Trust but Verify: Forensic Due Diligence

Transcript

SPEAKER_1: Last time we mapped out where to find deals. Now the harder question — how does someone actually verify what a seller is claiming? SPEAKER_2: That's the whole game at this price range. Due diligence involves a detailed forensic investigation into financials, legal contracts, and operational stability, using specific tools and techniques. Xero's New Zealand buying guide is explicit: rushing it is the most common and costly mistake buyers make. SPEAKER_1: Four to eight weeks feels long for a seven-thousand-dollar deal. What's actually happening in that window? SPEAKER_2: A lot. On the financial side, a buyer should review three to five years of tax returns, profit and loss statements, balance sheets, and cash flow records. Key steps include reconciling financial statements with lodged tax returns and using tools like Google Analytics for traffic verification. Significant inconsistencies are a red flag for misstatement. SPEAKER_1: So if the P&L shows strong profit but the tax return shows something much lower, that's not a paperwork gap — that's a warning. SPEAKER_2: Exactly. It cuts both ways. Sometimes sellers understate revenue on tax returns and overstate it to buyers. Either way, the numbers must tell the same story. If they don't, that's a renegotiation moment at minimum. SPEAKER_1: For online businesses — SaaS tools, ecommerce stores — the financials live inside Stripe or Shopify. How does someone verify those? SPEAKER_2: Use tools like Stripe or Shopify to review transaction records and cross-reference them against bank statements for accuracy. The platform data shows transaction-level detail. The bank statement confirms actual cash received. If those two don't match, something is wrong. SPEAKER_1: And for traffic — what's the right way to verify that? SPEAKER_2: Request view-only access to Google Analytics to verify traffic authenticity and detect any artificial spikes or anomalies. A screenshot can be edited. With real access, a buyer can check for artificial traffic spikes or sudden drops that don't align with the revenue story. Think of a business claiming steady organic growth but Analytics shows one spike from a single country, then nothing. Bounce rates near zero can also indicate bot traffic. SPEAKER_1: Now, platform risk comes up a lot. What does it actually mean for someone buying a small SaaS or ecommerce store? SPEAKER_2: Platform risk is the danger that the business depends entirely on a third-party platform — say, a Shopify app store or a Google ranking — and that platform changes its rules. Suppose a business earns ninety percent of its revenue from one app marketplace. If that marketplace changes its fee structure or delists the product, the business collapses. Evaluating whether the platform is SaaS, PaaS, or on-premise tells a buyer how much vendor lock-in exists. SPEAKER_1: For New Zealand buyers specifically — do supplier relationships automatically transfer to the new owner? SPEAKER_2: Not at all. Legal due diligence means reviewing every key contract — supplier, customer, lease, employment — to confirm transferability. Some supplier agreements have change-of-control clauses that void the contract on ownership transfer. The buyer should contact local suppliers directly and confirm the relationship continues post-sale. SPEAKER_1: There's also the regulatory layer — GST, the Privacy Act, the Fair Trading Act. How much of that falls on the buyer? SPEAKER_2: All of it. Regulatory due diligence means confirming GST registration if annual turnover exceeds sixty thousand New Zealand dollars, checking compliance with the Privacy Act 2020 for how customer data is stored, and verifying marketing claims meet the Fair Trading Act. These liabilities transfer with the business. SPEAKER_1: So what are the classic warning signs — the signals that a business is a lemon — that surface during this process? SPEAKER_2: Unresolved legal disputes, inconsistent financial records, high staff turnover, and heavy reliance on the current owner. That last one is especially dangerous. If the business only works because the founder personally handles every customer query, the buyer is acquiring a job, not an asset. SPEAKER_1: And professional help — lawyers, accountants. Is that realistic at this price range, or does it eat the margin? SPEAKER_2: The cost of expert advice is typically small relative to potential losses from missing critical issues. For a seven-thousand-dollar deal, even a few hundred dollars on an accountant and a lawyer to check the purchase agreement is worth it. Remember: the purchase agreement should be conditional on satisfactory due diligence. That's the buyer's exit clause if something surfaces. SPEAKER_1: So the takeaway for our listener — what are the three non-negotiable checks? SPEAKER_2: Financial statements must reconcile with tax returns. Stripe or Shopify exports must reconcile with bank statements. And view-only Google Analytics access is non-negotiable. Those three checks catch most fraud at this price range. Legal, operational, and regulatory layers build on top of that foundation.