The statements look perfect: five years of growth, healthy margins and audit reports without a single qualification. Then one question during due diligence - how much of this revenue depends on two customers? - turns a 'stable' business into a fragile one. This article explains what a clean audit actually confirms, why compliance and resilience are different things, and the practical tests investors should run before relying on good-looking numbers.
Clean financials mean the statements are fairly presented under the applicable accounting framework and free of material misstatement. They do not measure business resilience. Customer concentration, key-person dependence, weak cash conversion, expiring incentives and fragile contracts can all sit behind an unmodified audit opinion. Due diligence tests whether earnings are reliable, repeatable and sustainable, and prices the risks it finds.
What does a clean audit report actually tell an investor?
An unmodified opinion under SA 700 says that the financial statements present a true and fair view, in all material respects, in accordance with the applicable financial reporting framework. It is a conclusion about presentation and measurement, reached with reasonable (not absolute) assurance and at a level of materiality set for the whole entity.
The audit also covers a going concern assessment under SA 570. Under Ind AS 1, management assesses going concern for at least twelve months from the end of the reporting period. That is a narrow window and a high bar: a business can comfortably pass it while being heavily exposed to the loss of one customer or one promoter.
For listed entities, the auditor also communicates Key Audit Matters under SA 701, and many companies have additional reporting under CARO 2020. These add useful signals, but none of them is designed to answer an investor's real questions: will these earnings continue, at what risk, and what is the business worth?
An audit asks, 'Are these numbers right?' Due diligence asks, 'Are these numbers reliable, repeatable and sustainable, and what could break them?' Both questions matter, but only the second one sets a price.
Compliance versus resilience: where the two diverge
The gap is easiest to see side by side. The left column is what a clean audit gives comfort on; the right column is what an investor still needs to know.
| Area | What a clean audit confirms | What due diligence still asks |
|---|---|---|
| Revenue | Revenue is recognised in the right period and measured correctly | Who pays it, how concentrated it is, and whether contracts protect it |
| Margins | Costs are complete and correctly classified | Which drivers create the margin and whether they will last |
| Cash | Cash and bank balances exist and reconcile | How much of profit converts to cash, and how quickly |
| Debt | Borrowings are disclosed and classified | Whether the debt structure can survive a bad year |
| Related parties | Transactions are disclosed | Whether pricing and terms will continue after the deal |
| Management | Representations are obtained | Whether the business depends on one or two individuals |
None of the right-hand questions implies that the auditor did anything wrong. They are simply outside the purpose of an audit, which is why investors commission separate financial due diligence.
Six resilience tests to run behind clean numbers
A resilience review does not repeat the audit. It takes the audited numbers as a starting point and stress-tests the business model that produced them.
Each test produces a finding that can be quantified. That is what distinguishes due diligence from a general sense of unease: every risk should translate into an effect on earnings, cash or price.
Illustrative example: when 70% of revenue comes from two customers
A manufacturing company reports revenue of Rs 60 crore and EBITDA of Rs 9 crore (15%). The audit report is unmodified. Due diligence finds that Customer A contributes Rs 27 crore (45%) and Customer B Rs 15 crore (25%), so 70% of revenue comes from two parties. Neither contract has a minimum volume commitment, and both can be terminated on 90 days' notice.
Analysis of the cost base shows a contribution margin of about 35% on these sales, with most overheads fixed in the short term. If Customer B leaves, revenue falls by Rs 15 crore and EBITDA falls by about Rs 5.25 crore (35% of Rs 15 crore), to Rs 3.75 crore.
At an illustrative multiple of 8x EBITDA, the implied enterprise value moves from Rs 72 crore (8 x Rs 9 crore) to Rs 30 crore (8 x Rs 3.75 crore) on the loss of one customer. Nothing in the audited statements was wrong. The risk simply was not something an audit is built to measure.
In practice, the investor's response is rarely to walk away. More often, the finding changes the structure: part of the price is deferred, an earn-out is linked to retention of key customers, or the valuation multiple is reduced to reflect the dependency.
Where fragility hides inside compliant financial statements
Some risks are not hidden by poor disclosure at all. They are fully disclosed but easy to read past.
Earnings that are accurate but not repeatable
A one-time contract, an insurance claim, a reversal of an old provision or an export incentive that is being withdrawn can all be correctly accounted for and still inflate the base year. Identifying and removing these items is the purpose of EBITDA normalisation in due diligence.
Related-party support that may end
Rent-free premises from a promoter entity, shared staff paid by a group company, or sales to an associate at favourable prices are typically disclosed under related party notes. The question is whether those terms will continue after a change in ownership. Our article on related party transactions in due diligence covers how to test this.
Growth funded by working capital
Revenue can grow faster than the business can finance it. Rising receivable days, supplier credit stretched to the limit, or inventory financed by short-term bank lines will all appear correctly in an audited balance sheet, but they signal that growth is consuming cash rather than generating it.
Governance that works only because the promoter is present
Approvals, controls and customer relationships that depend on one person may function well today. The risk becomes visible only on succession or exit, which is exactly when an investor is buying in.
How to run a resilience review alongside financial due diligence
- Start from audited numbers, not management packs. Reconcile management information to the audited statements first, so every later analysis rests on a verified base.
- Break revenue down by customer, product and geography. Use the sales ledger and GST returns to build a customer-wise revenue table for at least three years.
- Map the top contracts. Read the agreements behind the largest revenue streams for term, termination, exclusivity, pricing and change-of-control provisions.
- Test cash conversion. Compare EBITDA with operating cash flow and reconcile bank statements to reported revenue for selected months.
- Identify non-recurring and policy-driven items. List incentives, one-off gains, related-party concessions and accounting estimates that flatter the base year.
- Interview beyond the promoter. Speak to the finance head, sales head and plant head separately to understand where knowledge and relationships actually sit.
- Quantify each finding. Express every risk as a scenario effect on EBITDA, cash flow or net debt, so it can be negotiated.
This approach complements a quality of earnings analysis rather than replacing it. Quality of earnings establishes the right base; resilience testing asks how robust that base is.
What resilience findings mean for price and deal terms
A fragile but compliant business is not necessarily a bad investment. It is an investment that should be priced and structured differently from a resilient one.
- Valuation: a lower multiple, or a base-case EBITDA that excludes revenue at material risk.
- Deferred or contingent consideration: earn-outs or holdbacks linked to retention of key customers or key people.
- Conditions precedent: renewal of key contracts, transfer of licences, or formalisation of related-party arrangements before closing.
- Warranties and indemnities: specific protection for matters identified in diligence, rather than general warranties alone.
- Post-deal plan: a 100-day plan that addresses the dependency, for example by broadening the customer base or building a second-line management team.
For a fuller view of how diligence findings flow into price, see our guide to financial due diligence scope, process and deal price.
Ask for the audit report, but also ask for customer-wise sales, the top ten contracts and three years of monthly bank statements in the first data request. The comparison between these and the audited numbers is often where the most useful questions begin.
Frequently asked questions
Does an unqualified audit report mean a company is safe to invest in?
No. An unmodified opinion means the financial statements are fairly presented in all material respects. It does not assess customer dependence, management depth, competitive position or the sustainability of earnings, which are the matters that drive investment risk.
What is the difference between a statutory audit and financial due diligence?
A statutory audit gives an opinion on whether financial statements comply with the reporting framework. Financial due diligence is commissioned by a buyer or investor to understand earnings quality, cash flow, debt, working capital and risks, and to support price and deal terms.
How do I know if a business is compliant but fragile?
Look for high customer or supplier concentration, weak conversion of profit into cash, margins dependent on incentives or one-off items, short or easily terminated contracts, and heavy reliance on the promoter for relationships and decisions.
Can a going concern assessment be relied on for investment decisions?
Only to a limited extent. Under Ind AS 1 the assessment covers at least twelve months from the reporting date and asks whether the entity can continue operating, not whether its earnings will remain at current levels over an investment horizon.
Is customer concentration disclosed in financial statements?
Partly. Entities applying Ind AS 108 must disclose reliance on a single external customer that contributes 10% or more of revenue, without naming the customer. Many unlisted companies do not apply Ind AS 108, so diligence must build the analysis from ledgers and GST data.
Should resilience risks reduce the price or change the deal structure?
Often both. Quantified risks can lower the base EBITDA or multiple, while uncertain risks are usually handled through earn-outs, holdbacks, conditions precedent and specific indemnities.
Conclusion
Clean financial statements are a necessary starting point, not a conclusion. They tell you where the business stands on a reporting date; due diligence tells you how strong that position really is. By testing concentration, cash conversion, margin drivers, people dependence and contract strength, and by putting a number on each finding, investors can separate businesses that are merely compliant from businesses that are genuinely resilient, and price the difference.
Planning an acquisition or investment?
H K Davra & Co. carries out financial due diligence, quality of earnings and working capital reviews for buyers, investors and lenders.
Talk to usThis article is for general information only and does not constitute professional advice or solicitation. Examples and figures in this article are illustrative. Provisions are summarised as of October 2026. Please refer to the relevant provisions and seek advice on your specific facts.