I look at a lot of businesses. Most of them are good businesses. Very few of them are good acquisitions.
That distinction sounds pedantic until you sit with it. A business can have loyal customers, decent margins and a founder who built something genuinely useful, and still be the wrong thing to buy. Working out why has become one of the most useful disciplines I've developed while building Civsec Group.
This isn't a generic acquisition checklist. It's closer to the actual sequence of questions running through my head when an information memorandum lands in my inbox and I'm deciding whether an opportunity deserves real time.
A good business is not necessarily a good acquisition
This is the idea I keep returning to, because it's the one most consistently underestimated by people outside acquisitions.
A business can be well run, profitable and respected in its market, and still be a poor acquisition: the valuation doesn't reflect reality, the earnings aren't as durable as they look, or the person selling it is, in practical terms, the business itself. Admiring a business and wanting to own it are different exercises. Conflating them is one of the more expensive mistakes a first time acquirer can make.
It's worth separating three things that get treated as one. A good business can still be a bad acquisition, for the reasons above. But even a genuinely good acquisition, priced sensibly with no obvious red flags, can still become a bad transaction if the structure placed on top of it doesn't match the risk. Business quality, acquisition quality and transaction quality are three separate tests. A deal can pass the first two and still fail the third.
The reverse also holds, and is worth stating plainly: a mediocre business doesn't become attractive simply because it's cheap. Cheap is not the same as good value. A struggling company at a low multiple is often correctly priced for the risk it carries, not undervalued. I'm not hunting for bargains. I'm trying to understand exactly what I'd be buying, what could go wrong, and whether ownership by Civsec genuinely makes sense.
Where I start: essential services, and revenue that does not need to be earned again
I'm drawn to businesses close to essential, mission critical or compliance driven work: fire and security, facilities management, technical building services, controls and building management systems. Not because these sectors are exciting. They generally aren't. But much of the underlying demand is driven by safety, compliance, maintenance and operational necessity rather than discretionary spending alone.
Within that, I look hard at what kind of revenue the business actually has, because “recurring revenue” gets used loosely and shouldn't be. Three categories matter, and they are not interchangeable:
Contracted revenue is backed by an enforceable agreement: a maintenance contract, a statutory compliance requirement, a signed term. It's the closest thing to certainty a private business can offer.
Repeat revenue comes from customers who keep coming back, but without a contractual obligation to do so. It's genuinely valuable, but it can disappear faster than it looks like it can.
Project revenue depends on winning the next piece of work. Useful, sometimes profitable, but structurally the least durable of the three.
Almost every business I look at in fire, security, facilities and building controls claims a service and maintenance book. Fewer of them can actually show that the same engineer relationship, the same contract terms and the same renewal pattern survive a change of the name on the van. The distinction between those categories can become blurred in an information memorandum. I don't let them blur in my assessment. The mix matters more than the total, and I'd rather see a smaller contracted base honestly labelled than a large “recurring” number that turns out to be mostly repeat and project revenue wearing the same coat.
Whose business is it, really
Founder dependency is probably the single question I spend the most time on, because it's the easiest to obscure and the most expensive to get wrong.
Some businesses are genuinely institutional: the relationships, the technical knowledge and the reputation sit with the organisation, not one person. Others are, functionally, the founder with a company wrapped around them. It shows up most clearly in businesses where the owner is also the estimator, the account manager and the person who turns up personally to renew the relationship, common in this sector, and easy to miss in an information memorandum that lists a full technical team underneath him. Buy that business without a serious transition plan, and you haven't bought a company. You've bought a job, and the person doing it just left.
This isn't binary. It's a spectrum, and where a business sits on it changes everything downstream: the valuation I'd support, the transition period I'd need from the seller, and whether the existing team can actually run the business day to day. High founder dependency doesn't automatically disqualify an opportunity. It demands a very different structure than a business with a proper management bench already in place.
Earnings you can trust, not earnings you're told to trust
Many information memoranda arrive with an adjusted EBITDA figure, and those adjustments deserve scepticism before they deserve belief.
The exercise isn't to accept or reject the seller's number wholesale. It's to work through each adjustment and ask a simple question: would a new owner genuinely avoid this cost? Some adjustments are legitimate. Others disguise a recurring problem as a single event, or strip out a management cost on the assumption the work still gets done for free. I care less about the headline margin than about what's actually producing it. A margin built on unsustainable practices tends to correct itself, usually just after completion.
None of that matters if the EBITDA doesn't turn into cash. Debtor days, retentions, work in progress and the capital expenditure a business has been quietly deferring can all sit between a healthy looking margin and what's actually available to service debt. Technical service businesses in particular tend to carry more of this than the accounts first suggest: retentions on larger contracts, vans and equipment due for replacement, engineers waiting on payment terms longer than the business admits to. I want to see the cash, not just the accounting profit that's meant to represent it.
The same scrutiny has to apply to customers, not just earnings. Concentration alone doesn't tell you much on its own; a large customer on a long contract with genuine switching costs is a different risk from a large customer who could leave at the next renewal with a phone call. What I actually want to understand is contract position, renewal history, who owns the relationship day to day, and whether that customer has any real reason to stay once the business changes hands. A business can look concentrated and be reasonably safe, or look diversified and be quietly fragile. The percentage is a starting question, not an answer.
Financeable is a different question from attractive
A transaction can be strategically sound and still be a bad idea if it can't be financed sensibly. I think about what senior debt a business could reasonably support and what a seller might defer or finance themselves, but the number I actually care about is what's left over once that debt is being serviced, not the headline amount that can theoretically be borrowed.
That's really a question about downside protection. It's easy to size a capital structure around a clean base case and call it financed. The more useful test is whether the business can still service its obligations under some reasonable amount of stress: a slower quarter, a lost contract, a cost that rises faster than expected. A structure that only works if everything goes to plan is a hope, not a structure. I would rather walk away from an interesting business than lever it up in a way that leaves no room for a bad quarter.
This is also where growth assumptions earn their keep or get discarded. Credible growth, such as a service book that can genuinely be expanded or a customer base that can be sold additional services, is interesting. Growth that exists only as a line in someone's spreadsheet, with no operational evidence behind it, is not. The acquisition has to work on what the business is doing today. Anything beyond that is upside, not underwriting.
What I'm actually trying to answer
Strip it back and I'm really asking one thing in a few different forms: what am I actually buying, is the earnings picture real enough to survive a change of ownership, is there something here worth protecting, and can it be financed with enough margin for things to go wrong, because they usually do, at least a little.
None of this is about finding a business that looks perfect on paper. Perfect doesn't really exist, and I'd be suspicious of an opportunity that presented itself that way. It's about being honest with myself before I ask anyone else to be honest with me.
That's the standard I'm trying to hold myself to as I work through Civsec's pipeline: not enthusiasm for every opportunity that fits the sector, but judgement about which opportunities deserve the capital. It's a slower way to build a group. I think it's the only way that produces one worth having in five years, rather than a collection of businesses bought simply because they were available.