The Four Risks That Decide Whether an Acquisition Works

A word on scope

This analysis covers deals from $1M to $100M enterprise value, spanning small business (SMB) through lower middle market (LMM). No public dataset tracks private acquisition outcomes cleanly by EV and NAICS code, so it stitches four source types together, each with its own size bias:

The four cross-cutting mechanisms hold across all sources. Severity numbers skew larger with deal size, and size context is flagged inline. The honest limitation: specific frequency rates below $25M EV are sparse outside SBA data and the Stanford search fund cohorts. The mechanisms validate strongly; precise sub-$25M frequencies do not. Full sourcing is at the end.

What does the failure data actually say by deal size?

At the SMB end, roughly 2% of acquisitions outright default each year; at the LMM and middle-market end, the majority generate post-close disputes and about one in five generates an insurance claim. Buying an existing business beats starting one: SBA 7(a) acquisition loans defaulted at 1.93% in FY2024 versus 2.71% for non-acquisition SBA loans — about 29% lower in default frequency. Higher up the size range, failure changes shape. Over 90% of private-target M&A deals now include purchase-price-adjustment mechanisms (95%+ for PE-backed deals, versus around 50% a decade ago), so post-close disputes are the base rate rather than an edge case.

The part most write-ups miss: the four risks do not operate independently. They compound. Customer concentration plus aggressive leverage is materially worse than either alone. Owner dependency plus an earnout creates a structural conflict in which the seller controls the operations that determine their own payout. The deals that blow up are usually the ones where two or more of these risks were each judged "manageable" in isolation.

Risk #1 — Is the cash flow as durable as the multiple assumes?

Usually less durable than presented. This is the most common failure mode, and it appears in three flavors. First, normalization that does not survive contact with reality: owner-comp add-backs based on optimistic replacement cost, related-party rent that stops when the building is sold separately, "one-time" legal expenses that turn out to be three-time, and personal expenses scrubbed from the P&L that the new owner cannot actually eliminate. Second, a balance sheet managed for the sale: receivables pushed in the trailing quarter, payables stretched, inventory written down, maintenance deferred, marketing pulled forward — all legal, all noise the buyer absorbs. Third, revenue that looks recurring but is not: a strong trailing twelve months because a customer doubled an order once, a pricing increase that has not fully cycled, or a government contract that will not renew at the same terms.

The severity math is what makes this decisive. Aon's 2025 study identifies financial statements as a top driver of paid R&W claim severity in North America; in EMEA, financial-statement breaches alone drive 27% of paid loss. On a 6x EBITDA multiple, a $1M EBITDA shortfall is not a $1M problem — it is a $6M problem, which is the logic behind the multiplied-damages trend: 23% of recent R&W claims allege loss beyond dollar-for-dollar. A common misconception is that a good QoE catches the big stuff; it catches the accounting, but over 90% of private-target deals still require post-close adjustments despite QoE being standard. What QoE often misses is not "are the numbers accurate?" but "are they repeatable?"

Before LOI, the durable tests are: owner comp normalized at realistic market replacement cost; add-backs validated against three years of history rather than the trailing year; working-capital peg methodology, especially AR and inventory reserves (which SRS Acquiom identifies as the two most disputed items); revenue by customer-cohort vintage; and top-quartile versus bottom-quartile customer profitability, since revenue concentration is rarely the same as profit concentration.

Risk #2 — Is the customer base a moat or a single point of failure?

Often the latter, with a friendly tone. The research is unambiguous: peer-reviewed work finds customer-concentrated acquisitions produce lower acquirer returns and weaker long-run operating performance, and Aon's data shows that in manufacturing acquisitions, over 50% of paid R&W loss comes from material contract breaches — performance failures, undisclosed rebates, misrepresented relationships, hidden loss-making contracts.

Three details make concentration trickier than the headline number in SMB and LMM deals. Revenue concentration is rarely the same as profit concentration: a customer at 15% of revenue is often 30–40% of gross profit through volume pricing or mix, so losing them costs closer to half of EBITDA than 15%. Contract language usually offers more outs than the seller advertises: termination-for-convenience clauses with 30–90 day notice, change-of-control triggers activated by the acquisition itself, and pricing-reset rights tucked into "five-year" auto-renewal clauses — the customer can stay, at a price they set. And concentration interacts dangerously with leverage: a buyer funded with 4x leverage on Year 1 EBITDA has roughly one year of covenant headroom, so a 20% customer loss on standard termination notice can trip a fixed-charge coverage covenant before the revenue can be replaced. The customer does not have to act maliciously; they only have to leave on the timing their contract allows.

A competing view — "long relationships mean low risk" — holds only sometimes. Long relationships are evidence of past behavior, not future commitment, and the acquisition itself can be the trigger that makes a 12-year customer re-ask whether the arrangement still works for them. Before LOI: interview the top 10 customers, not the top 3; read every master service agreement for termination, change-of-control, and renewal provisions; build a profit-concentration overlay against revenue concentration; ask each top customer what would have to happen for them to switch; and map share-of-wallet.

Risk #3 — Is the buyer acquiring a company or a person?

The smaller the business, the higher the odds it is a person. Stanford's search fund failure analysis names owner dependency directly — conflict with prior owners, execution gaps, weak management benches — and it comes in three flavors that do not mitigate the same way. Relationship dependency: customers buy from the owner, common in professional services and B2B sales-led firms, producing gradual revenue attrition over 12–24 months rather than a cliff. Technical dependency: the owner holds licenses, certifications, or supplier relationships not transferable on paper — HVAC qualifying-party licenses held individually, prescribing physicians, the one engineer who knows why the legacy system works. Sales dependency: the owner is the rainmaker and pipeline collapse within 12 months is the standard pattern.

The popular fix — the earnout — has an unflattering record. Grant Thornton reports a 26% dispute rate on earnouts, and SRS Acquiom's 2024 Claims Insights Report shows earnouts pay approximately 21 cents on the maximum dollar across all deals (excluding Life Sciences); even for deals with any earnout achievement, about half the maximum is paid.

What works better than an earnout: a second-tier management assessment as a deal-level diligence focus (specifically, who runs this if the owner is hospitalized for six months); retention agreements with key non-owner staff, structured as cash plus equity at performance milestones; knowledge-transfer protocols pre-close rather than vague post-close consulting agreements; and hold-back structures tied to operational milestones — license transfer, customer retention, key-employee retention — rather than EBITDA earnouts.

Risk #4 — Does the capital structure leave room to be wrong?

The deals that reach restructuring are rarely bad businesses bought at bad prices; they are okay businesses bought at okay prices with capital structures that left no margin for error. "Restrictive capital structure" is a recurring theme in unsuccessful search fund acquisitions per Stanford, and OCC commercial credit guidance ties working-capital weakness, leverage, and refinance pressure to elevated bankruptcy risk. What is new is the rate-environment effect, visible across the data: SBA 7(a) acquisition-loan defaults moved from a long-term baseline near 1% to 1.93% in FY2024, and Stanford's search fund cohorts show 2017–2020 vintages reporting IRR above 50% versus 2021–2022 vintages at 23% IRR and 1.5x ROI — same model, same diligence rigor, different cost of capital.

The mechanics worth understanding: fixed-charge coverage covenants trip first because they include interest, principal, and capex in the denominator, making them sensitive to EBITDA misses; working-capital revolvers compress at the worst moment, because deteriorating AR quality shrinks the borrowing base exactly when cash is needed to bridge an issue; and SBA 7(a) loans carry a 10-year ceiling, a serious refinance event at maturity for deals priced at meaningful EBITDA multiples. The interaction problem is the core of it: a typical levered SMB or LMM structure tolerates about a 10–15% EBITDA miss before covenant pressure, and any of the prior three risks can produce a miss of that size inside a quarter. Aggressive leverage maximizes IRR on the deals that work and maximizes pain on the deals that do not — an asymmetry that argues for conservative structures wherever one of the other three risks is elevated, which is most deals.

Before LOI: stress-test the capital structure against a 15% EBITDA decline, a 90-day AR extension, and a 10% inventory write-down, individually and in combination; identify which covenant trips first under each scenario; pre-confirm cure mechanics with the lender before close; and build refinance scenarios at realistic forward rates, not current rates.

How do these risks change by sector?

The four cross-cutting risks are roughly 80% of the failure stack; the remaining 20% is sector-specific packaging, and the severity signals differ:

Sector mechanics hold across SMB and LMM; severity scales with deal size, but the pattern does not.

What are the most common misconceptions?

Three recur. First, "sub-$10M SMB deals are safer because they're simpler." SBA acquisition defaults run ~2% annually at the small end and search fund losses are rising at the $14M median; smaller deals have fewer moving parts but each part is more fragile, with owner dependency materially higher. It is a different risk profile, not a lower one. Second, "R&W insurance covers the diligence gaps." It mitigates loss but does not prevent failure: 8% of paid claims hit policy limits, 32% exceed 40% of the limit, and 23% allege multiplied damages, while below ~$20M EV cost-effective coverage has historically been hard to source. Third, "sector expertise is the moat." Sector expertise handles the 20% wrapper; the 80% structural risk — cash flow, concentration, people, leverage — is industry-agnostic, and Aon's own data shows claim frequency and severity distributed remarkably evenly across sectors.

What are the five things that actually matter pre-LOI?

Regardless of sector or deal size, five checks separate the deals that perform over a 5-to-10-year hold from the ones with the most compelling growth deck:

1. EBITDA quality — owner comp at market replacement cost, add-backs validated against three-year history, revenue cutoff tested at the trailing-twelve-month boundary.
2. Working-capital structure — cash conversion cycle, AR aging, inventory reserves, deferred-revenue treatment, and the proposed PPA peg methodology.
3. Customer durability — top-10 review (not top-3), profit-concentration overlay, contract termination and change-of-control provisions, pricing-reset mechanics.
4. Management bench — succession capability without the seller, retention probability for key staff, individual versus entity-level licensing.
5. Covenant headroom — capacity to absorb a 15% performance miss without tripping anything, refinance scenarios at realistic forward rates.

The actual failure stack is more boring than fraud and lawsuits: cash flow slightly less durable than presented, customer relationships slightly less sticky than claimed, an owner slightly more central than acknowledged, and leverage slightly more aggressive than the moment supports. Boring is what trips up most SMB and LMM deals — and boring is also what a buyer can diligence for.

Sources & method

Primary sources, joined at the market level — directionally solid, not deal-level precise:

• SBA 7(a) program data, FY2024 — acquisition versus non-acquisition default rates (1.93% vs. 2.71%).
• Stanford GSB 2024 Search Fund Study (Kelly & Heston; n=681 funds) — acquisition rate, cohort IRR/ROI, and owner-dependency failure patterns.
• SRS Acquiom — 2024 M&A Deal Terms Study (2,100+ deals, $475B value), 2025 Working Capital PPA Study (1,250+ deals, $298B value), and 2024 Claims Insights Report — PPA prevalence, disputed items, and earnout payout data.
• Grant Thornton 2023 M&A Dispute Survey (150 deal professionals, 3,668 deals) — working-capital (36%) and earnout (26%) dispute rates.
• Aon 2025 Global Transaction Solutions Claims Study (1,100+ NA claims through Q4 2024) — claim frequency, severity, multiplied damages, and sector breakdowns.
• CVSA 2025 International Roadcheck (56,178 inspections) — 18.1% vehicle out-of-service rate.
• Peer-reviewed customer-concentration research; OCC commercial credit guidance — concentration returns and leverage/bankruptcy linkages.

The honest limitation: no public database tracks SMB or LMM acquisition outcomes by EV and NAICS code. The mechanisms validate strongly across sources; specific frequency rates below $25M EV are sparse outside SBA data and Stanford search fund cohorts.