The best due diligence request is not the longest list. It is a staged request in which every document has a purpose: confirm what is being sold, test the practice’s reported performance and operating capacity, identify obligations that may transfer, and record what remains unresolved.

Start with anonymised, practice-level evidence. Request client-level material only when necessary and cleared by the parties’ advisers. Indiscriminate copying can create privacy and professional-confidentiality risks before the buyer decides to proceed.

Set the request protocol before requesting files

Define the transaction perimeter first: selected engagements, assets, shares, employees, work in progress, debtors, intellectual property, software access or some combination. Only then can the documents answer the right question.

Then establish a request register with five fields: document requested, period and entity, claim being tested, status, and follow-up. Mark each response received, incomplete, not available or not applicable. Keep an exceptions schedule for discrepancies rather than letting explanations disappear into email threads.

Use a controlled data room, named access, download restrictions where appropriate and a clear return-or-destruction process. The OAIC’s guidance on selling a business says vendors should consider de-identified information, confidentiality controls and limited electronic access; it also says prospective purchasers should generally avoid collecting personal information where possible. Your lawyer should settle the lawful disclosure and consent process for the proposed transaction.

Stage 1: screen the opportunity with summary evidence

The first request should be compact enough to answer whether deeper work is justified. Ask for:

  • the proposed asset or share-sale perimeter and a schedule of inclusions and exclusions;
  • three to five years of annual financial statements and tax returns, plus current year-to-date management accounts;
  • monthly revenue and gross margin by service line, with an anonymised client-fee schedule showing service type, fee, tenure, billing method and last billing date;
  • a staff schedule by role, status, tenure, remuneration, ordinary hours and accrued leave, initially without unnecessary personal identifiers;
  • an organisation chart, seller responsibilities and a summary of work performed by contractors or offshore providers;
  • the current software stack, material supplier and licence commitments, premises arrangements and proposed transfer dependencies; and
  • summaries of complaints, claims, regulatory correspondence, data incidents and professional indemnity notifications.

Australian Government guidance recommends independently checking three to five years of financial information, including tax returns, BAS, receivables, payables, balance sheets, profit and loss, cash flow and sales records (business.gov.au). The first stage is for patterns and scoping, not proving every client balance.

Stage 2: test the financial and commercial records

If the opportunity passes the screen, request records that bridge reported results to source systems:

  • detailed general ledger, trial balances and chart of accounts;
  • BAS and income tax returns, bank statements and reconciliations;
  • aged debtors, aged creditors, bad-debt write-offs, credit notes and work-in-progress reports;
  • invoice-level billing exports linked to the anonymised client schedule;
  • payroll reports, superannuation records and contractor invoices; and
  • an add-back schedule with the source record and rationale for every adjustment.

Reconcile totals across independent records and investigate cut-off, reclassifications and unexplained journals. This article deliberately does not prescribe how to normalise earnings or measure fee recurrence; those are separate analyses. Here, the question is whether the data needed for those analyses exists, covers the same entity and period, and can be reproduced.

Request written explanations for changes in accounting policy, service mix, billing timing, partner allocations and related-party charges. Supporting ledger, invoice and bank records determine how much reliance a management spreadsheet deserves.

Stage 3: examine engagements, delivery and professional risk

Use anonymised samples selected by the buyer across service types, fee sizes, staff owners, overdue work and higher-risk files. Test whether each file contains:

  • a current engagement letter defining client, scope, fee basis, responsibilities and termination;
  • evidence of identity checks and authority to act;
  • key advice, source documents considered, lodgement status and material client communications;
  • conflict checks, review sign-offs and unresolved matters;
  • permissions for outsourcing, offshoring or disclosure where relevant; and
  • a clear record owner, storage location, retention rule and transfer path.

The TPB lists engagement letters, proof-of-identity records, permissions, key advice and communications among records a registered tax practitioner may need to keep (TPB record-keeping guidance). Its acquisition-specific client verification guidance says proof-of-identity records are expected to transfer with other relevant records when a practice or client list changes ownership, while stressing that client information requires client permission or a legal duty before disclosure to the buyer.

Also request relevant registration details, the current professional indemnity policy schedule, limits, exclusions, excesses, claims history and proposed run-off arrangements. The TPB describes adequate PI insurance as an ongoing registration requirement for registered tax practitioners (TPB); advisers and the insurer should confirm how historic and future work will be covered.

Stage 4: verify people, systems and transfer readiness

For employees likely to move, request contracts, applicable awards or agreements, payroll and leave reconciliations, role descriptions, relevant performance or disciplinary matters, training records and retention commitments. Fair Work explains that a transfer of business can affect employee entitlements and coverage (Fair Work Ombudsman). Employment counsel should determine what is recognised and how records are handled.

For technology, obtain the application register, licence terms, administrator list, integration map, backup evidence, access-control policy, incident log, continuity plan and supplier agreements. Ask the seller to demonstrate how a client file is opened, reviewed, billed, lodged, archived and recovered. Record which licences, portals and credentials cannot transfer.

Before signing, refresh material records. Classify each unresolved item as evidenced, priced, protected in transaction terms, assigned to a named post-completion action or a reason to pause.

Frequently asked questions

Should a buyer request every client file?

Usually not at the outset. Begin with aggregated and de-identified data, then use risk-based samples under an adviser-approved access protocol. More data is not automatically better evidence, and possession of personal information creates its own responsibilities.

What if a requested document does not exist?

Record the absence and ask what alternative evidence supports the claim. A missing document may reveal a weak control, an informal process or a transaction dependency. Do not silently replace primary evidence with a seller explanation.

Sources

Disclaimer

This article provides general information only. It does not constitute legal, tax, accounting, financial, credit, valuation or other professional advice. Circumstances differ. Obtain advice from appropriately qualified advisers before acting or entering a transaction.