What Due Diligence Asks a Fire Safety Business For

First WaveThe first request is commercial and it arrives within days

The opening list is short and it is about revenue quality. Three years of statutory accounts with management figures behind them, the split between contracted servicing income and project or reactive work, the full contract schedule showing who each agreement is with, what it covers, how often the visits fall, what it is worth in a year and when it comes up for renewal, and an analysis of the largest clients as a share of contracted income.

What the buyer is testing here is whether the business it was shown is the business that exists. Almost every disappointment in a process starts at this point, with a contracted share that turns out to be lower than the summary suggested, or a client concentration that was not visible in the headline numbers. An owner who assembled this material before the process began is simply confirming what was already said.

A fourth item sits in this first wave and surprises sellers: the pipeline. Buyers ask for quoted work not yet won, tenders outstanding and the conversion rate behind them, because they are testing whether current revenue is representative or whether it rests on a run of installation work that is ending. In a sector where servicing recurs and projects do not, that distinction moves the figure materially, so it is better presented than inferred.

Alongside it comes the three year renewal history: what percentage of the contract base renewed each year, what was lost and to whom. That figure is the most influential single number in a fire safety valuation, and it is also the one most often estimated rather than measured. Measure it before someone else does.

What the buyer is testing here is whether the business it was shown is the business that exists.

Second WaveThe second request is the one that separates this sector from others

Then the compliance file, and in a certificated business it is substantial. The BAFE registration certificate and the exact scope it covers; every audit report behind it, with each non-conformity raised and the evidence that closed it; a named list of who stands behind each module, and proof that lead individuals hold the Level 3 or higher regulated qualification that SP203-1 has required since 1 November 2025; then engineer qualifications, training records and CPD.

Then the work itself. A sample of service certificates and site log records going back two years, commissioning and handover documentation for recent installations, the defect and remedial trail showing what was found, what was recommended and what the client decided, and evidence that system modifications have been assessed against BS 5839-1:2025 since it came into force on 30 April 2025, with component compatibility confirmed.

This wave is where sellers get caught, because none of it can be created retrospectively. A missing commissioning certificate from 2023 is missing. An unanswered remedial report is unanswered. The only useful response is to have done the work at the time, which is why record keeping is preparation rather than administration.

One item in this wave is worth preparing as a document in its own right. A short written summary of how compliance is managed, who signs what, how defects are escalated, where records are stored and who checks them, answers a set of questions that would otherwise arrive one at a time across three weeks. A buyer reads it as evidence that a system exists rather than a habit.

Third WaveThe third request is legal, and the employment file decides the timetable

Employment records come next: contracts for every employee, the engineer list with start dates and qualifications, holiday and pension arrangements, any consultancy or subcontract arrangements, and every variation agreed along the way that never made it onto paper. Employees transfer with the business under TUPE, so the buyer is establishing exactly what it is inheriting, and the information and consultation obligations that follow set a timetable neither side can ignore.

With it comes the rest of the legal pack: company records and share history, property leases, vehicle and equipment finance, insurance policies with six years of claims history, professional indemnity cover in particular, and any disputes or complaints open or closed. Insurance history is read closely here for obvious reasons, and a clean record is worth stating clearly rather than leaving to be discovered.

On timing, one point worth carrying into any March conversation. Diligence in a certificated business runs three to five months, so a process being contemplated now sits well past the tax year end. Business Asset Disposal Relief is 14% until 5 April 2026 and 18% from 6 April 2026, and since the completion date fixes the rate, that arithmetic is best done before a timetable is promised to anyone.

A late request usually arrives after the main waves, when everybody is tired, and it is all loose ends. Intellectual property in any software or documentation the business has built, data protection arrangements covering client records, subcontractor agreements, and whether anything material sits in the owner's personal name rather than the company's. Vehicles, premises and domain names turn up in that last category more often than owners expect.