What Buyers Actually Look For in 2026 Due Diligence
29 April 2026
Author: Omar Badr
Author: Omar Badr
Buyer due diligence in 2026 is not one investigation. It is seven distinct workstreams running in parallel, each with its own team, its own questions, and its own price impact. Sellers who treat due diligence as a single process miss the workstream costing them the most. This article gives sellers a workstream-by-workstream view of what buyers actually look for in 2026 due diligence, what cleanliness is worth at the closing table, and what friction costs.
What buyers look for in 2026 due diligence is evidence that earnings are real and repeatable, working capital is normal, customer revenue is durable, AI exposure is bounded, add-backs are defensible, technology is secure, and the business will run after the owner leaves.
Modern buyer due diligence is structurally different from the process most sellers prepared for in 2020. Across the engagements we have supported, the workstream count has grown from four to seven, and each workstream now has its own dedicated team in serious bidders. The seven workstreams are: financial Quality of Earnings, working capital and net debt mechanics, customer concentration and revenue quality, AI vulnerability, EBITDA add-back defensibility, technology and cyber, and human-capital transferability. Each can compress or sustain valuation independently. Sellers who collapse the seven into one undifferentiated “due diligence” bucket lose visibility into which workstream is costing them the most.
The financial Quality of Earnings workstream is the heart of buyer due diligence and the place sellers leave the most value on the table. The goal is to normalize reported EBITDA by removing one-time events, owner perks, and aggressive accounting — producing a sustainable earnings figure that buyers will pay a multiple on.
What buyers test: revenue recognition timing, the quality of the cash conversion cycle, the durability of recurring versus one-time income, and the supportability of every add-back. Embarc Advisors reports that sell-side QoE reviews typically uncover at least $100k — and sometimes $1M+ — in EBITDA adjustments, even for companies doing under $5M EBITDA. At a 10x multiple, that is $1M to $10M+ of enterprise value the seller would otherwise concede to the buyer’s post-LOI normalization.
The “cash-free, debt-free” headline price hides a second negotiation that determines what the seller actually receives at close. The working capital peg is the negotiated normal level of working capital the seller must deliver at closing; deliver less, get less. Net debt items — leases, deferred compensation, capital expenditure backlogs, customer deposits — directly reduce equity value at the closing table.
What buyers test: the trailing twelve months of working capital seasonality to set a defensible peg, the classification of every debt-like item, and the treatment of cash held in foreign subsidiaries or restricted accounts. The mechanics are technical, and sellers who arrive without a pre-built peg model usually accept the buyer’s first proposal.
Buyers test customer concentration with sharper sensitivity in 2026 than at any prior point. The framework is mechanical: top-five customer revenue percentage, top-ten percentage, contract length distribution, change-of-control clauses by customer, and historical churn by cohort. A target with 40% of revenue concentrated in two customers faces multiple compression unless the contracts include change-of-control protection and multi-year minimums.
What buyers test: the cohort retention curve (do customer vintages improve or degrade over time?), the revenue distribution by customer (is concentration a feature or a bug?), and the contract terms governing what happens when ownership transfers. Strong cohort retention with diversified concentration sustains a premium multiple; weak cohort retention with concentrated revenue triggers earnouts and holdbacks.
AI vulnerability has joined the workstream list as a standalone since 2025, and it is causing meaningful deal mortality. Bain & Company’s 2026 M&A Report found that one in five strategic dealmakers walked away from a deal because of the anticipated impact of AI on the target’s business, with AI adoption for M&A more than doubling to 45% of practitioners.
What buyers test: the four AI vulnerability axes — model dependency on third-party LLMs, data moat strength, agentic substitution risk, and AI talent concentration. The pattern we see most often is that targets with high exposure to seat-based, repetitive workflows face the most aggressive scrutiny, while targets with mission-critical, regulated, or audit-trailed outputs sustain premium valuations.
EBITDA add-backs are the bridge between reported earnings and the normalized number buyers actually pay a multiple on. Defensibility is the workstream that determines which add-backs survive QoE and become part of the deal multiple, and which get stripped out before pricing.
Add-backs that consistently survive: documented one-time events with paper trails (litigation settlements, restructuring charges, plant flood expenses), discretionary owner compensation above market rate, owner family member payroll above market, and properly disclosed related-party transactions. Add-backs that consistently fail: “unusual” items recurring every two to three years, normalization adjustments unsupported by source documents, and aggressive run-rate adjustments based on a single quarter’s performance.
The economic stakes are direct: a $200K add-back surviving QoE adds $1.2M of enterprise value at a 6x multiple, and getting stripped out subtracts the same. Sellers who pre-document every add-back at the line-item level capture the value; sellers who present add-backs as a summary table concede most of them.
Cyber risk has moved from a checklist item to a deal-breaker workstream in 2026, particularly in deals above $25M enterprise value. Buyers run formal pre-deal cyber assessments — penetration testing, controls inventories, incident histories, and data mapping — and translate findings into representations, warranties, and pricing adjustments.
What buyers test: incident history and disclosure completeness, controls maturity (typically benchmarked against NIST CSF or ISO 27001), data classification practices, third-party data processor agreements, and AI-specific data handling controls. Material findings translate directly into indemnity caps, escrow amounts, and sometimes deal-killer status if the buyer cannot underwrite the risk.
The seventh workstream is the most underappreciated. Buyers test whether the business can sustain performance after ownership changes — whether the founder is replaceable, whether key customer relationships exist independently of specific people, and whether documented processes survive a leadership transition.
What buyers test: organizational depth below the C-suite, documentation of standard operating procedures, key person retention plans, and the distribution of customer and supplier relationships across the team. Targets with deep management depth and documented processes sustain premium multiples; targets where the founder personally holds key relationships and tribal knowledge face structural earnouts and rollover requirements that delay seller liquidity by years.
The pre-LOI window is where seller leverage lives. Once the LOI is signed, every adjustment the buyer proposes — working capital target, escrow size, indemnity caps, earnout structure — is a one-sided negotiation, because the seller has walked away from competing bids.
Bayes Business School and SS&C Intralinks’ analysis of more than 900 global M&A transactions found the average pre-announcement due diligence period — from VDR opening to public deal announcement — has stretched to 203 days, up from 124 days a decade ago. That is a 64% increase. Preparation quality directly affects how much of that time works for the seller versus against them.
A structured 90-day pre-LOI preparation runs all seven workstreams in parallel. The sequence below is what we recommend across sell-side engagements; deeper preparation timelines (180+ days) handle the same workstreams with more cushion, but 90 days is the practical floor for a defensible posture.
As we cover in our pillar on Quality of Earnings adjustments for M&A deals, the financial workstream is the foundation — but it is no longer sufficient on its own. The seven-workstream structure of 2026 diligence demands seven-workstream preparation.
For readers exploring this further:
4.4 / 5
