asset: who really owns it, and whether there's a lien on it.

Practical upshot: buy a company and the defense is built around the tax and litigation tail — representations plus a price holdback. Buy assets and the focus is clean title. These are different checks, and confusing them is expensive.

Found a risk — now what: price, representations, escrow, earn-out#

The value of due diligence isn't the list of risks; it's that each finding converts into a decision — and into leverage at the table. There are, essentially, four options.

1. A price cut by the amount of the risk, or by the discounted probable loss — when the risk is quantifiable and likely.
2. Representations and warranties plus indemnification in the purchase agreement — in larger US deals often backed by representations and warranties insurance. The seller answers in money if a hidden debt or claim fires. This is the pivotal point, and here's why.

Why a side letter doesn't protect you, but representations do#

A seller's letter or email assuring you there are no debts sits outside the purchase agreement — and almost every purchase agreement has an "entire agreement" clause saying nothing outside it counts. Don't rely on that. The reliable path is to write representations straight into the contract — clean title, no hidden debts, no third-party claims — and tie them to indemnification with a survival period long enough for tax and litigation tails to surface. The right construction isn't "the seller wrote a letter," but "the contract has representations plus indemnification plus a price holdback."

3. Deferred payment. Escrow — part of the price held by an independent agent, released after a warranty period or when no claims have surfaced. In global practice, 10–20% of the price is held for 12–24 months against the tax and litigation tail (the share is usually lower on large deals). Earn-out — part of the price tied to the business's future metrics; here it's essential to build in protection against KPI gaming on both sides.
4. Conditions precedent, or walking away — fix the breach before closing, or exit if the risk can be neither priced nor transferred.

This is the stage where DD findings turn into money. By practitioners' estimates, a significant share of deals surface material discrepancies, and the resulting price correction is often measured in tens of percent. Settling through an independent guarantor is escrow and deal support; structuring cross-border deals and compliance, when foreign jurisdictions and sanctions risk enter the chain, is the finance and compliance side.

Cost, timelines, and when to call in professionals#

Reference points (they depend heavily on scale, so ranges):

• The express screen above — a day of your own time and a few dollars in fees.
• A quality of earnings report on a small business — the financial core of DD — typically $10,000–$35,000 from providers serving acquisitions under $10 million, more for larger companies.
• Full DD — financial, tax and legal streams together, with lawyers and accountants — scales from there and takes weeks, not days.
• Where a QoE report would eat a noticeable share of the price, a careful self-run express screen plus a lawyer on the purchase agreement is often enough.

What's changed this year: AI-powered virtual data rooms have become the 2026 norm. Documents are auto-classified, key terms and risks surfaced, and multilingual search runs across contracts. Vendors building these platforms (V7 Labs, for one) estimate the routine part of the check speeds up by 60–80%. For the buyer that means the mechanical part of DD gets cheaper, while value shifts to where a human is needed — interpreting findings and checking the people behind the company.

When to call in professionals, no question: a complex tax history, a cross-border structure, a dispute over earnings quality, signs of asset-stripping or nominee ownership. The express filter clears out the obviously dead deals; anything that passes the filter and is worth serious money deserves a full check.

---

Checking a company before a deal is, above all, a check on people and money — not a retelling of the registry. Start with the one-day express screen: it's free and clears out the obviously dangerous deals. Anything that passes the filter and is worth serious money deserves a deeper look — we run those checks, including the layer a standard audit never reaches: beneficiaries, management, and reputation.