Risk assessment — quality, concentration, trust.

The financial-modeling layer of this cluster produces a clean set of verified statements. The risk-assessment layer asks what could go wrong with them. Statement integrity is necessary; risk-aware verification is sufficient. Four lenses structure the work: Quality of Earnings, concentration risk, trust-account integrity, and hard-market cycle discipline. Each can independently kill a deal — and each can independently justify post-close indemnification claims if material findings emerge after close.

Independent verification both sides accept.

A Quality of Earnings report is the single highest-leverage diligence artifact in an agency deal. The mechanics: an independent accounting firm — typically a specialist in agency M&A — rebuilds the seller's normalized EBITDA from source documents. They examine the general ledger, source revenue and expense documents, and produce a defensible normalized number with explicit reconciliation to the seller's adjusted number.

The QoE serves four purposes:

• Common pricing anchor. Both buyer and seller negotiate against the QoE-defined number rather than their own competing adjustments. Disputes about specific add-backs get resolved by reference to the third-party analysis.
• Lender comfort. Senior lenders typically require a QoE for agency acquisitions above $5M revenue. The QoE-defined number is what the lender's debt-service coverage math is built against.
• Investment committee defense. The buyer's investment committee approves the deal against the QoE number, not the buyer's working model. The QoE is the buyer's independent-verification check on its own analysis.
• Indemnification reference. If material EBITDA misrepresentations surface post-close, the QoE is the baseline against which damages are computed.

QoE cost typically runs $30K–$75K depending on deal size. The buyer should pay for it (the buyer is the one needing the verification) and should select the QoE provider (the buyer's accountability for outcome lives with the buyer).

The 15% rule, the existential dozen.

Concentration risk is the second risk lens. An agency with high revenue concentration — a small number of clients accounting for a large fraction of revenue — is fundamentally more fragile than an agency with a diversified book at the same EBITDA. The buyer who pays the same multiple for both has overpaid for the concentrated book.

Three concentration metrics matter:

Concentration risk is most usefully addressed through earnout structures that protect the buyer if concentrated accounts depart in the post-close window. A 10% earnout against retention of the top-12 accounts converts the concentration risk into a structural buyer protection without converting the entire deal into a contested earnout.

The highest-stakes single audit.

The premium trust account is the agency's regulatory third rail. Agencies hold premium funds on behalf of carriers between client payment and carrier remittance. Mishandling — commingling with operating funds, late carrier remittance, premium fronting — creates regulatory exposure that can dwarf the purchase price. The buyer's audit is non-negotiable on every agency deal.

The audit examines:

• Trust account separation. Trust funds in distinct, separately-identified bank accounts with no commingling. State regulations specify the structural requirements; the audit verifies compliance.
• Reconciliation history. Trust account ledger reconciled against carrier statements for at least 24 trailing months. Discrepancies are the highest-priority red flags.
• Carrier remittance timing. Premium remittance to carriers within carrier-contracted windows (typically 25–45 days). Late remittance creates carrier-relationship exposure and sometimes regulatory exposure.
• Premium fronting practices. The agency advancing premium to carriers ahead of client collection. Common but not best practice; creates working-capital exposure and sometimes regulatory exposure depending on state.

Material findings in the trust audit warrant deal restructuring — at minimum, escrow holdbacks to cover potential regulatory remediation; in serious cases, deal abandonment. The trust audit is the single most undervalued diligence workstream by first-time buyers.

Cycle-adjusted multiples, not face-value multiples.

The fourth lens addresses pricing-cycle distortion. Insurance pricing cycles between hard markets (rates rising; carriers selective; commissions inflate) and soft markets (rates falling; carriers competitive; commissions deflate). Agencies measured during hard markets show inflated revenue, EBITDA, and growth rates that may not persist through the next cycle.

Hard-market EBITDA is real cash flow today. Hard-market revenue growth is partially mirage. The buyer's job is to price the through-cycle reality, not the peak-cycle snapshot.

Three discipline points:

• Decompose revenue growth. Top-line growth during a hard market is the sum of rate (hard-market-driven), retention (often improved in hard markets as switching becomes harder), and new business (often slowed in hard markets as everyone is already with someone). The components don't all persist into the next cycle.
• Discount peak-cycle EBITDA. Apply a cycle-adjustment haircut to peak-cycle EBITDA — typically 10–25% — when projecting forward. The deal economics should survive the soft-market scenario, not just the hard-market continuation.
• Carrier contingency exposure. Contingencies are loss-ratio sensitive. Hard-market loss ratios may flatter contingency payments; soft-market loss ratios may compress them. Model contingencies separately with cycle adjustment.

The four risk lenses — QoE, concentration, trust, hard-market — together complete the buyer's financial-DD verification. Combined with the statement-construction work in the financial-modeling cluster, they produce a model the buyer can underwrite. The Pillar — Financial Due Diligence for Buyers — covers the full framework.