CIM Review Checklist: A Buyer's First-Read Walkthrough

I keep a checklist open on a second monitor every time a new CIM lands. Not because the analysis is hard (most of it isn't) but because it's easy to skim past the one line that kills the deal when the document is 40 pages of polished prose and someone else's profit framing.

This is that checklist. It's structured as a first-read pass: a sequence of items you tick through in order, each one a yes/no or a number you write down. If you want the underlying method (why I start with financials, how I run the two-hour triage) read how to read a CIM first. This post is the operational companion: the actual boxes I check. If you want the failure patterns that should make you walk, the CIM red flags guide covers those in depth.

Work top to bottom. You don't have to finish every section. The whole point of a checklist is that some items end the review early (a declining revenue line, a single customer at 40%) and that's a result, not a failure.

Section 1: Is the Financial Picture Internally Consistent?

Start here, every time. Before you judge whether the numbers are good, judge whether they agree with each other. Inconsistent financials are the cheapest red flag to find and the most expensive to miss.

• Three years of revenue are present and the trend is clear. Not one year. Not a chart with no axis labels. Three discrete revenue figures you can read.
• SDE moves with revenue, or you understand why it doesn't. If revenue dropped 8% but SDE somehow rose, find the reason (it's usually an add-back that got bigger, which is its own flag).
• The summary P&L ties to the detailed P&L. If the executive summary says $480K SDE and the financial appendix totals to $510K, that gap is a question, not a rounding error.
• Margins are stable across the 3 years. Gross margin swinging from 52% to 61% to 47% means either the business is volatile or the books are inconsistent. Both matter.
• The asking price implies a multiple you can state out loud. Asking divided by most-recent SDE. If it's 4.2x on a main-street services business, write that number down now (you'll come back to it).

If two of these fail, I usually stop and send clarifying questions before reading further. There's no point analyzing operations on top of numbers that don't reconcile.

Section 2: Are the Add-Backs Defensible?

Almost every CIM presents a "recast" or "adjusted" SDE higher than net profit. That's normal and legitimate. Your job on the first read is to flag which add-backs you'll need to verify, not to verify them yet (that's diligence).

• Total add-backs as a percent of net profit are written down. $150K of add-backs on $200K net profit is 75%, and that's a number worth staring at.
• Each add-back line is named, not bundled. "Owner adjustments: $140K" is not a schedule. A schedule lists owner salary, health insurance, the vehicle, the travel, line by line.
• Owner compensation is added back, and you know the replacement cost. If the owner runs sales and operations, the add-back for their salary is only honest if a buyer can replace them at that number. Often you can't.
• No add-back is suspiciously recurring. A "one-time" equipment repair that appears in all 3 years isn't one-time. Mark it.
• You've separated discretionary from structural. The owner's country club membership is a clean add-back. A below-market rent paid to the owner's own real estate LLC is a structural cost that comes back the moment you sign a market lease.

Section 3: How Owner-Dependent Is This Business?

This is the section that separates a real SDE from a fictional one. A business that can't run without the seller is a job you're buying, not an asset, and the financials rarely say so out loud.

• The owner's weekly hours are stated. If the CIM is silent on this, that silence is your first question for the call.
• The owner's actual roles are listed. Lead technician, top salesperson, only person who talks to the bank: each of those is a hire you'll need to make.
• There's a management layer that functions without the seller. A GM or operations lead with multi-year tenure de-risks the whole transition.
• Customer relationships sit with the company, not the owner personally. If the top accounts call the owner by his first name and would follow him out the door, that's transfer risk the SDE doesn't capture.
• You've estimated the true owner-replacement cost. Add up the hires required to cover what the owner does. A $350K SDE that needs $160K of new payroll to replace the owner is really a $190K SDE. Write the adjusted number down.

Section 4: Where Is the Revenue Concentrated?

Concentration risk is invisible in a clean-looking P&L and lethal to your DSCR. A business with $400K SDE and one customer at 35% has an effective debt-coverage cushion much thinner than the headline number suggests.

• Top-1, top-3, and top-5 customer concentration are documented. If the CIM doesn't disclose it, that's a required ask before any LOI.
• No single customer exceeds 20% of revenue. Above that line, one phone call can break the deal math. (I treat 20% as the threshold, not a hard wall, but it raises the bar for everything else.)
• Revenue mix is recurring vs. project, and you know the split. $2M of recurring contracts is a different asset than $2M re-earned from scratch every year.
• No single industry or geography is over-concentrated. 70% of revenue from one local municipal contract is concentration even if it's spread across departments.
• Contract terms and renewal dates are visible for the big accounts. A top customer whose contract expires 4 months after close is a timing risk you price in.

Section 5: Does the Business Transfer Cleanly?

You're buying historical performance, but you're also buying the ability to keep that performance running under new ownership. This section is about transferability.

• The real estate situation is clear: owned, leased, or sold separately. Owner-owned property changes the capital requirement and the lease economics materially.
• Lease terms (if leased) survive the sale or are assignable. A great business in a building you'll lose in 18 months is a different deal.
• Key licenses, permits, and certifications transfer to a new owner. Some don't, and that can stall a closing for months.
• Key employees are likely to stay. Tenure, whether they know the business is for sale, and any non-competes all factor in.
• The reason for selling is consistent with the trajectory. "Retirement" from a growing business is plausible. "Pursuing other interests" from a 49-year-old whose revenue declined 3 years running is a question, not an answer.
• Any litigation, regulatory, or environmental issues are disclosed. Often framed as "immaterial." Take that at face value only after your attorney reads it.

Section 6: Do the Numbers Pencil at the Asking Price?

Now run the quick model. Not a full diligence model, just enough to know whether this deal survives debt service. If it doesn't pencil at the ask, you either negotiate or pass, and you want to know which before the call.

• You've used the adjusted SDE, not the headline SDE. Take the number from Section 3 (after owner-replacement cost), not the broker's recast figure.
• You've modeled the SBA structure. 10% to 15% down, 10-year term, ~9.75% interest as of mid-2026, seller note if any. Plug it into the free SBA calculator to get the annual debt service.
• DSCR clears the SBA minimum of 1.25x with room to spare. A 1.30x deal is tight. A 1.85x deal has a cushion for the transition year.
• You've stress-tested a 20% to 30% SDE drop. Owner-transition softness is real. If the deal still covers debt at a 25% haircut, that's a resilient deal. If it goes underwater at 15%, that's your answer.
• Working capital at close is estimated. Usually 1 to 3 months of revenue, often missing from the CIM. Add it to your capital requirement.

For the math behind that coverage ratio, the DSCR explainer walks through exactly how SBA lenders size a deal.

Section 7: What Questions Do I Send Back?

The last box on the checklist is a list, not a checkmark. Every gap you hit in Sections 1 through 6 becomes a question. By the time you finish a first read, you should have 5 to 10 specific questions written down, ready to send to the broker or raise on the intro call.

The questions that come up on almost every deal:

• What does the owner actually do in a typical week, hour by hour?
• What's the real, specific reason for selling, and why now?
• What's the top-customer concentration, and can I see it by account?
• How much of revenue is contracted vs. re-won each year?
• Which add-backs are discretionary, and can each one be documented?
• Are the key employees aware of the sale, and will they stay through transition?
• What are the lease and real estate terms, and do they transfer?
• How long is the seller willing to stay on for handoff?

If the answers to these (combined with the CIM) hold up, the deal earns an LOI and the formal diligence process that follows. The due diligence checklist covers that deeper pass. The CIM review just decides whether you get there.

Running the Checklist Faster

The mechanical part of this (pulling the three-year P&L, totaling the add-backs, finding the concentration table buried in "Operations") takes me 30 to 45 minutes on a clean CIM and longer on a messy one. That's time spent extracting numbers, not judging them.

I built Searcher OS partly to delete that step. You upload the CIM and it runs this analysis with AI: financials extracted, add-back inflation flagged, customer concentration surfaced, and the SBA calculator pre-populated for the Section 6 model. It doesn't make the pass/pursue call for you (judgment is still yours) but it hands you a filled-in checklist instead of a blank one, so your hour goes to interpretation rather than data entry.

However you run it, the discipline is the same: tick the boxes in order, let the early items end the review when they should, and don't read charitably past a number that doesn't work. The full acquisition process is in the complete guide to buying a small business, and the CIM red flags guide covers the patterns that should send you straight to a pass.