Due diligence in a UK SME acquisition typically runs 4-9 weeks across five workstreams: financial, legal, commercial, tax, and operational. The buyer''s aim is to verify the target is what the seller claims and to identify the risks that warrant warranties, indemnities, or price chips.

This guide is the buyer''s checklist — what to test, what evidence to look for, and which findings warrant deal action.

When DD happens

Due diligence runs between Heads of Terms (the non-binding term sheet) and Share Purchase Agreement signing. The exclusivity period agreed in Heads (typically 6-12 weeks) is the time the buyer has.

The buyer pays for their own DD. Cost for a UK SME acquisition under £5M: typically £25-£75K across all workstreams. Worth it — the alternative is buying a problem.

Financial DD (the foundation)

What to verify

• 3 years of statutory accounts — audited where applicable, with a clear bridge to management accounts.
• 24 months of monthly management accounts — reconciled to statutory accounts.
• Quality of earnings — strip out one-offs, owner-discretionary items, related-party transactions to arrive at "normalised EBITDA".
• Working capital trends — debtor days, creditor days, stock turn, working capital seasonality.
• Cash flow — actual cash vs reported profit; any large mismatch needs explanation.
• Banking facilities — overdraft, loans, asset finance, personal guarantees.

Red flags

• Revenue concentrated in one customer (>30%) without long-term contract.
• Sharp revenue growth in the year before the sale (potential channel stuffing).
• Working capital deterioration trend.
• Cash significantly lower than reported profit (potential aggressive revenue recognition).
• Related-party transactions on unclear terms.

Standard buyer tactics

• Top-customer revenue analysis: top 10 customers, retention, revenue trend each.
• Aged debtors and creditors review for unusual delays.
• Bank reconciliation walk-through to confirm reported cash.
• Margin walk: gross margin trends, by product/service line.

Legal DD

What to verify

• Corporate structure — Companies House records vs claimed structure.
• Share register and cap table — match Companies House, properly executed allotments.
• Articles of Association and Shareholders Agreement — restrictions on share transfer, drag-along, tag-along.
• Material contracts — customer, supplier, partnership, lease. Any change-of-control triggers?
• Employment matters — employment contracts, key-personnel arrangements, dispute history, employee benefit schemes.
• IP register — who owns what, are assignments in place from employees and contractors.
• Litigation history — current, threatened, recent. Statutory dispute resolution proceedings.
• Insurance — current cover, claims history.
• Regulatory compliance — relevant sectoral regulation, AML if applicable, data protection.

Red flags

• IP held personally by founders rather than the company.
• Change-of-control clauses in customer contracts that could terminate on sale.
• Personal guarantees from founders that may not transfer.
• Unresolved employment claims or HR investigations.
• Missing or incomplete employee contracts.
• Regulatory complaints or investigations.

Commercial DD

What to verify

• Market positioning — competitor analysis, market share, market growth.
• Customer concentration — top customer share, customer churn, customer references.
• Customer contracts — terms, renewal cycles, change-of-control clauses.
• Pipeline and growth narrative — is the projected growth realistic, with evidence?
• Pricing power — can the business raise prices? What''s the customer''s alternative?
• Sales process and conversion — how does the business win new customers?

Red flags

• High customer concentration with month-to-month terms.
• "Pipeline" claimed as imminent but with no contractual evidence.
• High customer churn masked by new-customer wins.
• Major customer relationships personal to founders.

Standard buyer tactics

• Customer reference calls — 5-10 customers including some recent wins, some long-term, some lost ones.
• Win/loss analysis on the last 20 prospects.
• Cohort retention analysis (especially for SaaS).

Tax DD

What to verify

• Corporation Tax — recent returns filed, payments up to date, any open enquiries.
• VAT — registration correct, returns and payments up to date, any open queries.
• PAYE — recent submissions, P11D history, any open issues.
• R&D claims — if any, are they defensible? Were they handled by a credible adviser? Any HMRC enquiries?
• Tax structuring — has the business made any unusual tax-led arrangements (e.g. dividend strategies, capital allowance claims, IR35 positions on contractors)?

Red flags

• Aggressive R&D claims (especially since HMRC''s 2023 enforcement push).
• IR35 issues — contractors treated as self-employed who arguably should have been employees.
• Backdated dividend declarations.
• Unrecorded benefits in kind.
• Long-running tax enquiries.

Operational DD

What to verify

• People — key personnel and their commitment, plans, succession.
• Systems and IT — software stack, security, scalability, technical debt.
• Operations and processes — documentation, SOPs, dependency on key people.
• Premises — lease terms, break clauses, alternative options.
• Suppliers — concentration, key supplier terms, alternatives.

Red flags

• Key staff likely to leave post-sale (typical sale-driven departures within 6-12 months).
• IT systems on end-of-life software or with major security gaps.
• Single supplier with no realistic alternative.
• Founder personally holds critical operational knowledge with no documentation.

Prioritising findings

Every DD process turns up findings. The buyer''s job is to triage:

Deal breakers

Risks so material they would change the decision to buy. Examples: ongoing tax enquiry of unknown size, fundamental IP ownership issue, regulatory action threatening the licence to operate.

Price chips

Material risks that warrant a reduction in price. Examples: customer concentration risk, deferred maintenance / capex shortfall, working capital adjustment needed.

Warranty / indemnity items

Risks the seller agrees to take responsibility for in the SPA. Examples: known tax exposures, ongoing litigation, contract change-of-control issues.

Information items

Findings noted but not acted on — typically things you''ll fix post-acquisition.

The seller will push back hard on price chips. Be specific about why each chip is warranted, with evidence. Vague "I''m uncomfortable" rarely succeeds.

After DD: the SPA

Findings feed into the Share Purchase Agreement:

• Warranties (statements by the seller about the company''s position) covering each material area.
• Indemnities (specific commitments by the seller to pay) for known issues.
• Working capital adjustments for any DD-identified deficiency.
• Specific carve-outs in the price for risks identified.

The standard structure: seller warrants everything; the disclosure schedule lists every known exception. What''s NOT disclosed becomes a warranty claim if it turns out to be material.

What to do if you''re a first-time buyer

• Engage a corporate finance adviser and an M&A solicitor early.
• Specifically engage a tax adviser for the tax DD if the target is over £2-£3M EBITDA.
• Don''t skip DD on smaller deals to save money. The cost of a hidden problem dwarfs the cost of finding it.
• Use the DD process to negotiate, not just to verify. Findings = leverage.