Most SMB buyers think of due diligence as a post-LOI event — the 60–90 days after commitment when the accountants and lawyers go through the financials. That's formal due diligence, and it's necessary. But risk analysis is a pre-LOI activity.
The information needed to identify the five structural risks below is available before a letter of intent is signed. Tax returns, direct seller conversations, the CIM, and basic internet research surface the signals. The buyers who use that information to make a go/no-go decision before LOI close more efficiently, waste less time on deals that were never going to work, and negotiate from clearer positions when they do proceed.
Category 1: Earnings Quality Risk
What it is: The risk that reported SDE overstates the sustainable earnings a new owner can expect — through aggressive add-backs, non-recurring revenue, or financial presentation that doesn't survive lender normalization.
Earnings quality is the foundational risk in any acquisition. Every other category — concentration, key person, debt serviceability — is evaluated relative to the earnings base. If the earnings base is wrong, every downstream calculation is wrong.
The signals that indicate earnings quality risk:
Tax returns diverge significantly from the broker's recast P&L. A $200,000 gap between tax return net income and broker SDE is explainable — add-backs should account for it. A $200,000 gap with minimal documented add-backs suggests either aggressive recasting or creative bookkeeping.
Add-backs are large relative to net income. If a business shows $100,000 in net income and $300,000 in claimed add-backs, nearly 75% of the claimed SDE is from adjustments rather than documented profit. Each add-back should be scrutinized individually.
Revenue is trending or concentrated in a single year. A business showing $1.2M, $1.1M, and $2.3M in revenue over three years — with the ask based on the trailing 12 months — has an earnings quality question that requires explanation before it can be underwritten.
Owner's compensation is below market. An owner paying themselves $40,000 to run a business that realistically requires 60 hours per week is creating an add-back that will partially reverse under new ownership. The replacement manager cost, not the owner's actual draw, is the correct earnings base.
The pre-LOI action: Request three years of tax returns and build your own normalization from them — applying SBA SOP 50 10 8 standards, not the broker's add-back list. The gap between your normalized SDE and the broker's is the earnings quality adjustment you need to negotiate into the price or structure. See what normalized SDE means.
- Tax returns are the baseline — not the broker's recast, not the CIM, not verbal explanations.
- Large add-backs relative to net income (e.g., $300K in add-backs on $100K net income) require scrutiny of each item individually.
- Below-market owner salary is not a neutral add-back — it creates a post-close management cost that must be reflected in the earnings base.
Category 2: Owner Dependence and Transferability Risk
What it is: The risk that the business's revenue, customer relationships, operational knowledge, or regulatory standing are concentrated in the current owner in ways that won't transfer at close.
Owner dependence is the #2 buyer fear in the community data — and the most underestimated risk in standard deal analysis. It doesn't show up in the P&L. A business with fully documented, recurring, diversified revenue that happens to be run by one indispensable person looks financially identical to a business with equally transferable revenue.
The questions that reveal transferability:
Revenue sourcing: Where does new business come from? Is it referral-based (personal network), marketing-generated (channel-based), or repeat/contract-based (relationship-agnostic)?
Customer relationships: Do customers know they're dealing with the business, or do they feel they're dealing with the owner personally? Would they notice if someone else answered the phone?
Operational knowledge: Is there a documented process for the business's core functions? Can someone else execute the owner's role with 30 days of training, or does it require years of context?
Licensing and credentials: Is the business's ability to operate contingent on licenses, certifications, or credentials held personally by the owner? A GC license, a real estate license, a professional engineering stamp — if the owner leaves and takes the license, the business's ability to operate may be impaired.
Transition offer: How long is the seller willing to stay involved post-close? A 30-day transition for a business that required 20 years to build is insufficient. A 12-month earnout with the seller actively managing relationships is meaningful.
Transferability is not a binary — it exists on a spectrum from "fully systematized, any competent operator can run this" to "entirely personal, the business is the owner." Most SMB businesses sit somewhere in between. The risk analysis quantifies where on that spectrum the specific business sits, and what it would take to move it toward the systematized end during a transition period.
The pre-LOI action: Map revenue by source before LOI. Ask the seller directly: "If you were unavailable for 90 days starting at close, what percentage of revenue do you think we'd retain?" The answer — and the seller's comfort with the question — is informative. For sector-specific transferability analysis, see key person dependency risk in construction and SMB acquisitions.
- Revenue sourced through the owner's personal network, relationships, or license has different retention probability than marketing-generated or contract-based revenue.
- A 30-day transition for a business that required 20 years to build is a structure that doesn't match the risk.
- Map revenue by source before LOI — the transferability question has a quantitative answer, not just a qualitative one.
Category 3: Concentration Risk
What it is: The risk that a meaningful portion of the business's revenue, supply chain, or channel relationships is concentrated in a small number of parties — creating vulnerability to a single relationship ending.
Concentration risk is distinct from owner dependence because it can exist even when the business is operationally transferable. A business with strong systems and an excellent management team may still have 40% of its revenue from one customer — a risk that has nothing to do with the owner.
The three forms of concentration:
Customer concentration: One or a few customers represent a disproportionate share of revenue. The threshold that commonly flags lender concern is 20%+ from a single customer; 10%+ in certain industries or lender credit policies. The key questions: How long has the relationship existed? Is there a contract? What is the customer's own financial health?
Supplier concentration: The business depends on a single supplier, distributor, or vendor for key inputs. If that supplier raises prices, changes terms, or exits the market, the business's cost structure changes significantly. This is common in specialty retail, food service, and certain manufacturing contexts.
Channel concentration: The business's revenue flows predominantly through one channel — one platform, one referral source, one sales channel. A business generating 80% of revenue through a single platform (e-commerce, franchise referrals, one large contractor relationship) has channel concentration risk that doesn't appear in the customer list.
The pre-LOI action: Request a customer revenue breakdown — at minimum, the top 10 customers by revenue and their percentage of total. If the seller won't provide this pre-LOI, it's a documentation gap that needs to be resolved before commitment. For customer concentration analysis in SMB deals specifically, see customer concentration risk in SMB deals.
- Customer concentration above 20% in a single customer flags in most SBA lender credit policies and should be reflected in deal structure.
- Supplier and channel concentration are separate from customer concentration — a business can have diversified customers and still depend on one supplier for key inputs.
- Request the top-10 customer revenue breakdown before LOI. Sellers who won't provide it are creating a diligence risk you'll face later.
Category 4: Regulatory and Licensing Risk
What it is: The risk that the business's ability to operate — or its cost structure — is subject to regulatory change, permit issues, license non-compliance, or legal exposure that would materially affect value post-close.
Regulatory risk is underweighted in most buyer analyses because it requires specific knowledge of the industry's regulatory environment. Financial modeling is accessible to any financially literate buyer; regulatory mapping requires sector-specific research.
The sub-categories:
Operating licenses and permits: Does the business hold all required licenses and permits? Are any of them subject to renewal in the near term? Are any of them transferable at close, or must they be re-applied for under new ownership? In some industries (childcare, healthcare-adjacent, alcohol-related), license transfer is not automatic and can delay close by months.
Zoning and lease compliance: Is the business operating in a location where the use is permitted? Are there pending zoning changes that could affect operations? Is the lease assignable at close, and on what terms?
Employment compliance: Does the business have documented employment practices — W-2 vs. 1099 classification, overtime compliance, required postings? Worker classification issues (contractors who should be employees) can create retroactive liability.
Environmental exposure: For businesses with physical operations — shops, auto services, manufacturing, dry cleaners — does the business or its property have any environmental compliance history or potential liability?
Pending litigation: Even a small business can have pending or threatened litigation that creates contingent liability. A standard representations and warranties clause addresses this, but knowing about it pre-LOI allows the buyer to price the risk.
The pre-LOI action: Run a basic regulatory check before LOI: confirm the business's license status through the relevant state or local licensing board, check for public litigation (court records), and ask the seller directly about pending regulatory issues or disputes. For the structured approach to legal risk, see how to uncover legal red flags in business acquisitions.
- License transferability varies by state, sector, and license type — some transfer automatically at close, others require re-application under new ownership.
- Worker classification issues (contractors who should be employees) can create retroactive liability that doesn't appear in the P&L.
- A basic regulatory check before LOI — license status, pending litigation, known compliance issues — takes hours and surfaces risks that take months to resolve in post-LOI diligence.
Category 5: Debt Serviceability Risk (DSCR Analysis)
What it is: The risk that the business's lender-normalized earnings do not support the proposed debt structure — either falling below the SBA's 1.25x minimum DSCR or leaving insufficient margin for operational variability.
Debt serviceability risk is the most directly quantifiable of the five categories. It requires three inputs: normalized earnings (from tax returns), proposed loan terms (amount, rate, term), and the buyer's personal debt obligations. The output is a DSCR figure and a sensitivity analysis showing how the coverage ratio changes under different earnings scenarios.
The two-level analysis:
Static DSCR: Does the deal clear 1.25x at historical normalized earnings? If trailing three-year average lender-normalized SDE is $320,000 and proposed annual debt service is $250,000, static DSCR is 1.28x — marginal, but passing.
Stressed DSCR: What happens to DSCR if revenue falls 10%, 20%, or 30% in the first year post-close? A 20% revenue decline on a business with 70% variable costs produces a different earnings hit than a business with 70% fixed costs. The stressed DSCR tells you how much operational cushion exists before the deal becomes a coverage problem.
Example: DSCR Sensitivity Analysis
| Scenario | Revenue change | Normalized earnings | DSCR (@ $250K debt service) |
|---|---|---|---|
| Base case | — | $320,000 | 1.28x |
| Mild stress | −10% | $275,000 | 1.10x ⚠️ |
| Moderate stress | −20% | $230,000 | 0.92x ❌ |
At a 10% revenue decline, this deal falls below the 1.25x SBA minimum. A 20% decline produces negative coverage. The buyer needs to understand this before LOI — not after 60 days of diligence.
The implication for deal structure: a deal with thin DSCR at the base case needs structural mitigation — larger down payment, seller note, earnout, or price reduction — before it can be safely financed. Discovering the stress case at the lender meeting is a late and expensive time to learn this.
For the full mechanics, see what DSCR SBA lenders actually require.
- Static DSCR tells you if the deal works at the base case. Stressed DSCR tells you how much cushion you have when it doesn't.
- At 70% variable costs, a 20% revenue decline hurts less than at 70% fixed costs — model the cost structure, not just the revenue.
- Run the stress test before LOI. If downside DSCR falls below 1.15x on a 10–15% revenue decline, the deal needs more cushion in price or structure.
Putting the Framework Together
The five categories are not independent — they interact. A business with high owner dependence also has higher earnings quality risk (if the revenue concentration is personal, it's also at risk if the owner leaves). A business with customer concentration also has DSCR sensitivity (if the concentrated customer leaves post-close, the stressed DSCR deteriorates quickly).
The practical application:
Pre-LOI Risk Analysis Sequence
- Normalize earnings from tax returns (Category 1) — establishes the base
- Calculate preliminary DSCR (Category 5) — determines whether the deal is financeable at the ask
- Map owner dependence (Category 2) — identifies whether the earnings base is at risk post-transition
- Check concentration (Category 3) — identifies structural fragility in the revenue
- Run basic regulatory check (Category 4) — identifies known compliance issues before commitment
The output of this sequence is not a pass/fail decision — it's a risk map that drives negotiation. Deals with high owner dependence get earnout provisions. Deals with thin DSCR get seller note or price negotiation. Deals with customer concentration get representations, warranties, and escrow sized to the risk. Deals with regulatory exposure get indemnification and contingency.
No deal is risk-free. The framework doesn't identify perfect deals — it identifies manageable risks, quantifies them, and creates the structure to address them.
Run the full risk analysis before LOI.
Acquidex scores deals across earnings quality, transferability, concentration, and DSCR — producing a structured risk map before you commit.
Analyze a Deal →
-
What are the main risk categories in a small business acquisition?
Answer: Five categories: earnings quality (is the SDE sustainable?), owner dependence and transferability (does value survive a transition?), concentration risk (customer, supplier, or channel), regulatory and licensing risk (operating permits, compliance), and debt serviceability (does DSCR clear at the proposed terms?). Each requires a different analytical approach.
-
When should acquisition risk analysis happen — before or after LOI?
Answer: Preliminary risk analysis should happen before LOI, using the information available at that stage: CIM, three years of tax returns, bank statements, and direct seller conversations. Formal risk quantification — QoE, legal review, full documentation — happens in post-LOI diligence. Using pre-LOI analysis to surface the structural risks means you're negotiating with information, not discovering problems after commitment.
-
How do you quantify owner dependence before LOI?
Answer: Map revenue by source and estimate retention probability under new ownership for each source. Ask the seller directly what percentage of revenue they expect to survive if they're unavailable for 90 days at close. Then model what happens to DSCR if 20–30% of that revenue doesn't transfer.
-
What customer concentration percentage should concern an acquirer?
Answer: Most SBA lenders flag 20%+ in a single customer. Buyers should flag it earlier — at 15%, customer concentration starts to create meaningful revenue risk in a downside scenario. The relevant question isn't just the percentage; it's whether that customer has a contract, how long the relationship has been, and whether the owner manages the relationship directly.
-
What is a DSCR stress test and why does it matter?
Answer: A stress test calculates DSCR at reduced earnings — typically modeling 10%, 20%, and 30% revenue declines. The goal is to identify the floor at which the deal remains serviceable and compare it to historical revenue volatility. A deal with a 1.40x base-case DSCR that drops to 0.95x on a 20% revenue decline is fundamentally different from a deal that holds 1.20x under the same stress. Both show fine on a static analysis.
The Bottom Line
Risk analysis is not the same as due diligence. Due diligence verifies. Risk analysis informs the decision about whether to pursue verification.
The five-category framework above applies to every SMB acquisition regardless of sector, size, or deal structure. The specific signals, the data sources, and the thresholds vary by industry — but the categories don't. Earnings quality, owner dependence, concentration, regulatory exposure, and debt serviceability are the five places where SMB deals consistently fail.
Using this framework before LOI doesn't guarantee deals close. It guarantees that deals proceed because of what you know, not in spite of what you don't.
Related reading:
Avery Hastings, CPA
Founder, Acquidex • CPA • Tokyo, Japan
Avery Hastings is a CPA based in Tokyo, Japan and the founder of Acquidex. She focuses on helping buyers evaluate small-business deals with clear cash-flow logic, realistic downside analysis, and practical diligence frameworks.
Keep up with Avery →Sources
No external sources are cited in this article.
Keep Reading
- What Buyers Actually Fear in SMB Acquisitions: Insights from 767 Community Conversations10 min read read
- Why Small Business Deals Fall Apart Before LOI (And How to Avoid It)12 min read read
- How to Calculate Maximum Offer Price for a Small Business Acquisition12 min read read
- Seller Notes, Earnouts, and Holdbacks: Which Deal Structure Protects You Best?9 min read read
- Stretched Seller Expectations: How Buyers Bridge the Gap Without Overpaying8 min read read
- Laundromat Acquisition Deal Structures, Diligence Checklist, and Valuation17 min read read