Due Diligence Checklist Before Buying a Small Business

You are about to spend your savings on a small business. The seller's numbers look good, but you have one fear: the earnings are wrong and the P&L doesn't match the tax returns or bank deposits. Listing sites like BizBuySell state plainly they have not independently verified any seller information. This page gives you a concrete checklist to protect yourself, then shows how Cortex AIF automates the public-records verification step.

Run a free check →See pricing

1. The Real Due Diligence Checklist (What You Must Do)

Never rely on the seller's word alone. Cross-check every financial statement against official records. Here are the essential steps:

Cross-check financials against tax returns: Request the last 3 years of business tax returns and compare them to the P&L. Discrepancies often reveal inflated earnings.
Verify bank deposits: Ask for 12 months of bank statements. Revenue on the P&L should match deposits. Spikes in the months before sale are a red flag.
Check customer concentration: If one customer accounts for more than 20% of revenue, the business is fragile. Ask for a customer list and verify contracts.
Search for unrecorded liabilities: Check for lawsuits, liens, or unpaid taxes using public court and tax lien databases.
Review domain and online presence: Verify domain ownership history and check for any trademark or copyright issues.
Order a Quality-of-Earnings (QoE) report: This is a forensic reconciliation of the seller's private books by an accountant. It is expensive but essential for larger deals. Cortex comes first as a low-cost pre-screen.

2. Why Self-Reported Trust Signals Are Not Enough

Many listing sites offer paid 'Verified' badges or rely on user reviews. These are self-reported or easily gamed. A seller can pay for a badge or ask friends to leave positive reviews. Independent code-checked evidence beats both. Cortex does not accept seller claims at face value; it verifies each claim against real public records and stamps it VERIFIED, PARTIALLY_VERIFIED, UNVERIFIED, or CONTRADICTED.

3. How Cortex Does This – Code Is the Judge, Not the Model

Cortex is not an LLM that guesses or fabricates sources. It is a code-based verification engine. Here is how it works:

Claim extraction: Cortex reads the business listing and extracts every factual claim (revenue, years in business, number of employees, etc.).
Source matching: It searches real public records – company registries, SEC filings, domain WHOIS, court records, review platforms – to find evidence for each claim.
Verification stamp: Each claim gets a stamp: VERIFIED (source found and matches), PARTIALLY_VERIFIED (some evidence but not full), UNVERIFIED (no source found), or CONTRADICTED (source contradicts the claim).
Anti-fabrication: Any number without a source proof is deleted. Cortex never invents data.
GO / NO-GO: You get a clear verdict with per-claim evidence, so you know whether it is worth paying for a full QoE.

4. Contrast: ChatGPT vs. Cortex for Due Diligence

You might ask ChatGPT for advice. ChatGPT answers from old memory, reassures you, and can fabricate sources. It cannot open the live record or check a specific business's claims. Cortex, on the other hand, opens the live record – it checks the actual company registry, the actual tax lien database, the actual domain history. It does not guess. It returns evidence you can verify yourself.

5. What Cortex Does NOT Do (Be Honest)

Cortex is a pre-screen for public records. It does NOT reconcile the seller's private books – that is the job of a Quality-of-Earnings report done by an accountant. Cortex tells you if the business's external claims hold up. If they do not, you save the cost of a QoE. If they do, you proceed with confidence. Cortex is the first step, not the last.

6. Get Your GO / NO-GO Before You Pay for a QoE

Don't spend thousands on a Quality-of-Earnings report for a business that fails basic public-record checks. Use Cortex first. Enter the business name or URL, and within minutes get a verification report with per-claim evidence. If the business claims are contradicted or unverifiable, you get a NO-GO and move on. If they are verified, you know it is safe to invest in the full QoE. Start your due diligence with Cortex.

Run a free Home > Resources > Due Diligence Checklist check

Describe your setup or paste your documentation. Get a sourced, per-requirement status in minutes.

Start free check

Frequently asked questions

What is the most important step in due diligence for a small business?

Cross-check the seller's financial statements against tax returns and bank deposits. If the P&L shows higher earnings than the tax returns, the seller may be inflating numbers. Also verify customer concentration and check for unrecorded liabilities.

Can I trust a 'Verified' badge on a business listing?

No. Many listing sites offer paid badges that are self-reported. They are not independently verified. Cortex checks claims against real public records and stamps them VERIFIED only when source evidence is found.

How is Cortex different from asking ChatGPT for due diligence advice?

ChatGPT answers from old memory and can fabricate sources. It cannot check a specific business's claims against live records. Cortex opens the live record – company registries, court records, domain history – and returns evidence for each claim.

Does Cortex replace a Quality-of-Earnings report?

No. Cortex is a pre-screen that checks public records. A QoE report reconciles the seller's private books and is done by an accountant. Cortex tells you if the business passes basic public-record checks before you invest in a QoE.