Financial due diligence: spotting red flags in under 3 weeks

Short answer. A well-run financial due diligence on a French SME identifies the main red flags within 15 to 20 business days: non-recurring EBITDA, incomplete trial-balance reconciliation, atypical shareholder current accounts, under-provisioned items, VAT inconsistencies, URSSAF under-reporting, dependency on the seller. The method fits in three structured weeks, each targeting a risk block and a precise reading of the accounts. A buyer doesn't need a full audit to decide; they need a quantifiable risk map and its impact on price.

A deep due diligence on a mid-cap can take months. For an SME under €50m revenue, three well-organised weeks are enough to produce an actionable red flag report, provided three principles are respected:

• Priority documents: three years of tax returns, detailed 24-month trial balance, general ledger of key third-party accounts, top-10 customer contracts, litigation register. That is all that is strictly required pre-LOI.
• Block-by-block method: quality of earnings, balance sheet structure, tax & labour. Each block fits in five business days.
• Materiality logic: comprehensiveness is not the goal. Variances above a materiality threshold (typically 1% of revenue or 5% of adjusted EBITDA) are.

An effective DD is not an audit. It does not certify anything. It ranks risks.

Goal of week 1: answer one question — is the reported result the real result?

Day 1-2. Reconstructing adjusted EBITDA#

From the French tax filings (forms 2052/2053 for BIC), strip out:

• owner's compensation (vs. market benchmark);
• non-recurring items (P&L exceptional accounts);
• personal expenses booked through the company;
• intra-group transactions not surviving closing;
• accounting policy changes (ANC 2014-03, art. 122-1 et seq.).

Day 3. Revenue / VAT consistency#

Reconcile book revenue with:

• total VAT returns (CA3 / CA12) over 12 months;
• intra-EU operations summary (DEB / EMEBI);
• the FEC file (Fichier des Écritures Comptables, art. L.47 A-I of the French Tax Procedure Code).

A structural unexplained gap above 1% between book revenue and VAT-declared revenue is a major red flag.

Day 4. Gross margin and cost structure#

• monthly gross margin trend over 24 months;
• variable / fixed split of operating costs;
• detection of mis-classified recurring charges (e.g. SaaS subscriptions booked as exceptional expenses).

Day 5. Quality-of-earnings preliminary report#

Mid-DD synthesis: contradictory EBITDA bridge and the three areas to deepen in week 2.

Goal of week 2: does the closing balance sheet reflect the real value of the business?

Day 6-7. Trial-balance reconciliation, customer / supplier ageing#

Review:

• reconciliation rate (matched vs. open items);
• customer ageing > 90 days (often under-provisioned);
• supplier ageing > 60 days (cash tension signal);
• collective accounts 411/401 with inconsistent balances.

A customer trial balance reconciled below 70% with a 411 account containing receivables older than 12 months without provision is a textbook red flag.

Day 8. Shareholder current accounts (account 455)#

Check:

• balance direction (creditor vs. debtor) — a debtor 455 is in principle prohibited for SARL and SAS in favour of individuals (Articles L.223-21 and L.225-43 of the French Commercial Code);
• interest rate: tax-deductible cap (variable-rate loan reference, Article 39-1-3° of the French Tax Code);
• atypical movements in the last 24 months;
• contractual documentation (current account agreement).

Day 9. Inventory and provisions#

• valuation method (FIFO, weighted average) and stability;
• recent physical count?
• impairment policy: provision after 12 / 18 / 24 months without rotation?
• consistency with reported gross margin.

Day 10. Fixed assets, leases, off-balance-sheet items#

• full depreciation schedule;
• finance leases: capitalised residual debt;
• guarantees given / received (mandatory disclosure in notes, PCG art. 832-7);
• end-of-service indemnity commitments (IFC).

Week 2 synthesis#

Goal of week 3: what latent liabilities will the buyer inherit?

Day 11. VAT#

• FEC / CA3 consistency (started in week 1);
• VAT collected on intra-EU transactions: reverse charge correctly declared?
• VAT deductible: pro-rata rules, excluded items (entertainment, passenger vehicles);
• refund claims: any undocumented DGFiP rejections?

Day 12. Corporate tax and loss carry-forward#

• CIT rate (25%, 15% on first €42,500 for eligible SMEs, Article 219 CGI);
• loss carry-forward: amount, annual offset cap (€1m + 50% above, Article 209-I CGI);
• tax consolidation: scope, agreements, post-acquisition exit consequences;
• already-imputed tax credits (R&D credit, residual CICE) — challenge risk over the prescription period.

Day 13. URSSAF and labour#

• 12-month DSN: consistency with payroll cost;
• last 3 years of URSSAF reassessments;
• atypical contracts: freelancers, fixed-term, interns, apprentices — reclassification risk;
• benefits in kind: vehicles, housing, meals — declaration and contributions.

Day 14. Compliance: CFE/CVAE, customs, GDPR#

• local business tax: base, capping, secondary sites declared;
• customs if import/export: EORI, tariff classification, preferential origin;
• GDPR: records, lawful bases, sub-processor contracts, cookies.

Day 15. Final red flag report#

Deliverable:

• ranked risk list (high / medium / low);
• indicative quantification of each risk (low / high range);
• valuation impact (discount, R&W, escrow);
• recommendations on R&W scope and duration.

For each identified risk, two axes:

• Probability (1 = low, 5 = certain);
• Financial impact (1 = < €10k, 5 = > €500k).

Score = probability × impact. Above 12, the risk requires a specific cover (price discount, dedicated R&W, condition precedent, escrow).

A 3-week DD only matters if a buyer knows what to do with it. Each identified risk must translate into a contractual clause: discount, deferred consideration, R&W, condition precedent. If the red flag report sits in a PDF with no impact on the LOI or SPA, the DD spend is wasted.

Our conviction: a red flag report must be actionable. For each risk, an executable recommendation and a quantified amount. Otherwise the buyer arrives at the negotiation table without ammunition and ends up accepting the seller's terms.

The most underestimated risk in financial DD is not a balance-sheet line item: it is the accounting culture of the target. An SME with a delayed general ledger, untracked monthly current accounts, no interim closings, carries a structural risk: the closing balance sheet will be inaccurate, post-closing adjustments will be contested, and trust between seller and buyer will erode by D+30. This quality is evaluated with three questions to the controller: when was the last monthly close produced? How many days after period end? With what review depth?

The data room itself as a signal#

Data room quality reflects accounting quality. A data room populated below 60% (missing standard documents: tax returns, bank reconciliations, credit facility agreements) signals either weak deal prep or documents that are problematic (e.g. undocumented URSSAF reassessments, ongoing litigation expert reports). Explicitly ask the seller: which documents are intentionally excluded and why. Log all refusals in the Red Flag Report — they become contractual protection.

Three calls to make based on the red flag report:

1. Reprice: direct discount on certain risks, deferred consideration on conditional risks.
2. Calibrate the R&W: extended duration (5–7 years for tax and labour matters), uplifted cap on open fiscal years.
3. Set conditions precedent: regularising debtor shareholder loans, GDPR remediation, confirmatory DD post-LOI, key customer consent.

• E-invoicing: an unprepared target = mandatory IT upgrade 2026–2027. Cost to factor in.
• B2B payment terms: significant DGCCRF fines; a degraded customer ledger is a non-compliance signal.
• CSRD / VSME: for mid-caps and their suppliers, lacking sustainability reporting weighs on bank financing of the acquisition.
• R&D credit doctrine: ongoing audit pressure; a recent R&D credit not secured by a tax ruling should be treated as a latent liability.

What is the difference between due diligence and statutory audit?#

Statutory audit, governed by CNCC NEP standards, certifies the regularity and fairness of the accounts. DD is a contractual engagement for an acquirer or investor: it ranks risks but does not certify accounts.

Is a 3-week DD enough to sign an SPA?#

For a conditional LOI, yes. For the SPA, a confirmatory DD is generally run during exclusivity, with a scope expanded around the items flagged pre-LOI.

Who pays for the DD?#

The buyer, unless agreed otherwise. The cost is included in acquisition expenses and capitalised or expensed depending on French GAAP treatment.

Can the seller's statutory auditor run the DD?#

No, by independence rule (CNCC NEP). A separate accounting firm must be engaged.

How much does a 3-week DD cost on an SME?#

Market range: €15k–€50k excl. VAT depending on target size, number of subsidiaries and tax complexity. A cost typically dwarfed by the avoided risk.

A well-run 3-week financial DD does not replace a multi-month confirmatory DD on large transactions. Pre-LOI, it gives the buyer negotiation arguments, risk pricing and R&W calibration. The method is simple: three weeks, three blocks, one ranked deliverable. Discipline means staying within scope and not letting the DD drift into a full audit — uneconomic and unnecessary at this stage.

Last updated: 28 April 2026.