Due Diligence 12 min read

SaaS Due Diligence Deep Dive: Auditing Billing Systems and Subscription Management

The margin story of a SaaS company is only as true as its billing infrastructure. Most buyers focus on MRR, but the real risk lies in how that revenue is collected, billed, and managed.

2026-08-27  ·  By Sophal Lanh, Founder of Deal Alert AI

Deal Alert AI is reader-supported. We earn commissions from affiliate links at no cost to you.

This post is based on a video from our Deal Alert AI YouTube channel. Watch the original or read the full breakdown below.

The Hidden Risk in SaaS Revenue Claims

Most SaaS acquisitions go wrong not because the technology is bad, but because the financial data was manipulated or misstated at the source. When you look at a cap table or a financial model, you see Management Recurring Revenue (MRR) and Average Revenue Per User (ARPU). These numbers look clean. They look profitable. But if you do not dig into the plumbing beneath those metrics, you are buying a house without checking the foundations.

In my experience advising buyers on Deal Alert AI, I have seen countless deals price out because of billing discrepancies. The seller claims a 10% monthly churn rate, but the billing system reveals that customers were auto-renewing failed payments or that refunds were not being deducted correctly. This is not just an accounting error; it is a signpost of poor operational discipline that will bleed money after you take over as the new owner.

The core issue is that billing systems are the single source of truth for revenue. If the billing system is configured incorrectly, or if it lacks proper reconciliation with your payment processor, every financial projection you build is built on sand. You cannot trust the P&L (Profit and Loss statement) if the revenue recognition is flawed. This guide will walk you through exactly how to audit the billing and subscription management layers to ensure you are buying real, defensible revenue, not just inflated numbers.

Why Billing Systems Matter More Than Customer Support

Get Free Deal Alerts Every Morning

We scan Empire Flippers, Flippa, Acquire.com and Quiet Light daily — scoring every listing. Start free.

Buyers often spend 80% of their due diligence time on customer interviews and sales process analysis. This is a mistake. The billing system is the engine room of a SaaS business. It determines when money moves, how payments are applied, and how subscription states are defined. A sophisticated customer support team cannot retrieve revenue lost due to a broken webhook that failed to mark a subscription as "churned" after a failed payment.

Consider the mechanics of revenue. In a SaaS model, you are selling access over time. The billing system must accurately reflect this periodicity. If a customer upgrades from a Basic plan to a Pro plan mid-month, does the system prorate the invoice correctly? Does it handle the credit for the unused time on the old plan and the charge for the remaining time on the new plan? If the answer is no, you are either overcharging customers (which creates churn and chargebacks) or undercharging (which destroys your margins). Both scenarios are fatal for a post-acquisition growth strategy.

Furthermore, the complexity of your billing system dictates your operational floor. A simple, rigid billing system is easier to maintain but offers less flexibility for product-led growth strategies. A complex, highly configurable system allows for dynamic pricing and bundling but introduces significant risk of error. During due diligence, you must assess whether the existing setup matches the company’s growth stage. If a startup is using an enterprise-grade billing suite to manage 50 subscriptions, you are likely overpaying for infrastructure that becomes obsolete at scale. Conversely, if a scaled company is using a manual spreadsheet to manage 5,000 subscriptions, you are buying a ticking time bomb.

Key Insight: Never accept a SaaS valuation based solely on software-reported metrics. Always require a direct export of transaction-level data from the payment processor (such as Stripe or PayPal) to cross-reference with the billing software’s ledger. Discrepancies between these two sources are the most common red flag in SaaS deals.

Auditing the Payment Processor Integration

The first step in your audit is to disconnect from the SaaS dashboard and look at the bank feed. Most SaaS companies use Stripe, Braintree, or Chargebee as their billing engine, which connects to a payment processor. You need access to the raw data from the processor. Ask for a CSV export of all transactions from the last 12 months, including successful payments, failed attempts, refunds, and chargebacks.

Once you have this data, you need to perform a three-way reconciliation. First, match the payment processor data against the billing system’s invoice history. Every payment recorded in the processor should match an invoice in the billing system. If there are payments without invoices, ask why. If there are invoices without payments, investigate the failure rate. Second, match the net deposits in the bank account against the net proceeds from the payment processor. This is where tax withholdings, Stripe fees, and refund processing costs come into play.

A common error I see is "phantom revenue." This happens when a company books revenue based on invoices issued rather than cash collected. If a customer signs a contract but fails to pay, and the company books that as MRR, the financials are inflated. In due diligence, you must calculate the "Collection Efficiency Ratio." This is Net Cash Collected divided by Gross Revenue Recognized. If this ratio is below 95%, you have a significant leakage problem. You are working hard to generate sales, but the cash is not entering the business. This is a critical operational KPI that many sellers try to hide because it reflects poorly on their sales and finance teams.

Churn Analysis and Subscription State Visibility

Churn is the metric that kills SaaS business valuations. However, not all churn is created equal. You need to distinguish between "voluntary churn" (customer cancels) and "involuntary churn" (payment failure). A good billing system gives you clear visibility into both. If the seller cannot quickly show you a report breaking down churn by reason, that is a red flag. It suggests their data hygiene is poor, or they are deliberately obscuring the volume of in-voluntary churn.

Involuntary churn is often the largest category for SaaS companies handling credit card payments. On average, 40-60% of total churn in SaaS is due to failed payments. If a company claims a 2% monthly churn rate, you need to ask: Is that 2% pure voluntary cancellation? Or does it include the 1.5% of customers whose cards expired? If the latter, their true product churn is only 0.5%, which is a much stronger fundamental. But it also means they need a dunning sequence (automatic email/SMS reminders for failed payments) to recover that revenue.

During the audit, test the "customer status" workflow. Create a test subscription. Cancel it. Change the quantity. Add a one-time purchase. Observe how the system handles these state changes. Does it immediately update the MRR? Does it send the correct transaction emails? If the system is lagging or sending confusing emails, you are looking at a technical debt issue that will cost you engineering resources to fix after the deal closes. This is not a minor annoyance; it is a direct hit to your post-acquisition EBITDA because you will have to divert engineering time to patch the billing flow rather than building new features.

The Danger of Multi-Region and Multi-Currency Billing

If the SaaS business has international customers, your due diligence must expand to cover currency exchange rates and tax compliance. A simple billing setup handles one currency and one tax jurisdiction. A complex global setup must handle dynamic currency conversion, VAT/GST collection, and international remittance fees. For first-time SaaS buyers, this is often a blind spot. They see high revenue from international customers but do not understand the net margin impact of currency fluctuations and payment processing fees, which can range from 1.5% to 4% per transaction depending on the route.

You need to analyze the "Effective Tax Rate" calculated from the billing system. Does the business use a tool like Avalara or TaxJar to automate sales tax? If not, they may be undercharging or overcharging, which leads to compliance audits. A buyer inheriting a business with months of unfiled sales tax returns is inheriting a legal liability that can completely wipe out the acquisition profit. Always request a copy of the tax calculation report from the last four quarters. Look for anomalies where tax was charged on non-taxable services or missed on taxable ones.

Furthermore, examine how the company handles refunds across currencies. If a customer in the UK cancels a subscription billed in USD, does the system convert the refund rate dynamically or use a fixed rate? Small discrepancies here accumulate over time. In a large deal, these discrepancies can amount to thousands of dollars in unrecovered revenue or unnecessary expense. You want to ensure the billing system is configured to maximize the company’s net income, not just to process transactions blindly.

Warning: If the seller claims "zero" compliance risk but cannot produce a third-party audit of their sales tax configurations, do not close the deal. Uncovered sales tax liabilities are retroactive. If the IRS or local tax authorities decide the business under-filed, the penalty falls on the new owner, not the seller. Always escrow a portion of the purchase price to cover potential back-taxes.

Evaluating the Billing Technology Stack for Technical Debt

Technology debt is the hidden cost of buying a business. When evaluating the billing technology, ask: Is it proprietary, open-source, or a SaaS product? If it is a proprietary in-house build, you are buying a liability. You do not know the code quality, the maintainer, or the security vulnerabilities. If it is a SaaS product (like Stripe Billing or Recurly), you are buying a dependency. You need to confirm that the contract terms transferable to the new ownership group. Some billing vendors have clauses that allow them to cancel service if ownership changes, which could disrupt your revenue stream on day one.

I recommend pushing for a "Code Review" or at least an "API Introspection" if the system is custom-built. If the billing system is custom, you need to know who maintains it. If the founder is the sole developer of the billing logic, you are relying on a single point of failure. If the business is scaling, that person is your bottleneck. You should factor in the cost of hiring a senior engineer to take over the billing infrastructure into your post-acquisition budget. This is a consumable cost, not a one-time fee. You will need engineers forever.

Also, look at the integration points. Does the billing system integrate cleanly with the CRM? If a sales rep closes a deal in Salesforce, does the subscription automatically start in Stripe? Or does someone have to manually create the subscription? Manual processes scale poorly. They lead to errors, missed revenue, and customer dissatisfaction. During your audit, track a new sales cycle from lead closure to first invoice billing. If there are manual handoffs, quantify the time and error rate. This is the operational drag that will eat your margins in the first year of ownership.

Ensuring Data Privacy and Security Compliance

Billing systems store bank account information and email addresses. This makes them a prime target for hackers. When auditing SaaS deals, you must verify the security posture of the billing infrastructure. Is the data encrypted at rest and in transit? Are access controls properly segmented? Can every employee see every customer’s credit card number? If the answer is yes, you have a catastrophic security flaw that violates PCI-DSS (Payment Card Industry Data Security Standard).

You should request a review of the user role hierarchy in the billing platform. Who has admin access? Who can issue refunds? Who can view raw transaction data? Ideally, refund permissions should be restricted to a few trusted finance staff. If junior support staff can issue unlimited refunds, you have a fraud risk. Additionally, check the logging capabilities. Can the company trace a specific transaction back to a specific user action? If not, you cannot protect yourself against internal theft or external fraud when you take over.

Beyond security, consider data deletion. GDPR and CCPA require that data be deleted upon request. Does the billing system support this? If the system retains card data indefinitely, you are non-compliant with privacy laws. Remediation for data privacy violations is expensive and public. It can hurt the brand and depress the valuation significantly. As a buyer, you must be proactive. Do not assume the seller has handled this. Ask for a data retention policy document and verify its implementation in the actual system configuration.

The Profitability Impact of Dunning and Recovery Strategies

Dunning is the process of collecting unpaid invoices. It is the difference between losing a customer forever and recovering 80% of failed payments. Advanced billing systems have built-in dunning sequences that send emails, retry payments, and update card details. If the SaaS company you are buying does not use these features, or if they have disabled them, you are leaving money on the table. Every month, you are losing revenue that should have been collected.

Calculate the potential upside of active dunning. Take the last six months of failed payment attempts. Multiply the number of attempts by the average recovery rate (typically 15-30% for well-configured dunning). This is the incremental MRR you can capture immediately after acquisition. This number should be added to your "Run Rate" adjustment during valuation. If the seller is not maximizing dunning, you are not just buying a business; you are buying a stranded asset room for revenue. This is a great thing for the buyer, but it means the historical EBITDA is understated. You must adjust your multiples accordingly.

Furthermore, look at the "Rescue Rate." This is the percentage of churning customers who can be saved by a coupon or a retention offer triggered by the billing system. Modern billing platforms allow you to trigger discounts when a payment fails or a cancellation is detected. If the current setup is static, you are missing out on this dynamic retention opportunity. The billing system should be viewed as a retention engine, not just a collection tool. If the technology stack does not support this, you may need to plan for an upgrade in your first 90 days of ownership. Budget for this. It is a capex (capital expenditure) that pays for itself in retained MRR.

Key Insight: The "Dunning Recovery Rate" is a leading indicator of SaaS health. A high recovery rate indicates a sticky customer base that intends to stay but had a payment issue. A low recovery rate, combined with high churn, indicates customers are actively leaving. Use this metric to separate "technical churn" from "product churn" in your valuation model.

Critical Due Diligence Checklist for Billing Audits

Due diligence is not just about reading documents; it is about verifying reality. The following checklist is a non-negotiable part of any SaaS acquisition. You cannot skip these items. If a seller resists providing any of this data, walk away. Transparency is the currency of trust in M&A.

  1. Request Raw Transaction Logs: Obtain a complete export of all transactions from the payment processor for the last 24 months. Do not rely on the billing dashboard’s summary reports. We need row-level data to detect anomalies.
  2. Verify Reconciliation Procedures: Ask the CFO or Finance Lead to demonstrate how they reconcile the bank statement against the Stripe/dashboards. Watch them do it. If it takes them more than an hour, their process is manual and risky.
  3. Analyze Churn Breakdowns: Separate voluntary churn from involuntary churn (failed payments). Calculate the "net churn" after dunning recovery. This gives you the true customer health metric.
  4. Test the Invoice Lifecycle: Create a test user. Run through a full cycle: signup, payment, upgrade, down-grade, cancellation. Note any errors, delays, or lack of communication in the emails triggered.
  5. Audit Access Controls: Review the user roles in the billing software. Ensure that not everyone has super-admin access. Confirm that refund limits are set appropriately and that logs are monitored.
  6. Check for Dormant Accounts: Identify customers who have not logged in or received service for 90+ days but are still being billed. This is "zombie revenue." It will eventually churn and will likely come with chargebacks if you don't clean it up.
  7. Review Refund History: Look at the last 12 months of refunds. Are there patterns? Is there a specific product feature or a specific period where refunds spiked? High refund rates on specific invoices indicate product-quality issues.
  8. Evaluate Tax Configuration: Confirm that sales tax/VAT is being calculated and collected correctly for all jurisdictions where the company operates. Request a report from their tax automation provider if one is used.

Negotiating Based on Billing Findings

Once you have completed the audit, you are in a position of strength. Most sellers have not audited their billing systems rigorously. They assume it works because the money is coming in. When you present them with a report showing that their churn is actually 3% higher than they claimed due to uncollected failed payments, or that their refund rate is double the industry average, you have identified a material adverse change. This is leverage.

Use these findings to adjust the purchase price. If the correct churn rate is higher, the Lifetime Value (LTV) of your customers is lower, and therefore the multiple you should pay is lower. If the billing system is technically bankrupt and requires a month-long rewrite, deduct the cost of engineering time from the enterprise value. Be specific. Do not say "I think the billing is messy." Say "Your MRR is overstated by $15,000 per month due to improper proration on mid-cycle upgrades, and your technical debt requires 400 hours of engineering to fix. I will reduce the offer by $X to account for this."

Additionally, consider structuring the deal with earn-outs based on corrected metrics. Instead of a static price, link a portion of the payment to the collection efficiency and net churn targets over the next three months after closing. This aligns the seller’s incentives with yours. They want the money; you want the business to work. By billing-focused earn-outs, you ensure that they help you transition the system correctly and that the revenue you promised is actually realized. Find more tailored strategies on how to structure these deals at Deal Alert AI.

Where to Find Audited SaaS Opportunities

Not all marketplaces are created equal. When you are looking for SaaS businesses, you need platforms that perform their own baseline due diligence. This reduces your risk and speeds up the transaction. Marketplaces that verify revenue claims in your favor are the best sources of quality deals. You want to avoid open marketplaces where anyone can list a business with a spreadsheet as their only proof.

Empire Flippers is a great resource for verified SaaS listings. They conduct deep due diligence on the businesses they list, which means the billing data you receive is usually pre-verified. This saves you weeks of work. You still need to do your own technical audit, but starting with a verified baseline is a significant competitive advantage for any serious buyer. They handle the initial screening, ensuring that the revenue streams are real and the legal structure is sound.

Alternatively, Flippa offers a higher volume of listings, including smaller micro-SaaS businesses. While the quality varies, the variety is unmatched. You can find niche SaaS tools that are perfect for a solo founder or a small investor. However, on Flippa, you must be more diligent. The lack of pre-verification means you need to be aggressive with your questions and more skeptical of the provided reports. Use the checklists provided in this guide to filter out the bad deals quickly.

Whether you are a first-time buyer or a serial acquirer, the principle remains the same: verify the revenue. The billing system is the heartbeat of the SaaS business. If it is weak, the body will fail. Do not be the buyer who inherited a business with a broken billing system and then spent the next eighteen months fixing it instead of growing it. Do your diligence. Audit the billing. Protect your capital. The numbers do not lie, but the systems that generate them often hide the truth.

Final Thoughts on Valuation and Operational Readiness

Buying a SaaS business is an operational exercise disguised as a financial one. The financials are just the report card; the operations are the student. In my twenty years in e-commerce and software acquisition, I have learned that the students who look the most polished are often the ones who have been the most coached. The most valuable assets are those that are self-sustaining. A SaaS business with a robust, transparent, and automated billing system is self-sustaining. It collects money automatically. It reduces churn through proactive communication. It scales without adding headcount for finance support.

When you find a deal where the billing infrastructure is clean, documented, and efficient, you should pay for that quality. It reduces your risk of fraud, reduces your operational burden, and increases your confidence in the data. Conversely, if the billing is a mess, you are effectively buying a job. You are buying a project to fix. Price the business as a project, not as a print-rip-repeating cash cow. Respect the difference. It is the difference between a good investment and a bad mistake.

Use the insights from this guide to sharpen your eye. When you join communities like Deal Alert AI, you gain access to these real-world insights from founders who have walked this road before. Do not learn by losing money. Learn by studying the deal. Audit the billing. Ask the hard questions. You will come out the other side with a business that is not just profitable on paper, but profitable in reality. That is the only kind of business worth owning.

By Sophal Lanh, Founder of Deal Alert AI: Sophal built Deal Alert AI after years of analyzing online business acquisitions and missing time-sensitive deals. The platform tracks and scores 100+ listings daily across Empire Flippers, Flippa, Acquire.com, and Quiet Light. Learn more →

Get Deals Before Other Buyers

We scan Empire Flippers, Acquire, Flippa, and Quiet Light daily. The best sub-$500K businesses are gone within 48 hours.