Revenue is the number a seller has the most control over and the one most buyers verify the least. Analyzing SMB revenue during due diligence means cross-checking reported revenue against bank deposits, breaking it into components to measure customer concentration and durability, and translating what you find into a recast earnings figure, an adjusted price, or specific deal terms, before you sign anything binding.
Key takeaways
- Verify revenue against the bank, not just the P&L. A three-way reconciliation of net income, sales, and deposits is the fastest way to catch a number that isn't real.
- Customer concentration risk runs on a gradient, not one line: under 10% from a single customer is healthy, 10% to 20% is a caution zone, 20% to 30% is elevated, and above 30% is severe.
- A full Quality of Earnings report at searcher-sized deals ($500K to $3M EBITDA) typically runs $5,000 to $25,000 and two to four weeks, well below the $30,000-plus mid-market figure most articles quote.
- Most SMB acquisitions under $3M to $5M in enterprise value are valued on Seller's Discretionary Earnings (SDE), not EBITDA. Your revenue findings should feed an SDE recast.
- Revenue red flags don't have to kill a deal. An escrow holdback, a seller note, or a shorter earnout can shift the risk you found back onto the seller instead of forcing a walk-away.
Why Revenue Is the First Thing to Verify
Every other number in a small business acquisition, from EBITDA to SDE to the multiple you're willing to pay, is built on top of reported revenue. If that top-line figure is inflated, wrongly timed, or concentrated in a customer relationship that won't survive a change of ownership, everything downstream inherits the error. Revenue is also the easiest figure for a seller to misrepresent, whether intentionally or not, because it's the one number brokers lead with in a listing and the one owners are most motivated to present favorably before a sale.
That's why revenue verification comes before, not after, the deeper Quality of Earnings work. If the top-line number doesn't hold up to a basic bank reconciliation, there's no point spending thousands of dollars adjusting an earnings figure built on it. The SBA's guidance on buying an existing business makes the same point from the lender's side: financing decisions are built on verified financials, not on what a listing or a broker's summary claims.
Step 1: Gather the Right Documents
You can't verify anything without the source documents, and asking for the wrong set wastes a diligence cycle. Request:
- Three to five years of business tax returns
- Profit and loss statements dated within the last 180 days, plus trailing 12 months monthly
- Bank statements for the same period as the P&L, all operating accounts
- Accounts receivable aging report
- Customer-level revenue detail (or, at minimum, a list of the top 10 to 15 customers by revenue)
- Point-of-sale or payment processor exports, if the business runs on Square, Toast, Shopify, or similar
Cross-referencing multiple sources up front (tax returns against P&Ls, both against bank statements) also flags a mismatch early, before you've invested real time modeling a number that turns out to be wrong.
Step 2: Verify Reported Revenue Against the Bank
Short answer: cross-check the P&L, the tax returns, and the actual bank deposits over the same period. If all three roughly agree, reported revenue is probably real; if they diverge, you need a specific explanation before relying on any of them.
This is commonly called a three-way reconciliation, or proof of cash. Practically, it works like this: pull total revenue from the P&L for a given month, pull total deposits from the bank statement for the same month, and compare. Some gap is normal (timing differences from checks in transit, a large invoice paid a few days into the next period), but a persistent, unexplained gap of more than a few percentage points, month after month, is a signal that reported revenue isn't what actually landed in the business's account.
Two specific things to check while you're in the bank statements:
Revenue recognition timing. A business on accrual accounting can legitimately show revenue on the P&L before cash arrives, if it has real deferred revenue from annual contracts billed upfront. That's a structural, explainable gap. What you're hunting for is the gap that has no consistent explanation, or one that widens unpredictably around fiscal year-end, when a seller has the most incentive to make a number look better than it is.
Deposit sourcing. Not every deposit is revenue. Owner capital contributions, loan proceeds, and asset sale proceeds sometimes get lumped into "sales" categories in less disciplined bookkeeping. Isolate these before you accept a deposit total as a clean revenue figure.
Handling Cash-Heavy and Undocumented Revenue
Restaurants, salons, contractors, and other cash-adjacent SMBs create a specific verification problem that mid-market deals rarely face: some portion of revenue may never have touched a bank account or a formal invoice in the first place. A seller who tells you the business "really does more than the books show" is not handing you an upside, they're handing you a number you can't verify and can't finance against.
Treat undocumented revenue as unverifiable, not as a discount to negotiate around. Lenders underwrite against what shows up in tax returns and bank deposits, so unreported cash revenue has no value in an SBA-financed deal even if it's true. If a seller insists it's material, the only workable path is a transition period where you observe the actual cash flow yourself, or a price built entirely on the documented number with any premium deferred into an earnout tied to revenue you can independently verify post-close. Don't pay upfront for revenue you can't trace to a deposit.
Step 3: Break Revenue Into Components
Total revenue is a single number that hides everything useful. Break it down three ways before you form a view on the business:
By recurring vs. project-based. A business with a high share of contracted, subscription, or repeat-customer revenue is worth more than one that starts from zero every month. There's no universal target ratio for owner-operator SMBs the way there is for SaaS, but the direction is consistent: more recurring revenue as a share of the total is a positive signal, and a sudden drop in that share year over year is worth investigating.
By customer. This feeds directly into the concentration analysis in the next section, and it's usually the single most important cut of revenue data in an SMB deal, since a small number of relationships often drives outsized influence over the total.
By channel or product line. A landscaping business generating half its revenue from one commercial contract and half from dozens of residential accounts is a fundamentally different risk profile than one generating the same total split evenly across 200 residential clients, even if the top-line number is identical.
Step 4: Measure Customer Concentration Risk
Customer concentration is the single biggest revenue-durability risk in most SMB deals, because losing one relationship can remove a disproportionate share of the business overnight. Current practitioner guidance uses a gradient rather than one hard cutoff:
| Single customer % of revenue | Risk band | Typical buyer response |
|---|---|---|
| Under 10% | Healthy | No special diligence needed |
| 10% to 20% | Caution | Extra scrutiny; many buyers cap comfort near 15% |
| 20% to 30% | Elevated | Customer interviews, escrow holdback |
| Above 30% | Severe | 20% to 35% valuation discount, or buyer walks |
Top-customer percentages are useful but incomplete on their own, since two businesses can share the same top-customer number with very different overall exposure. The Herfindahl-Hirschman Index (HHI), a standard concentration measure originally used in antitrust review, gives a fuller picture by accounting for the whole customer base, not just the largest account.
A worked HHI example. Take a business with five customers making up 30%, 20%, 20%, 15%, and 15% of revenue. Square each percentage and sum: 900 + 400 + 400 + 225 + 225 = 2,150. An HHI under 1,500 generally reads as low concentration, 1,500 to 2,500 as moderate, and above 2,500 as high. This business, despite no single customer crossing the 30% severe threshold on its own, scores in the moderate-to-elevated range once the whole customer base is accounted for, which a simple "top customer is 30%" headline number would understate.
If concentration comes back elevated or severe, that doesn't have to end the deal. It's information to price into the offer or structure into the deal terms, covered below.
Step 5: Judge Revenue Quality and Durability
Beyond the numbers, judge what's actually behind the revenue. Pricing power (has the business raised prices in the last two years without losing customers, or is it competing purely on price) tells you whether margins can hold under new ownership. Customer tenure (are top customers one-year relationships or ten-year relationships) is a better durability signal than the dollar figure alone. One-time revenue (an asset sale, a single unusually large project, a pandemic-era demand spike) needs to be identified and excluded from any forward-looking number, since it won't repeat under your ownership and shouldn't be paid for as if it will.
Do You Need a Quality of Earnings Report?
Most articles on this topic cite Quality of Earnings costs that describe mid-market, sell-side engagements, not what a self-funded searcher buying a $500K to $3M EBITDA business should actually expect to pay. Here's what QoE realistically costs at searcher deal sizes in 2026:
| EBITDA size | Typical QoE cost | Typical timeline |
|---|---|---|
| Under $1M | $10,000 to $25,000 | 2 to 4 weeks |
| $1M to $3M | $15,000 to $40,000 | 2 to 4 weeks |
| $3M to $10M+ | $30,000 to $100,000+ | 4 to 8 weeks |
Below roughly $1.5M in EBITDA, a full outside QoE engagement isn't always worth the cost relative to deal size. Many searchers instead run a scaled-down version of the same process themselves: the three-way reconciliation above, a documented add-back schedule with receipts for every adjustment, and the customer concentration analysis, then bring in a professional only if that self-directed pass surfaces something they can't resolve on their own.
Turning Revenue Findings Into Valuation and Deal Terms
Recast to SDE, not EBITDA. For most acquisitions under roughly $3M to $5M in enterprise value, Seller's Discretionary Earnings is the standard valuation metric, not EBITDA. SDE adds back one owner's full compensation on top of the standard EBITDA add-backs, reflecting the reality that the buyer is stepping into an owner-operator role, not hiring a management team. Every revenue adjustment you make (excluding one-time items, normalizing a customer that's about to churn) should flow into that recast SDE figure, since that's the number your offer price and lender's underwriting will actually be built on.
Structure terms around specific findings, not a generic discount. A flat price cut is a blunt instrument. Matching the deal term to the specific risk is usually a better outcome for both sides:
- Concentration risk (a top customer above 20% to 30%) → escrow holdback tied to that customer's retention through a defined post-close period
- Unverified growth claims → earnout tied to revenue continuity, typically structured over 12 to 24 months and capped around 20% or less of total deal value
- Recast uncertainty or aggressive add-backs → seller note contingent on the business hitting the recast SDE figure post-close
- A confirmed recognition or reporting error → straight price re-trade, since this is a factual correction rather than a risk allocation
Earnouts show up in a minority of SMB-sized deals overall, so don't assume one is standard; a seller note or holdback is often the more common tool at this deal size, and both accomplish the same goal of keeping some of the purchase price tied to whether the numbers you verified actually hold up after closing.
A worked example. Say your revenue analysis on a $2M-revenue business turns up a top customer at 28% of total revenue, elevated on the concentration table above, plus $80,000 in owner add-backs you can fully document. Recast SDE comes out to $520,000. At a 2.8x multiple typical for that industry and size, straight math says $1.456M. Rather than walking or demanding a flat discount for the concentration risk, you could offer the full $1.456M with $200,000 of it placed in escrow for 12 months, released only if the flagged customer is still active and at comparable volume at the anniversary. The seller gets a price built on the number they showed you; you get downside protection on the one risk your diligence actually found, instead of a generic haircut that either overpays if the customer stays or underpays if concentration wasn't the real risk in the first place.
Revenue Due Diligence Red Flags Checklist
| Red flag | What it usually means |
|---|---|
| P&L revenue doesn't match bank deposits | Numbers may be overstated, or timing is being manipulated |
| Top customer above 20% to 30% of revenue | Business value is concentrated in one relationship that may not transfer |
| "One-time" add-backs recurring every year | Not actually one-time; belongs in ongoing earnings, not excluded from them |
| Revenue spikes concentrated near fiscal year-end | Possible channel-stuffing or premature recognition |
| Seller can't produce customer-level detail | Books may not be clean enough to trust the aggregate number |
| Declining recurring revenue share, flat total revenue | New-customer acquisition masking a retention problem |
This process pairs directly with the cash and earnings side of diligence. Our guide on cash flow due diligence covers the OCF, FCF, and Net Working Capital mechanics that sit alongside revenue analysis, and our broader due diligence checklist covers everything else to request across legal, operational, and HR categories.
How Clef Fits In
Running this process well depends on getting the right documents early and comparing what you're seeing against enough other deals to know what's normal for the industry and deal size you're targeting. Clef aggregates more than 120,000 business-for-sale listings into one searchable feed, gives you an AI assistant to help screen a target before you request a data room, and organizes every deal under LOI in a shared pipeline, so the revenue findings from this process don't live in a scattered folder while you're juggling more than one acquisition at a time.
Frequently asked questions
How do you verify a seller's reported revenue is real before buying a business?
Cross-check three sources against each other: the P&L statement, the business tax returns, and the actual bank deposit records over the same period, a check commonly called a three-way reconciliation or proof of cash. If reported revenue doesn't match what actually hit the bank account, or tax returns and internal financials diverge significantly, that's a red flag requiring a specific explanation before you proceed.
What percentage of revenue from one customer is considered too risky?
Under 10% from a single customer is generally considered healthy. Between 10% and 20% enters a caution zone that draws extra scrutiny in diligence, and many buyers cap their comfort level around 15%. Above 20% to 30% is elevated risk, often requiring customer interviews or an escrow holdback, and above 30% is severe risk that can cut valuation by 20% to 35% or cause a buyer to pass entirely.
How much does a Quality of Earnings report cost for a small business acquisition?
For SMB deals in the sub-$3M EBITDA range that most self-funded searchers target, a QoE report typically costs $5,000 to $25,000 and takes two to four weeks. The commonly cited $30,000 to $100,000, four-to-eight-week figures describe larger, sell-side, mid-market engagements, not a typical searcher-sized acquisition.
What's the difference between SDE and EBITDA, and which matters for revenue analysis?
Seller's Discretionary Earnings (SDE) adds back one owner's full compensation and is the standard valuation metric for owner-operator businesses under roughly $3M to $5M in enterprise value. EBITDA is used once a business is large enough to run without owner involvement. For most SMB acquisitions, revenue findings should feed an SDE recast, not an EBITDA bridge.
How should revenue red flags change the deal terms, not just the price?
Concentration or recognition issues are often better addressed structurally than through a straight price cut: an escrow holdback tied to key-customer retention, a seller note contingent on hitting recast SDE post-close, or a shorter earnout tied to revenue continuity all shift risk back to the seller instead of relying on the buyer having priced every uncertainty correctly upfront.