Buying an Internet Business: Advanced Due Diligence

With an offer accepted on an internet business, attention in the buying process will move to the task of due diligence (DD). We’ve written before about how best to structure due diligence and in this article we will dig deeper into each area, giving buyers a much stronger sense on what to look for and how to go about finding it.

As a reminder, the six key tenets of a robust due diligence process are:

1. Traffic
2. Financial
3. Owner
4. Operational
5. Technical
6. Legal

It is worth reiterating that some parts of the process may be considered more important by some investors than others. Equally, some will matter more for some business models versus others. Regardless of this, all aspects should at least be probed to some extent.

Traffic

Analyzing the traffic profile of the business is one of the first things buyers should do. The three key elements to look for are traffic 1) trends 2) concentration and 3) quality.

Trends

Firstly, buyers should use Google Analytics (or whichever analytics tool has been used) to observe the trends in the overall traffic and for each channel, on a daily, monthly and annual basis. This should serve as ‘stage one’ of the traffic analysis before delving deeper on issues of interest.

Naturally the desired trend is for slow and steady growth across all sources, but it is perfectly acceptable to see some sources grow and diminish in importance over time. It is important to observe spikes in the data set and carefully explore the reasons for these, asking direct questions of the seller if need be.

• Did the traffic spikes correspond to specific action by the owner?
• Did it correlate to increased revenue?
• Can it be repeated?

These are all important considerations to understand. Buyers should use the following screens in GA to probe the trends data:

Penalties are an important consideration too. Whilst not necessarily a deal killer, they are vital to explore for damage they may have caused and what the owner has done to rectify the solution. Google Webmaster Tools is the definitive tool for identifying a penalty but buyers should also be able to spot significant downward (or upward) changes using 3^rd party tools such as FEI’s Website Penalty Indicator.

Concentration

With a better sense on the overall traffic trends it’s time to turn focus to traffic composition. A diverse set of traffic sources is the desirable situation but not all websites have this and it is by no means a negative trait, depending on the fundamentals underpinning each traffic source.

Using the channel data and traffic sources screens, buyers can observe each of the major traffic channels, their historic profile and current characteristics (e.g. time on site, page views). Buyers should look to investigate at least the top 3 channels that cumulatively account for 80%+ of traffic. Within each, there are specific further checks to think about:

Organic Search – If the business is reliant on particularly high search traffic (and many websites can be) then it is important to examine the quality of this traffic. SEMRush is a great tool for digging deeper on keyword rankings and concentration.

The three characteristics buyers should be looking for are:

• A high number of ranking keywords (preferably on page 1 for the target term);
• Traffic split relatively evenly across the keyword spectrum; and
• Consistency in keyword rankings

Inevitably SEO is not every seller’s forte and not all websites are perfect but if the site has ranking consistency and traffic concentrated on keywords where it maintains a strong and stable rank, it has a solid foundation.

Naturally, the site should not just be assessed in isolation and buyers should be cognizant of movements in the niche historically (the rankings analysis should uncover this). SEMRush can also provide metrics on keyword competitiveness.

The next thing to examine is the website’s backlink profile. Ahrefs is a good tool for analyzing a website’s current profile and link growth over time. Buyers should look to evaluate at least the top 20 backlinks (sorted by page authority) and identify the quality of the content underpinning it, engagement on the page and on the rest of that site. Whilst there is no fool proof way of assessing link quality, buyers should generally ask the following questions when looking at each linking site:

• Does the linking website look legitimate?
• Is the website linking in a relevant niche?
• Does the link look natural? Could it be paid (e.g. “site sponsors”, “donors” or similar)? Has the cost been declared by the seller?
• Does the seller also own the site? Will that link(s) remain after the sale?
• Are all of the links the same (e.g. guest posts, blog comments, paid links)?

Buyers should also analyse the link growth over time and assess its sustainability. Generally, a natural link profile will gradually increase over time, there may be occasional spikes or losses in the number of referring domains (more relevant than number of pages), but the trend should be upwards.

If the site goes from very few links to a large number within a few days then this could be the sign of buying links or the use of a private blog network (PBN) which would require further investigation.

Referral – If the business receives a high degree of traffic from referral sources then it is important to understand the quality and stability of those referral sources. Buyers should examine each major referring site carefully and establish the nature of the relationship between the linking sites.

Does the seller have any relationship to the linking referral source, either formally or informally? Buyers should identify the nature of the content being posted and linked, the linking history and whether this is likely to continue over time.

Nature

Having understood the major traffic channels in greater detail it’s time to focus on the nature of the traffic coming through to the site. The ‘nature’ of the traffic is somewhat subjective and its desirable qualities vary with the business model under review. For instance, for a CPM-network monetized site, traffic with a high time on site, a high number of page views per user and a low bounce rate is desirable. For a SaaS business where conversions to trials might be important, the traffic reaching a particular page (e.g. product demonstration and sign up) would be lucrative.

For the specific business under examination, the key is to understand the traffic profile of the desirable visitor and look for this in the traffic data. Key measures of value are pages per session, average session duration, bounce rate and of course the conversion rate.

If Google Analytics has been set up with conversion goals then a lot of useful data will exist already for review (note: not all sellers have this by default).

Financial

Graduating on from traffic, next to review should be the financials. These two areas complement each other and the findings from the traffic analysis should be overlaid to the financial analysis. In particular if there is clear traffic and conversion data available, this can be used as an additional sense check on the stated revenues.

Revenue

To audit the revenue history of the business, buyers should at the very least requisition the affiliate/advertising reports (where relevant), merchant processing statements and bank statements for the last 12 months or further back.

Many buyers are fixated on the use of tax returns for financial due diligence but in reality these are commonly misleading due to aggregation with other businesses. Instead, with monthly reports, there should be more than enough data to link the earnings through to the deposits.

The best exercise for revenue verification is to create a monthly income statement spreadsheet and analyse the flow of earnings through to deposits. Be cognizant of time delays in payments (e.g. some networks pay net-30) and also the seller’s own behavior (e.g. setting payout thresholds) which can confuse the month-by-month analysis. The important thing is to establish that over the entire time period the earnings match the bank deposits and any significant monthly deviations are explained.

Many buyers are concerned about the source of revenue particularly in respect of affiliate networks. Make sure in the case of large networks (e.g. Commission Junction) to requisition the reports by referring domain. For websites transacting through PayPal, request the full line-by-line transaction history (sensitive customer information will be redacted) in order to see the exact transactions going to the PayPal email.

Buyers should look to overlay this with the traffic data above, preferably the goal conversion data if available, to be sure that the PayPal transactions correspond to traffic on the specific site and not from elsewhere.

Costs

COGS and expenses should looked be looked at thoroughly. Buyer should requisition the monthly bank statements, PayPal statements and credit card statements relevant to the business and go through line by line totaling up expenditure in each month. It’s important during this exercise to match up the stated costs (in the marketing materials) versus what is found.

In general, the cost base is the easiest place for a seller to manipulate the numbers (either intentionally or accidentally) so it is important buyers spend adequate time auditing this.

Buyers should look to not only match the cost base up but also understand the terms attached to each. Is the owner getting a preferential rate on a particular subscription? If so, why? Will this transfer? It is worth researching the costs independently on the platform provided (e.g. AWeber costs for the relevant email subscriber count). It’s also important to observe the cost base as a percentage of revenue each month and each year and see how this has changed over time.

Other Checks

Line item trends and matching aside, it’s also important to look at the bigger picture when assessing revenue in particular. Buyers should use the exercise to look for any customer or affiliate concentration that wasn’t clearly identified during the assessment and offer stage.

Buyers should look to requisition the affiliate report for any business heavily reliant on affiliate sales and examine it carefully. As with the traffic analysis, if there are signs of concentration, analyse the history and nature of the relationship between the affiliate and the owner, to ensure consistency and survivability in the event of the sale.

For SaaS or subscription-based businesses, there are a number of other metrics worth close attention, principally the customer lifetime value, duration and churn, and what have these been doing over time. Buyers should look to incorporate the revenue data from above into a SaaS metrics sheet such as this one to gain a better sense on the customer profile from a strictly financial standpoint.

As a final step, buyers should arrange a live screen share with the seller to both authenticate ownership of all the relevant accounts and verify the same financial information as presented in documented format.

Owner

Owner risk is an essential part of the due diligence process and quite often overlooked by buyers either because it seems intangible compared to traffic and financial verification or because it’s a relatively unknown area of due diligence.

Broadly speaking, buyers should look to assess 2 things: 1) key man risk and 2) character.

Key Man Risk

Key man risk is essentially how reliant the business is on the owner or its employees. Buyers should examine carefully the role that the owner plays in the business (see next area, operations) and discern what kind of proprietary knowledge is required to maintain those responsibilities. To what extent can that knowledge be taught and in what timeframe?

For example, if it is a SaaS product which the owner has written and no other developer has worked on, then the buyer needs to be careful to assess the code base if they do not have technical expertise. A screen share and discussion of the source code with a 3^rd party developer and additional training/consulting hours post sale are some of the common solutions to this problem.

Equally important is what owner relationships or agreements are in place to enable the business to succeed and will they survive change of control? If the owner relies heavily on one affiliate and has a personal relationship with them, then there needs to be strong assurances in place that the agreement will continue post sale. Other things to think about include whether the content or the product is anchored around the owner personally and to what extent are customers buying for the owner’s name? Does the owner have relationships with any of the major customers?

Character

A character assessment of the owner is vital and should be drawn from all aspects of dealings with them. Buyers can learn a lot from the seller’s readiness to supply answers and information, honesty in response and attitude throughout the sale. Aside from that though there are a number of methods to see how the seller has behaved historically.

There are all sorts of past and current issues that can impact how one views the deal:

• Has the owner been convicted for felony fraud before?
• Sued in a civil action by an agency like the FTC?

A yes to either of those would be a red flag, even if everything else checked out. Perhaps the owner has a tax or corporate lien against him – how will that affect the business?

There are various levels of owner due diligence buyers can do, from a spot check to a full private investigation. Much depends on the size of the deal, the parties involved, budget and if the business owner is staying on in some capacity.

The things that will most concern a buyer involve the business owner and the business itself. Buyers want to look for:

• Civil Actions
• Bankruptcies
• Felonies
• Business Legitimacy

Civil Actions, Bankruptcies and Felonies

In the US, civil lawsuits are filed either in County Court (the state level) or Federal District Court. Searching the Federal Civil System is easy. Go to Pacer, create an account and search away. Just note that Pacer charges 10 cents a page viewed. PACER offers some good video training on how to use the system.

Searching state and county courts can be more complicated. About 50% of all county courts are online. As an example, in Wisconsin, buyers can search all cases at a click of a button for free. In other states and counties, the buyer will have to either hire a court runner or physically go to the court to search. Since time is valuable, it’s better to hire a court runner and there a many local services across the country that offer this.

In the US, bankruptcies take place in Federal court, as required by the constitution. Again, PACER can be used to search for bankruptcies, both personal and business.

Most felonies occur at the local level but for federal crimes, check PACER. For local searches, buyers should look to hire a background check company.

Business Legitimacy

Is the business being bought or the entity owning the asset, legitimate? In the US, companies are registered on a state level. Buyers can search online at the local level to find the registered LLC, S-Corp or Inc. There is also the option to retrieve a certified copy of the company’s existence directly from the relevant Secretary of State.

Digging Deeper

There are a number of other things buyers can do to start a deep dive:

• Get a copy of the owner’s tax returns either through the DD process or via an IRS FORM 4506-T, but there are plenty of companies that do this digitally, as well;
• Check out the seller’s Driver’s License Report: many DUIs signal a potential issue; and
• Hire a Private Investigator – have the PI interview employees, business partners, vendors, family and friends of the owner.

This section on background checks was contributed by Ariel Ozick, an FE International buyer and Founder of ArrestRecords.com, a background check SaaS platform. He also founded PMGuardian.com, a Leasing Automation platform for real estate professionals.

Other Resources

Social media can be a useful tool to check the consistency of a seller’s story. Use LinkedIn to browse a seller’s professional and business history and also their connections to see if they have any undeclared affiliations. Twitter is useful for seeing what conversations the seller has been having and with whom.

Finally there are also websites such as Scam where victims post about previous scams and scam artists. A consistent number of reports found on site such as these should be taken as a major red flag. One or two negative reports could be from unscrupulous competitors so it’s worth being practical and not jumping to conclusions. If there have been negative reviews, look how they have been dealt with. A direct and non-dismissive approach is usually a good sign.

Operational

Due diligence on the operations of the business is an absolutely vital component of small business due diligence and a key area overlooked by some buyers. The hourly time requirement and owner/employee responsibilities are important elements for the buyer to assess in order to both understand the obligations for taking over the business and validating the pricing of that work in to the valuation.

The most efficient way to audit the business’ time requirements and responsibilities is to conduct a ‘task audit’ for the owner and the employees of the business. This involves getting a detailed schedule of daily and weekly tasks and identifying next to each the time and expertise required for each.

It is worth sense checking these against external observations of the site, e.g. number of articles being posted per week, timing of social media updates and number of email newsletters etc.

Clearly not all businesses have the same tasks week on week but a task audit should give a good idea over +80% of the business’ requirements. Buyers can then stress test the workload with base/mid/high scenarios for the weeks where things might change positively or negatively. Next to each task, buyers should take care to note the frequency of each task and the expertise required.

This is a useful exercise for analyzing when some tasks might increase (e.g. maintenance) and what could cause that (e.g. more customers, more traffic) which helps improve thinking around growth planning/strategy. From a diligence perspective, it also helps identify where there might have been previously unstated responsibilities or undiscovered shared resources.

From a practical perspective, there are ways that buyers can dig deeper to get the information to validate the tasks. For example, two significant work streams in many online businesses are customer support and maintenance. If the business being evaluated falls into this camp, then buyers should look to requisition the customer support logs (e.g. ZenDesk) and analyse the frequency of tickets, nature of enquiries and associated response times. This will give a lot of clarity over the stated time requirements and the expertise required.

For maintenance (e.g. software coding), buyers should look to requisition the developer wage slips and maintenance logs (if they exist) to diligence these requirements too.

Fundamentally, a task audit should verify the statements made about time spent on the business. It should also help a buyer plot the pieces of the business out for the transition of ownership and growth strategy ahead.

Technical

Technical DD relates to establishing that the technology platform that the business is based on has a solid foundation. Typically this involves assessing technical elements including the CMS, plugins, hosting/server data and any email solutions being used. For SaaS or software businesses, an audit of the source code is highly recommended before for the sale.

CMS / Plugins / Hosting / Email

Buyers should look to audit the content management system and plugins being used by the website. A screen share is sufficient to establish the CMS version and the plugins in use. Buyers should be wary of websites that have not been updated in a significant period of time as these may experience issues when upgraded at a later point. Server side data can also be an indication of a legacy install.

On the plugin side, buyers should look to ensure all the plugins being used are paid for (where relevant) and updated to the latest install. The former is important to avoid any unexpected bills post sale and the latter important for stability issues down the line.

For businesses heavily reliant on robust hosting (e.g. SaaS or high traffic sites), buyers should look to requisition hosting data pertaining to bandwidth usage and downtime. This is an important and often overlooked component. Analyzing the hosting configuration and downtime data is vital and may uncover explanations for potential revenue fluctuations or customer service issues.

For businesses where the email list is of focus either as a current or future customer capture and monetization channel, buyers should take care to verify the key email metrics advertised with the business. The majority of business owners use 3^rd party tools such as AWeber, MailChimp and GetResponse, all of which provide sufficiently detailed analytics to help in this regard. Buyers should look to requisition information on:

• Subscriber growth (recently and over time)
• Open and click-through rates
• Bounce rates
• Broadcast frequency
• Email sequence configuration

Consistency in open and click-through rates is important across broadcasts as is the frequency. Be wary of businesses with declining readership and a high frequency of emails, both of which signal reader fatigue.

Source Code

For business acquisitions including intellectual property such as software source code, it is advisable to audit the code in either GitHub or requesting a sample. Buyers who are not well versed in the programming language should look to hire a programmer for a few hours to analyse the code with a particular focus on the quality of the code base, the originality and the annotation/ documentation that accompanies it. This final point is of particular note for software that is regularly updated or is intended for major development in the future.

Legal

Legal due diligence completes the set of key tenets for the due diligence process. In general the depth of legal DD is proportionate to the size of the business being acquired, but there’s certainly no reason not to follow through on some basic checks for any sized business under offer. There are a number of relatively straightforward checks that buyers should look to take.

Corporate Entity

Check to find the seller’s corporate entity in the state corporate registrar. Check for good-standing and request a certificate from the state registrar if you wish.

Liens

Checking for tax liens against the business or person is a wise course of action for larger size acquisitions. There are various 3^rd party services that handle this at the local and national level which are relatively cheap to contract for the peace of mind they give. Corporation Service Company is typically well recommended.

Trademark Search

If the business being acquired comes with a trademark, ensure the trademark is properly registered and active still. Buyers can do this through USPTO which provide a user friendly service for search for protected intellectual property. It is also worth searching the trade name of the business regardless of whether there is a trademark, in case it is currently infringing on a 3^rd party trademark.

Content Uniqueness

Ensuring the content on the site is original and unique is vital from both a litigation and SEO perspective. Buyers should look to screen a sample of the content through content-checking tools such as CopyScape. Naturally the importance of unique content varies with the type of internet business (i.e. it will be of greater focus on high content websites), but a high degree of plagiarized content says more about the owner than it does about the quality of the site, which is something all buyers should be wary of.

Image Source Accreditation

Similar to content uniqueness, buyers should look to audit a sample of images used on site to make sure they are correctly attributed. TinyEye provides a good service to do this quickly. It’s also important to ensure licenses have been properly acquired and can be proven, especially when using stock photos.

Privacy Policy and Terms of Use

An up-to-date and properly written privacy policy is very important in the current era of information security. It is also an essential requirement for sites running AdSense (with specific criteria) so buyers should take note to audit the privacy policy for compliance and general quality. There are various free privacy policy generators online which provide a good reference point.

Terms of Use is of particular importance for e-commerce, software or SaaS businesses where there is any extended guarantee or refund policy made to users which could extend to the purchaser upon completion. Generally speaking the APA indemnifies the purchaser from legacy issues but it is important that buyers are aware of what obligations there are taking on and if they need to change these going forward.

Major Contracts

Any major advertising, affiliate or 3^rd party contract that the business relies up for significant revenue generation or cost should be very closely examined by buyers. Before the business is acquired, buyers should seek reasonable assurances from the seller (and warrant in the APA) that the contracts will survive a change of control on the same terms.

Putting It All Together

With a comprehensive due diligence process completed, it makes sense to step back and assess the findings in the context of the wider business sale. In truth, no business is perfect and there are likely to be minor infractions here and there so it is important that buyers approach it with a mindset of materiality and assess any issues in light of the overall purchase and size.

The other important factor to think about is the seller’s responsiveness to issues as they have arisen. Did they act with surprise? Did they respond quickly with a detailed and credible explanation? These are important considerations for taking a wider view on the seller’s character which is fundamental to deciding to proceed forward with trust.

Want help planning your DD process? No problem! We have put together a handy DD checklist.

If you have got any questions, do please drop us a note in the comments below.