2026 Business Acquisition Due Diligence in Australia: Seven Risks Buyers Should Not Ignore

Business acquisition and due diligence

Buying an established Australian business can provide immediate access to customers, employees, systems, supplier relationships and revenue. However, it may also expose the buyer to liabilities and operational problems that are not obvious from the sales memorandum or headline financial figures.

In 2026, due diligence should extend well beyond checking profit-and-loss statements. Employment obligations, privacy compliance, technology risks, climate-related reporting, customer concentration and the quality of reported earnings can all materially affect the value and future performance of a business.

A structured due diligence investigation helps a buyer verify the seller's representations, identify material risks and negotiate appropriate protections before settlement.

1. Confirm the quality of earnings

A business may report a healthy accounting profit while generating weak cash flow or relying on income that is unlikely to continue after the sale.

Financial due diligence should examine:

• Historical financial statements and management accounts
• Business activity statements and tax returns
• Bank statements and reconciliations
• Revenue trends and seasonality
• Gross margins and operating expenses
• Accounts receivable and overdue debts
• Accounts payable and undisclosed liabilities
• Inventory valuation and obsolete stock
• Owner-related and non-recurring expenses
• Capital expenditure requirements
• Working capital needs
• Customer refunds, discounts and credit notes

The buyer should not rely solely on the seller's stated EBITDA. Reported earnings may need to be adjusted for personal expenses, related-party transactions, one-off income, unpaid owner labour, abnormal expenses or costs that will arise under new ownership.

The objective is to establish the business's sustainable maintainable earnings, rather than simply accepting its historical accounting profit.

2. Investigate employment liabilities

Employees are often one of the most valuable parts of an acquired business, but they can also create significant liabilities.

Where a business changes ownership, Australia's transfer-of-business rules may affect employee service, leave balances, awards, enterprise agreements and other entitlements. In many circumstances, a new employer must recognise an employee's previous service when determining certain entitlements. Different rules may apply to annual leave, redundancy, long-service leave, unfair-dismissal qualifying periods and notice obligations.

Employment due diligence should review:

• Employment contracts
• Applicable modern awards or enterprise agreements
• Employee classifications
• Ordinary hours and overtime
• Penalty rates and allowances
• Annual and personal leave balances
• Long-service leave liabilities
• Superannuation payments
• Payroll tax obligations
• Contractor arrangements
• Workplace policies
• Workers' compensation claims
• Employee complaints and disputes
• Key-person dependency
• Proposed employee transfers

Buyers should also determine which employees are essential to business continuity and whether they intend to remain after the transaction.

Employment liabilities should be quantified and clearly addressed in the sale agreement, with assistance from qualified employment and legal advisers.

3. Review privacy, data and cybersecurity risks

A buyer may acquire customer databases, employee records, payment information, cloud systems, websites and other digital assets. These assets can be commercially valuable, but they may also carry privacy and cybersecurity exposure.

The Australian Privacy Principles regulate how covered organisations collect, use, disclose, secure and provide access to personal information. Although the Privacy Act generally applies to organisations with annual turnover above $3 million, some smaller businesses are also covered because of the nature of their activities.

The Office of the Australian Information Commissioner announced that it would conduct a privacy-policy compliance sweep during 2026, demonstrating increased regulatory attention on whether businesses accurately explain their handling of personal information.

Technology and privacy due diligence should consider:

• Whether the business is covered by the Privacy Act
• Privacy policies and collection notices
• Customer consent arrangements
• Data storage and retention practices
• Access controls and password management
• Cybersecurity policies
• Previous data breaches
• Backup and disaster-recovery systems
• Software licences
• Cloud service agreements
• IT support contracts
• Website and e-commerce security
• Ownership of domains, software and digital content
• The lawful transfer of customer and employee data

A customer database should not automatically be treated as a transferable asset. The buyer should confirm whether personal information may legally be disclosed and used following the transaction.

4. Examine customer and supplier concentration

A business can appear profitable while depending heavily on one customer, one supplier or the personal relationships of the outgoing owner.

Commercial due diligence should identify:

• Revenue generated by the largest customers
• Customer retention and cancellation rates
• Contract expiry and termination rights
• Changes in purchasing patterns
• Customer complaints and refunds
• Supplier exclusivity arrangements
• Minimum purchase commitments
• Price-increase provisions
• Foreign-currency exposure
• Alternative supplier availability
• Product shortages and lead times
• Related-party customers or suppliers

A high level of concentration does not necessarily make the business unsuitable. However, it increases the commercial risk and may justify a lower valuation, deferred consideration, retention amount or earn-out arrangement.

The buyer should also confirm whether key contracts require consent before they can be assigned or transferred.

5. Verify assets, inventory and intellectual property

The sale price may include plant, vehicles, equipment, stock, trademarks, websites, telephone numbers, designs, software and other intellectual property.

The buyer should verify:

• Legal ownership
• Asset condition
• Market value
• Maintenance history
• Finance arrangements and security interests
• Remaining useful life
• Replacement costs
• Inventory quantities
• Damaged, expired or obsolete stock
• Ownership of trademarks and business names
• Domain-name registration
• Software and content ownership
• Intellectual-property licences
• Restrictions on transferring assets

A physical inspection should be conducted where material assets or inventory form an important part of the transaction.

Asset registers should be reconciled against the items located at the premises. Buyers should also conduct appropriate searches to identify registered security interests and confirm whether assets are owned outright, financed or leased.

6. Assess licences, contracts and regulatory compliance

The buyer must determine whether the business has the licences, permits, registrations and approvals required to operate lawfully.

The review may include:

• ASIC company information
• Business-name registration
• Local council permits
• Industry licences
• Professional registrations
• Food, liquor or health approvals
• Building and planning approvals
• Environmental obligations
• Product certifications
• Insurance policies
• Commercial leases
• Customer and supplier contracts
• Franchise agreements
• Litigation and disputes
• Regulatory correspondence

A licence held by the seller may not automatically transfer to the buyer. The purchaser may need to lodge a new application, obtain regulatory approval or satisfy qualification and fit-and-proper-person requirements.

Material contracts should also be checked for:

• Change-of-control clauses
• Assignment restrictions
• Termination rights
• Personal guarantees
• Automatic renewals
• Minimum purchase obligations
• Exclusivity
• Indemnities
• Liability limitations
• Unusual pricing or rebate arrangements

These matters should be reviewed by an appropriately qualified Australian lawyer.

7. Consider emerging sustainability and supply-chain obligations

Australia's mandatory climate-related financial reporting regime commenced on 1 January 2025 and is being introduced progressively. Group 2 reporting applies to relevant financial years beginning on or after 1 July 2026, followed by Group 3 from 1 July 2027.

Many small and medium-sized businesses will not be directly required to prepare mandatory sustainability reports. However, they may still receive information requests from larger customers, lenders and supply-chain partners that are subject to reporting obligations. ASIC has noted that small businesses may increasingly be asked for information about emissions and climate-related practices by larger reporting entities.

Depending on the target business, due diligence may therefore consider:

• Energy and fuel consumption
• Environmental licences
• Waste-management practices
• Climate-related operational exposure
• Insurance availability and cost
• Supplier sustainability requirements
• Customer reporting requests
• Physical risks affecting premises and supply chains
• The reliability of environmental claims

This is particularly relevant for businesses operating in manufacturing, logistics, construction, agriculture, energy, property and other asset-intensive sectors.

What should a professional due diligence report provide?

A useful due diligence report should not merely list documents reviewed. It should clearly explain:

• What was examined
• What information was unavailable
• Whether the seller's statements were supported
• Which findings are material
• The likely financial or operational consequences
• The priority of each risk
• What further investigation is required
• What protections the buyer should discuss with advisers
• What improvements may be required after settlement

Findings may be classified as low, moderate, high or critical risk, supported by an explanation of likelihood and potential impact.

Due diligence supports a decision — it does not make the decision

No acquisition is completely free from risk. The purpose of due diligence is to ensure that those risks are identified, understood and appropriately reflected in the transaction.

Depending on the findings, a buyer may decide to:

• Proceed on the original terms
• Renegotiate the purchase price
• Require specific warranties or indemnities
• Request that liabilities be resolved before settlement
• Retain part of the purchase price
• Introduce an earn-out
• Alter the transaction structure
• Conduct additional specialist investigations
• Withdraw from the transaction

The cost of professional due diligence is generally small compared with the financial consequences of acquiring undisclosed liabilities, overstated earnings, non-compliant employment arrangements or an unsustainable business model.

This article provides general information only and does not constitute legal, tax or financial advice. Obtain independent professional advice before making any decision.