Buying an MSP: The Due Diligence Checklist That Keeps You From Overpaying

Last updated: October 7, 2026
Written by Rhett Collver, Managing Partner, C4 Solutions

Say you’re buying a $4 million MSP. The teaser shows 72% recurring revenue, 21% adjusted EBITDA, and no client above 8% of sales. Good numbers. Unverified ones, too. Every one of them was prepared by the seller’s team, and every one of them sets your price.

I’ve sat on both sides. I founded an MSP and ISP, took it past $5 million in revenue, and then sold it. After that came years in investment banking, working on acquisitions. Buyers rarely get burned by some dramatic hidden lawsuit. They get burned by ordinary numbers that turn out a little softer than the teaser said, multiplied by the same EBITDA multiple they already agreed to pay, and nobody notices until the first year’s results come in.

And the market isn’t handing buyers extra time. Omdia counted 64 MSP and MSSP acquisitions in the first quarter of 2026, up 73% from a year earlier, with outside investors involved in 80% of them. More capital chasing the same good MSPs. That’s when diligence gets rushed.

What Does Due Diligence Cover When You’re Buying an MSP?

MSP due diligence is the buyer’s verification of everything the purchase price assumes, done after the letter of intent and before closing. It covers the financials, the quality of the recurring revenue, client contracts, gross margin by service, the security of the tools and admin accounts, vendor commitments, and the people who deliver the work.

Generic M&A checklists stop at the financial statements. An MSP is different. Its revenue sits on top of other companies’ networks. You’re buying contracts that may not transfer, privileged access into dozens of client environments, and a team whose client relationships leave the building every evening.

Is the Recurring Revenue Actually Recurring?

Only if it’s under a written agreement, billed on a schedule, and collected. Rebuild monthly recurring revenue agreement by agreement from the PSA, then tie it to invoices and bank deposits for at least the last 12 months.

Sellers aren’t usually lying about MRR. They’re generous. A few things get folded into the recurring line all the time.

• Block hours and prepaid retainers. A client buys 40 hours, burns them down over a year, and may never buy again.
• Microsoft 365 and other licensing billed monthly. Recurring, sure, but at a pass-through margin that shouldn’t earn a managed services multiple.
• What stops a month-to-month client with no signed agreement from leaving the week your deal is announced?
• A 15% price increase that went out in August and hasn’t faced a single renewal yet.

One test catches the rest. It’s boring. It works. Export the agreement list from the PSA, whether that’s ConnectWise PSA, Autotask, or HaloPSA, and match each agreement to an invoice and then to a deposit in the bank statement. Next, pull the device count from the RMM and compare it with the devices the clients are actually billed for. A gap one way means free work the seller never priced. A gap the other way means a client is about to notice they’ve been overpaying. Either one matters.

Churn belongs in this section too. Ask for the client list as it stood at the start of each of the last three years, not just today’s version. Names that disappeared tell you more than the names that stayed.

Which Clients Can You Actually Keep?

Whichever ones the contracts allow. Read every client agreement for assignment and change-of-control language, termination rights, and end dates. Then measure how much revenue sits with the top one, five, and ten clients.

In a stock purchase the contracts stay with the company, so assignment usually isn’t triggered unless a change-of-control clause says otherwise. In an asset purchase each contract has to be assigned to you, and some of them will need the client’s written consent, which means the seller has to make some awkward calls before closing. Not after.

Concentration is the other half. There’s no legal ceiling for a private MSP, but public companies have to disclose any single customer that reaches 10% or more of revenue under ASC 280, which makes it a sensible place to start asking hard questions. A school district at 18% of revenue is a great client and a risky asset. Price it as both.

Who holds each relationship? If the top ten clients all have the owner’s cell number and nobody else’s, the paper matters less than you’d think.

Where Is the Margin Hiding?

Inside the blended number. Ask for gross margin by service line, covering managed services, projects, licensing, and hardware, with labor and tool costs assigned to each one. A healthy blended margin can hide a service that loses money every month.

For managed services agreements, a long-standing rule of thumb from Taylor Business Group puts the floor at 65% gross margin on each agreement. It’s old. Published in 2016. Still a decent first filter. For the business as a whole, a June 2026 Service Leadership report found top-performing IT service providers holding adjusted EBITDA at 19% or more for a sixth straight year. A target claiming far above that? Look twice.

Then go line by line through the tool stack. RMM, PSA, EDR, backup, email security, documentation. Each one bills per seat or per device, and sellers sometimes carry a client on a bundle price that was set three tool changes ago, so rebuild the true cost of serving the five largest clients from scratch and don’t be surprised if one of them is quietly being subsidized by everyone else.

Check who does the work, too. A margin that depends on the owner working 60 unpaid hours a week isn’t a margin. It’s a salary. The next owner pays it.

Do the Add-Backs Hold Up?

Some will and some won’t. Every add-back needs a document behind it and has to pass one plain test. Would this cost really stop after closing, or does it come back every year under a different name?

The SEC’s staff applies nearly the same test to public companies. Its non-GAAP guidance warns that stripping out normal, recurring, cash operating expenses can make a measure misleading, and it treats an expense as recurring even when it shows up at irregular intervals. A tool migration every two years is a recurring cost. So is the recruiting fee that gets labeled one-time every single year.

Owner pay cuts both ways. Suppose the seller takes $350,000 and a general manager would cost $180,000. The difference is a fair add-back. Now suppose the seller takes $90,000 while running service delivery, sales, and every vCIO meeting. The adjustment flips. You’ll be hiring for those seats. Sellers get warned about the inflated version in our rundown of MSP exit strategy mistakes, and buyers should read that list from the opposite chair.

Smaller deals just got stricter rules. As of October 1, 2026, the SBA requires a quality of earnings report on acquisition loans with a purchase price of $3 million or more. It’s engaged for the lender’s benefit, it can’t be prepared by or for the buyer or the seller, and it has to reconcile bank activity to the income statement and the tax returns. Financing with SBA debt? The lender will test the add-backs for you. Paying cash? Order the review anyway.

What Security Risk Comes With the Client Base?

All of it. An MSP holds privileged access to every client it manages, so a weak spot in its tools or accounts is a weak spot in every network you’re about to take responsibility for.

That isn’t a sales line. A joint advisory from CISA, the NSA, the FBI, and their Five Eyes partners warned that attackers can use a vulnerable MSP as an initial access vector to multiple victim networks. The same advisory tells MSPs to put MFA on every account with access to customer environments and never to reuse admin credentials across customers. And Verizon’s 2025 Data Breach Investigations Report found third-party involvement in breaches had doubled to 30%. Sit with that number for a minute before you sign.

What to ask for

• Every account with admin rights in the RMM, the PSA, and the documentation platform, plus the person who uses each one
• MFA enforcement settings as screenshots, not a verbal yes
• Where credentials live, and whether any are shared across clients
• Offboarding records for techs who left in the last two years. Were their accounts really removed?
• Incident history, cyber insurance claims, and any breach notices sent to clients
• The date of the last tested backup restore

Bring in a technical reviewer who has run an MSP stack, not a general IT auditor. The question isn’t whether the tools are good. It’s whether the way this team uses them would survive your own insurer’s questionnaire. Different question entirely.

Will the Team Stay After Closing?

Not automatically. Find out who holds the client relationships and the technical knowledge, then decide what it will take to keep those specific people through the first year.

Ask for an org chart with tenure and pay, then ask the uncomfortable question. If the service manager quit in month three, who would the clients call? Be honest. Documentation answers part of it. Open the runbooks in IT Glue or Hudu and check the edit history, because a runbook that was kept current for years reads very differently from one that was written last month for the sale.

In a lot of MSPs under $5 million, the owner is the single biggest dependency. Our exit-ready MSP framework was written for sellers, but read it as a buyer and you’ll spot the owner habits that drag a price down. Buyers discount for messy books, founder dependency, undocumented processes, and concentrated client lists, sometimes by several turns of the multiple. When those risks are present, the price should show it. Or the structure should.

Retention tools are simple enough. Stay bonuses paid in stages. A written transition agreement for the owner with a defined term. Non-solicitation terms for clients and staff, drafted by an attorney who knows your state, since enforceability varies a lot from one state to the next.

What Vendor Commitments Come With the Deal?

Every contract the MSP signed to serve its clients. Microsoft licensing commitments, distributor terms, and tool contracts with seat minimums keep billing even if a client walks out the month after closing.

Microsoft’s new commerce rules deserve a close read. Per-user subscriptions can be cancelled for a prorated refund only within seven calendar days of purchase, and Microsoft holds the partner responsible for payment even when the customer can’t or won’t pay. Get every annual commitment, its renewal date, and the client it belongs to. All of them. Lose a client in month two of a 12-month term and you’re holding ten months of licenses nobody uses, billed to you every month whether the client pays or not.

RMM, PSA, backup, and security vendors negotiate minimum commitments as well, and a few contracts carry change-of-control language of their own. Read them before you plan a migration, not after you’ve announced one.

How Should Each Finding Change the Offer?

Each finding should move one lever. Lower the price, hold part of it back in escrow, tie part of it to an earnout, make something a condition of closing, or walk away.

Deal terms data shows how normal the middle options are. In SRS Acquiom’s 2026 study of private-target deals, earnouts showed up in 24% of 2025 transactions, and the median indemnity escrow was about 10% of deal value.

Walking away counts too. Nobody enjoys writing off the legal fees and the months. It still costs less than owning a business you paid too much for.

Who Should Run Each Part of Diligence?

Split it four ways. A CPA firm for the quality of earnings. An M&A attorney for contracts, the entity, and the purchase agreement. A technical reviewer who has actually run an MSP stack. And you, personally, for the conversations with key clients and employees, because nobody else can judge whether those people will want to work with you once the seller is gone.

Bought three MSPs already, with an integration team on staff? You may not need outside help on half of this. First-time buyers usually do, and I’d rather say that plainly than pretend every buyer needs an advisor.

C4 Solutions is a growth and M&A advisory firm for MSPs and technology companies, based in Irvine, California. On the buy side we build the target profile, source sellers through our done-for-you MSP deal flow service, and guide buyers from the first conversation through LOI, diligence, and close. If you’re weighing a deal backed by outside capital, our notes on PE-backed MSP acquisitions cover what those buyers look for. And if a deal is already in motion, bring the target to our M&A team before the exclusivity clock runs out.

Book an M&A Strategy Call