Your Australian Business Due Diligence Checklist

The contract is on your desk. The seller wants a quick signature, the numbers look workable at first pass, and the actual risk sits in what has not yet been tested. In that moment, a due diligence checklist is not an administrative exercise. It is the discipline that checks earnings quality, exposes hidden liabilities, and shows whether the deal still stands up once ATO, ASIC, Fair Work, ACCC, and industry-specific obligations are brought into view.

Australian transactions need local judgement. A buyer may be taking on unpaid super, payroll tax exposure, leave liabilities, data security gaps, equipment finance commitments, or consent requirements buried in customer and supplier contracts. In medical practices, I look closely at Medicare billing processes, service entity arrangements, practitioner agreements, and privacy controls. In SMEs, working capital settings, customer concentration, PPSR issues, and award compliance often drive price and deal structure. In NFPs, the position on ACNC obligations, funding conditions, deductible gift recipient status, and board governance can matter as much as profit.

Good diligence gives you options. It supports a cleaner valuation basis, a more realistic offer, tighter warranties and indemnities, or a decision to step away before settlement. If you need an informed price view before negotiations harden, a business valuation for an Australian acquisition helps frame the review around value, not just disclosure.

Cross-border comparisons also matter. The legal mechanics, tax settings, and filing requirements in Australia differ from the process for purchasing an Ltd company in the UK, so buyers should avoid importing offshore assumptions into a local deal.

Attribution: Panbo Ye, CFP® | FCPA | SSA® | Founder, Everglow

Who this article is for: Australian buyers, founders, professionals, advisers, medical practice operators, SMEs, and not-for-profits assessing a business or asset purchase. For a narrower overseas sale context, see this guide for FedEx ISP owners selling.

Table of Contents

• 1. Financial Due Diligence
• 2. Tax Due Diligence
  • Where buyers often get caught
• 3. Legal and Regulatory Compliance
• 4. What Is the Commercial and Operational Viability?
• 5. People and Culture
  • Entitlements are only the starting point
• 6. IT, IP, and Cybersecurity
  • What to inspect before you assume continuity
• 7. Sector-Specific Checkpoints
  • Different sectors, different traps
• 8. Guidance and Tools
  • A practical scoring lens
• 9. Australian Worked Example
  • What Dr Sharma should test first
• 10. FAQ
• 10-Point Due Diligence Checklist Comparison
• From Checklist to Confidence

1. Financial Due Diligence

Settlement is six weeks away. The draft accounts show healthy profit, the owner speaks confidently, and the bank is comfortable. Then the buyer tests cash conversion and finds overdue debtors, financed equipment recorded as if it were unencumbered, and margins flattered by one-off cost timing. That is why financial due diligence has to do more than confirm that accounts exist. It has to test whether earnings, assets, and working capital will hold up after completion.

For an Australian transaction, the starting point is usually three to five years of profit and loss statements, balance sheets, cash flow reports, management accounts, finance agreements, aged receivables and payables, and lodged tax returns. Those records should then be reconciled against BAS reporting, bank statements, debtor collections, stock records, and asset registers. ATO-facing records matter here because unexplained differences between accounting income, GST reporting, and cash movement often point to a control problem, not a clerical one.

The principles of verifying revenue and assets are universal, though the specifics change by industry, as shown in this guide for FedEx ISP owners selling.

What I look for first is earnings quality. A business can report acceptable profit and still be a poor acquisition if revenue is concentrated, gross margin moves around without explanation, or working capital has to be topped up every quarter to keep operations stable. For SMEs, that often means checking whether the reported result depends on founder underpayment, irregular personal expenses through the business, or aggressive year-end adjustments. For medical practices, it means separating practitioner-generated fees from practice-owned income and checking whether billings are sustainable if a key doctor leaves. For NFPs, the issue is often different again. Surplus or deficit may say less than grant conditions, restricted funds, and the reliability of recurring funding.

A sensible file review usually covers these points:

• Revenue verification: Reconcile sales in the financial statements to bank deposits, debtor ledgers, BAS figures, and major customer contracts.
• Earnings adjustments: Identify one-off income, deferred expenses, owner benefits, and unusual related-party charges before accepting any normalised EBITDA figure.
• Asset position: Physically inspect vehicles, equipment, fit-out, and stock where they drive value. Confirm ownership, condition, useful life, and any PPSR or finance exposure.
• Working capital: Test debtor ageing, bad debt history, creditor stretch, stock obsolescence, and seasonal cash demands so the purchase price is not agreed on a misleading month-end snapshot.
• Debt and contingent claims: Review leases, equipment finance, bank covenants, guarantees, and any commitments that will survive completion.

One warning sign deserves direct attention. If a seller cannot produce clean reconciliations between management accounts, statutory accounts, and source records, the buyer should assume more review is needed before price and warranty settings are finalised.

Where valuation is contested, the financial review should feed directly into deal terms. Buyers often focus on headline price and leave the harder work for later, but the better discipline is to tie findings to specific protections. That may mean a lower price, a working capital adjustment, retained funds at settlement, or warranty and indemnity drafting targeted to receivables, stock, or asset title. Everglow's business valuation services can help where purchase price, earn-out settings, or asset allocation need a defensible basis.

Director conduct and financial reporting discipline also matter at this stage, especially where there are signs of unpaid super, withheld amounts, or related-party movements that may not have been handled properly. Those issues can spill from financial review into personal exposure for controllers, which is why buyers should understand the practical risk areas covered by these Australian promoter penalty laws and tax super compliance rules.

The job is verification. If cash flow, asset value, and maintainable earnings only make sense on the seller's assumptions, the buyer does not yet have a reliable deal.

2. Tax Due Diligence

Tax due diligence is where hidden liabilities often surface. In Australian transactions, that usually means reviewing income tax positions, GST treatment, PAYG withholding, superannuation compliance, payroll tax exposure depending on the state and structure, and whether the target has lodged consistently and accurately with the ATO and other authorities.

One practical baseline is BAS review. For tax due diligence on a business purchase, at least three years of Business Activity Statements should be examined to verify GST reconciliation to the financial statements, the GST treatment of revenue and expenses, and any unpaid GST liabilities or amended BAS lodgements that may point to unresolved exposure, as noted in this Australian business purchase due diligence guidance.

Where buyers often get caught

A Sydney buyer like Wei, especially if new to Australian business settings, may focus on profit and miss tax posture entirely. That's risky. A business can appear commercially sound while carrying poor GST coding, unremitted withholding, or superannuation issues that complicate settlement terms and post-completion cash flow.

A sensible review usually includes:

• BAS and GST testing: Confirm GST reported aligns with the financial statements and identify amended lodgements.
• PAYG and super checks: The financial review should verify that withholding and super payments are current.
• Structure review: Consider whether the existing entity and tax settings still suit the buyer's intended ownership structure after completion.

If the seller's arrangements look aggressive, inconsistent, or undocumented, that's often the point to slow down and tighten contract protections. Buyers dealing with sensitive tax governance issues may also need to understand the broader compliance posture around high-risk tax behaviour and intermediary exposure. Everglow's article on promoter penalty laws and tax super compliance is a useful companion if the transaction raises concerns about how prior advice was framed or implemented.

Tax issues rarely stay neatly in the tax file. They often spill into valuation, warranties, indemnities, and timing.

A sound tax review helps you price the business you're buying, not the one implied by incomplete lodgements or optimistic accounting treatment.

3. Legal and Regulatory Compliance

Settlement is booked for Friday. On Wednesday, the buyer learns the lease requires landlord consent, the practice accreditation sits with a related entity, and a key licence cannot be transferred on completion. The issue is no longer a legal tidy-up. It is whether the business can keep trading on Monday.

That is why legal due diligence in Australia needs to test continuity as well as title. ASIC extracts, PPSR registrations, business name records, material contracts, court searches, licences, permits, and regulatory correspondence all matter. So do Fair Work issues, privacy obligations, and industry-specific approvals that attach to a particular entity, location, or responsible manager.

For medical practices, I look closely at accreditation status, practitioner arrangements, privacy controls, and whether the operating model creates exposure under AHPRA, Medicare, or records-handling requirements. For SMEs, the pressure points are often lease terms, personal property security interests, standard form contracts, and consumer law complaints. For NFPs, constitution settings, ACNC obligations, deductible gift recipient status where relevant, and board approval pathways can change what a buyer is acquiring.

A sensible review usually covers four areas:

• Corporate authority and ownership: Confirm the seller has power to sell, the shares or assets are correctly held, and no related party interests or undocumented side arrangements sit outside the sale documents.
• Transferability: Check which licences, accreditations, leases, supplier contracts, funding agreements, and software subscriptions need consent, notice, novation, or reissue.
• Regulatory history: Review litigation, threatened claims, regulator correspondence, Fair Work issues, privacy complaints, and ACCC-related conduct that could lead to post-completion cost or reputational drag.
• Control changes: Test whether a change in directors, shareholders, trustees, or responsible persons triggers a breach, review event, or approval requirement.

The trade-off is practical. A defect does not always justify walking away. It may justify a longer completion timetable, a holdback, a condition precedent, or a staged handover with the seller carrying part of the transition risk.

Governance quality often decides how painful that process will be. Buyers who need a clearer view of board controls, delegated authority, policy settings, and regulator readiness should review Everglow's governance and compliance advisory.

Cross-border or highly regulated operators also benefit from looking at comparable control frameworks overseas. For healthcare-related compliance discipline, Simbie AI's 2025 compliance guide is a useful reference point on how tightly regulated environments treat documentation, access, and operational accountability.

Legal due diligence should answer a simple question: can this business keep operating lawfully, with the same revenue engine, after control changes hands?

4. What Is the Commercial and Operational Viability?

Settlement has just occurred. The numbers looked sound, the legal file was clean enough, and within 90 days revenue slips because the founder still holds the key customer relationships, two suppliers tighten terms, and staff are waiting for direction that no one documented. That is an operational failure, not an accounting one.

Commercial due diligence asks a harder question than whether the business has traded profitably to date. It asks whether the revenue engine, delivery model, and management routines will keep working under new ownership, with normal disruption around handover, financing, and decision-making. In practice, buyers often find the gap between a good business on paper and a business they can run.

For Australian buyers, that review should be grounded in how the business earns money, how work gets done, and which obligations could change costs after completion. A medical practice may look stable until you test practitioner dependency, billing workflows, Medicare administration, and the lease. An SME wholesaler may stand or fall on supplier terms, stock controls, and warehouse discipline. An NFP may have goodwill and demand, but still struggle if grant income is concentrated or reporting capacity is thin.

A practical review usually starts with concentration risk. Identify the customers, referrers, funders, or suppliers the business cannot afford to lose, then test how secure those relationships really are. In a suburban medical practice, that may mean checking whether patients are loyal to the clinic or to individual practitioners. In a trade services business, it may mean examining whether revenue is tied to one builder or project pipeline. In an NFP, it may mean reading funding agreements against actual delivery capability rather than assuming renewal.

Systems deserve the same scrutiny. If management reports arrive late, stock counts do not reconcile, debtor follow-up is inconsistent, or pricing sits in spreadsheets known only to the owner, the buyer is inheriting execution risk. Growth claims should be matched against the operating base. A business cannot sensibly scale if payroll, rostering, billing, procurement, or compliance checks still depend on manual intervention and informal supervision.

Cost structure also needs testing from an Australian operating perspective. Award coverage, overtime practices, contractor usage, superannuation treatment, and rostering discipline can all shift future margin, even where the historic P&L looks acceptable. Buyers who need a clearer read on workforce settings that affect day-to-day operating performance should review employment law compliance support.

The commercial answer is rarely binary. A target may still be attractive if the weaknesses are visible, priced, and capable of correction within a realistic transition plan. That often leads to specific deal responses: an earn-out tied to customer retention, a service agreement with the founder, a working capital adjustment, a phased handover, or a lower multiple to reflect execution risk.

Commercial and operational viability comes down to transferability. If revenue, process control, and management judgment do not transfer cleanly, value should not be accepted at face value.

5. People and Culture

Most public checklists mention employees. Too few treat people risk as a core value issue. That's a mistake, especially in Australian professional services, healthcare, hospitality, and founder-led SMEs where goodwill often sits with staff behaviour, team cohesion, and local reputation rather than hard assets.

Human capital and cultural fit due diligence is often overlooked, yet 68% of Australian mergers fail primarily due to poor workforce integration and cultural mismatch, as noted in the Queensland Government's due diligence guidance context summarised here: buying a business and due diligence guidance. In practice, I see buyers spend hours on equipment and very little time on whether key staff will stay, whether pay settings are compliant, or whether the incoming owner can integrate with the existing culture.

Entitlements are only the starting point

A proper employment review should include contracts, remuneration structures, leave liabilities, superannuation, and transfer arrangements. The business purchase checklist for Australia also requires a full employee entitlement report detailing annual leave, long service leave, and super contributions if employees are being transferred.

For an SME acquisition, the following usually deserve close attention:

• Employment terms: Identify who has written contracts, restraint clauses, incentive plans, or unusual termination terms.
• Entitlement exposure: Confirm accrued leave, long service leave, and super balances before completion.
• Cultural stability: Speak with the people who hold operational memory, not just the owner selling the business.

Buyers wanting to stress-test payroll and workplace settings can also review Everglow's employment law compliance support, especially where Fair Work exposure or staff transfer obligations may affect settlement mechanics.

Field note: A tidy payroll file doesn't prove a stable workforce. It only proves the arithmetic may be tidy.

People due diligence is part liability review and part continuity review. If your value depends on staff staying, their entitlements and their trust both matter.

6. IT, IP, and Cybersecurity

Technology diligence isn't only for software deals. Even a suburban clinic, trade business, or NFP may depend heavily on practice software, cloud records, licence access, domain control, and basic cybersecurity discipline. If those settings are weak, the buyer may inherit disruption risk immediately.

For Australian SaaS and technology acquisitions, technical diligence now mandates assessment of technical debt, intellectual property ownership, and compliance posture against regulations such as GDPR and relevant sector standards, with founder dependence treated as a material transfer risk in the deal framework, according to this technical due diligence guide. The principle travels well beyond SaaS. If the business can't show clear ownership of code, content, trademarks, domains, or critical data systems, the asset may be less transferable than it appears.

What to inspect before you assume continuity

A buyer should identify who controls the systems, who holds administrator access, whether backups are tested, and whether the target can evidence IP ownership from employees and contractors. In a medical setting, software and data handling may also touch privacy obligations and business continuity in a way that directly affects patient service and goodwill.

• Check ownership documents: IP created by contractors needs valid assignment, not assumptions.
• Map key systems: Know which products run billing, records, payroll, and customer communication.
• Review access control: Shared logins and seller-only administrator rights are common and avoidable transition problems.

Where ownership or protection of intangible assets is central, Everglow's intellectual property protection guidance can help frame the review.

If the business runs on software, data, or know-how, the buyer should treat digital control as a core asset, not a side issue for the IT team later.

7. Sector-Specific Checkpoints

A due diligence checklist should be customized to the target, not pasted in unchanged from another deal. Medical practices, property structures, family businesses, and not-for-profits each have pressure points that generic lists tend to miss.

For property-related acquisitions or trust-held assets, local market checks matter. In Australian property due diligence, recent sales within one kilometre over the last six months are a key comparison point, and vacancy rates provide a useful signal, with rates above 3% indicating softer conditions and below 2% indicating stronger demand, according to this Australian property due diligence checklist. Property buyers also need to verify approved council works and pending development applications because unapproved renovations or nearby projects can materially alter the investment case, as noted in this Australian property due diligence guide.

Different sectors, different traps

The Nguyen family in Parramatta buying through a property trust will care about title, strata, local vacancy, approved works, and contract review timing. Castle Medical will care about doctor arrangements, patient continuity, lease assignment, software access, and staff entitlements. An ACNC-registered charity looking at a merger may care more about constitution fit, restricted funds, governance obligations, and board control.

• Medical practices: Review practitioner agreements, billing workflows, software access, lease terms, and regulatory fit.
• Property-linked structures: Check title, strata, council approvals, development activity, and independently verified rental assumptions.
• NFPs: Review governing documents, deductible gift recipient status where relevant, grant conditions, and governance continuity.

The right checklist is industry-aware. Generic diligence often misses the exact issue that later becomes expensive.

8. Guidance and Tools

A due diligence checklist works best when it's run as a managed process. Buyers need a request list, document control, responsibility lines, escalation points, and a way to separate fixable issues from deal-breakers. Without that structure, teams drown in documents and miss the matters that affect price and risk allocation.

The most useful discipline is risk ranking. I usually sort findings into three groups: issues that change valuation, issues that change legal terms, and issues that can be fixed operationally after completion. Not every problem should stop a transaction. Some should reduce price, delay completion, or trigger a special condition.

A practical scoring lens

Use plain categories rather than elaborate formulas. That keeps the process understandable for owners, lenders, legal advisers, and family decision-makers.

• High priority: Revenue verification gaps, unpaid tax, licence transfer problems, undocumented IP, major entitlement exposure.
• Medium priority: Process weaknesses, incomplete contracts, customer concentration, weak access controls.
• Lower priority: Cosmetic policy gaps and non-material filing irregularities that can be remedied promptly.

Buy time where it matters. Speed is useful only after the critical facts have been verified.

For document control, a secure data room or structured shared drive may help, depending on deal size and confidentiality needs. The point isn't sophistication. The point is traceability. Every issue should tie back to a document, a person responsible, and a decision required.

Good diligence is organised, not theatrical. Buyers don't need more paperwork. They need a clearer decision.

9. Australian Worked Example

Dr Anya Sharma is considering the acquisition of Castle Medical, a GP partnership in suburban Sydney, for an indicative price of $1.2 million. The practice has three GPs, five administrative staff, and leased premises. On first review, the business looks stable, but the due diligence checklist changes what deserves attention.

The first pass would test financial consistency against lodged records, doctor billing patterns, and working capital quality. Then the review should move quickly to workforce and continuity questions, because a medical practice's value often depends on doctor retention, reception capability, software continuity, and lease security more than on furniture or fitout.

What Dr Sharma should test first

A practical review for Castle Medical would include verification of tax and BAS positions, employee entitlement reports, lease assignment terms, software administrator control, and the transferability of doctor arrangements. If the practice depends on one partner for referral relationships or operations, that should be treated as a pricing and handover issue, not a soft concern.

• Financial records: Reconcile earnings with lodged reporting and identify any unusual adjustments.
• Staff exposure: Confirm annual leave, long service leave, super contributions, and role dependency.
• Operational control: Check who controls practice software, patient communications, and premises access.

If Dr Sharma discovers that one GP drives a large share of patient demand and hasn't committed to stay, she may still proceed. But the prudent response could be a lower price, deferred consideration, or specific retention conditions before settlement.

In a medical acquisition, diligence should follow continuity of care and continuity of cash flow. If either is fragile, the structure of the deal may need to change.

10. FAQ

How detailed should a due diligence checklist be for a small Australian business purchase?
It should be detailed enough to verify the numbers, ownership, staff obligations, contracts, and compliance settings that drive risk. Small businesses often have less formal documentation, so buyers may need more verification, not less. Informality isn't itself fatal, but it does mean more assumptions need to be tested before signing.

What documents should I ask for first?
Start with financial statements, tax returns, BAS, key customer and supplier contracts, employee records, lease documents, ASIC records, and evidence of licences or approvals. If the business depends on software, brands, or specialist know-how, request IP ownership and system access details early rather than leaving them until the end.

Can I rely on the seller's summaries and agent commentary?
Only as a starting point. Important matters should be verified independently. That's particularly true for revenue, employee liabilities, asset ownership, legal compliance, and any future-looking assumption used to justify price. A seller summary may be accurate, but the buyer still needs evidence that stands up if conditions change after completion.

Does due diligence only matter for share sales?
No. It matters in both share sales and asset sales, although the focus changes. In a share sale, you may inherit more historical liabilities. In an asset sale, transfer mechanics, consents, staffing treatment, and tax outcomes may need closer attention. The checklist should match the structure being proposed.

When should legal and tax advisers come in?
Earlier than many buyers expect. A solicitor should review the contract before signing, not after. Tax input also matters before heads of agreement become too fixed, because tax treatment, entity choice, and transaction structure may affect what the deal is worth and how risk should be allocated.

10-Point Due Diligence Checklist Comparison

From Checklist to Confidence

A due diligence checklist is valuable because it converts excitement into evidence. This is the key transformation. Instead of relying on seller confidence, industry chatter, or broad assumptions, you build a grounded picture of the business how it operates. For Australian buyers, that picture should include tax lodgement discipline, ASIC and licence checks, staff entitlement exposure, contract transferability, digital control, and the commercial realities that keep revenue stable after completion.

In practice, the best due diligence work is calm and selective. It doesn't chase every minor imperfection. It focuses on what changes value, what changes deal structure, and what could impair continuity once the buyer takes control. Some findings justify a price reduction. Some justify stronger warranties, indemnities, retention conditions, or a delayed completion. Some tell you that a business is sound, but only if you plan the handover properly.

That's especially important in Australian mid-market transactions, medical practices, family business purchases, and founder-led SMEs. These deals often involve a mix of formal obligations and informal operating habits. The tax records may be mostly in order while employment terms are uneven. The legal title may be clean while customer concentration is uncomfortable. The software may function perfectly while access rights remain with the seller. A generic checklist won't always catch those points. A customized one usually will.

Buyers also need to accept a simple trade-off. Thorough due diligence may slow momentum in the short term, but weak due diligence usually creates more expensive delays later. The goal isn't to find a perfect business. It's to understand the one in front of you well enough to make a prudent decision on price, structure, and post-completion planning.

If you're buying as a sole trader, through a family trust, within an SMSF-related structure, or as part of a strategic expansion, your checklist may need to go further into tax, entity design, governance, and regulatory fit. That's where integrated accounting, tax, and advisory input can be useful. The checklist stops being a list and becomes a decision tool.

The core answer is simple: a strong due diligence checklist helps you buy with clearer eyes. It may confirm the deal, reshape it, or stop it. All three outcomes can be good outcomes if they happen before you sign.

If you would like clarity on how these principles may apply to your own circumstances, contact Everglow on 1300 913 929 or email contact@everglow.au.

To book directly: Book a meeting with Panbo.

If you're assessing an acquisition and want integrated support across tax, accounting, advisory, governance, and transaction readiness, Everglow Prosperity may help you evaluate the deal with greater clarity and discipline. Everglow works with medical professionals, small and medium business owners, not-for-profits, fund managers, AFSL operators, Chinese companies, and new migrants establishing themselves in Australia.