Red flag report in due diligence: how to write one an IC can act on

A red flag report in due diligence is a short report on a target company that lists only the issues the buyer's review found to matter for the deal: those that should change the price, the protections written into the share purchase agreement, the conditions to closing, or the plan for the first 100 days. A full due diligence report describes the business; a red flag report tells the investment committee what to do about it. It is hard to write well because each outside adviser produces its own, findings arrive in different currencies and languages, and the issues that move the price sit between workstreams. Botminds' Virtual Data Room Due Diligence drafts the report from the deal lead's decisions on each flag, with every line cited to its page and a statement of how much of the data room was read.

Take a fictional sample deal through it: Quillfield Private Equity Fund V buying Skarvik Logistik AB, a Swedish contract-logistics company with SEK 4,520 million ($429 million) of revenue and SEK 680 million ($64.6 million) of adjusted EBITDA, at an indicative enterprise value of $708 million. The deal, the people and every figure about them are sample data, not a customer result.

What is a red flag report in due diligence?

A red flag report is the decision document of diligence: a list of findings serious enough to act on, written for the people who approve the deal. The term is practitioners' shorthand rather than a defined legal one, and a Delaware court record shows how it is used in a real acquisition. In Fresenius Kabi's 2017 purchase of Akorn, the buyer's team "kept track of “red flag DD findings”", the trial record included a "Red Flag Tax Due Diligence Report", and after "just over two weeks" in the data room a presentation already identified a "preliminary red flag DD finding" under the heading of sales and marketing: "Risk to achieve forecasts due to stronger competition, especially for Ephedrine, Lidocaine ointment, clobetasol, Fluticasone" (Akorn v. Fresenius Kabi, Del. Ch., 1 October 2018).

Three things in that record are worth copying. The findings were tracked from the second week, not saved for the end. They were split by workstream, with tax producing its own red-flag report. And the preliminary finding named its products, which is what makes a flag testable. What it did not carry, as far as the opinion shows, was a size; the sections below are about adding one.

Red flag report vs full due diligence report: which does the committee need?

The committee needs the red flag report to decide, and the advisers' full reports stand behind it as evidence. A full report describes everything the adviser reviewed, finding or not; a red flag report leaves out what is in order and spends its pages on what is not. Its flags then feed the risks section of the committee's own paper, the part an investment committee memo template ties to its sources.

What goes in a red flag due diligence report?

A red flag due diligence report has seven parts: a summary, price items, purchase agreement protections, closing conditions, 100-day plan items, flags still with the seller, and a coverage statement. The four middle sections are the four things a buyer can do with a finding before signing: pay less, get protected, make it a condition, or fix it after closing. A finding that fits none of them is not a red flag; it is a note.

The summary is written last and is short: in the sample, one paragraph naming the four issues that move the price, each with its citation. The section on flags still with the seller is the honest part of the report. It lists what the buyer has asked and not been told, so a committee member can see that a clean section 3 does not mean the agreement is clean, only that its open questions are elsewhere.

Does it change the price, the protection or the conditions? The one test for a flag

A finding belongs in the red flag report if it changes what the buyer pays, what the agreement protects, what must happen before closing, or what must be done after it; otherwise it goes to a register. The line needs a number. In the sample firm's playbook, materiality is "$1M or 1% of EBITDA", and flags below it are logged as medium rather than reported. On a target with $64.6 million of adjusted EBITDA, 1% is about $0.65 million (our arithmetic).

The four outcomes are not interchangeable, and the reason is how purchase agreements allocate risk. The Court of Chancery put it directly in Akorn: "The identification of issues in due diligence thus does not simply lead to a binary go/no-go decision on the acquisition; it also affects how the parties use representations in the transaction agreement to allocate responsibility for those issues." A finding sized before signing can be priced or protected; the same finding discovered after signing has to fit a representation that may not have been drafted for it. Research on public acquirers points the same way: Wangerin describes due diligence as the last point at which a buyer can still renegotiate or pull out (Contemporary Accounting Research, 2019).

How to size a flag: from one clause to a number the committee can use

Size a flag by finding the second document that turns the finding into money, then stating the treatment in the same unit the committee prices in. On the sample deal, the legal reading found that clause 18.3 of the Nordhavn Retail Group agreement lets the customer terminate on 90 days' notice within six months of a change of control. The financial reading found that Nordhavn is SEK 1,040 million of SEK 4,520 million FY2025 revenue, 23.0%, with an EBITDA contribution of SEK 152 million ($14.4 million). The suggested treatment, a $42 million holdback until Nordhavn waives the clause in writing, is about 2.9 times that EBITDA contribution, with a waiver as a condition to signing as the alternative.

A rejected flag stays on file with its reason, which is the line that protects the deal lead later. When the committee asks why a known issue did not move the price, "already in the investment case", with the date and the person, is an answer; silence is not. The clause-level mechanics of the largest flag are worked through in the change of control clause and the revenue behind it.

Deciding a flag: the reason code and the treatment go into the report

Who writes the red flag report, and who signs it?

Each adviser writes the red flag findings for its own scope; the deal team writes the report the committee reads, and the deal lead signs it. That division matters because the advisers' reports, merged by hand, are where findings get lost or double-counted: two advisers can flag the same customer contract from different angles, and neither sees the other's number.

In the sample the merge is done from decisions rather than from documents. The agents raise flags; the deal lead decides each one; the Report agent assembles only decided flags into their sections; the associate reviews; the deal lead signs; legal counsel co-signs after him.

The limits on the agents are the design, not a disclaimer. An agent that could include an undecided flag would let a report reach the committee carrying a judgement nobody made; one that could sign would remove the person the committee holds to account. How those limits are set for each agent, and what the research says about contract-reading accuracy, is the subject of legal due diligence AI and its limits.

What a red flag report must admit: what was not read, and what is still open

A red flag report should state what it does not cover, because a committee reads a short list of flags as a clean bill of health on everything else. The sample report ends with a coverage statement, "5,418 of 5,418 documents read or explained", and lists each unread file with its reason. Its section on flags with the seller lists the questions not yet answered.

The Akorn record shows the cost of a report that is silent on a risk. The court found that the final presentation to Fresenius's supervisory board "did not identify risks related to data integrity", the issue at the centre of the later dispute. Nothing in a report can surface a risk the reviewers could not see; but a report that says where the review stopped tells the committee where to ask. Measuring that, folder by folder, is the subject of proving how much of the data room was read.

The red-flag report with its sections, versions and sign-off

How long is a red flag report, and how often should it be reissued?

A red flag report is as long as its decided flags require; there is no standard length, and padding it with in-order findings defeats its purpose. The sample report has seven sections and 33 decided flags in version three. What matters more than length is cadence. A report issued once, at the end, gives the committee one look; a report reissued as decisions are made lets it see the picture form.

The sample report has three versions in five days: the first on 14 October at 08:10, 46 hours after access, with the first full read; the second on 16 October with 24 decisions; the third on 19 October with 33. Each is kept. The record-keeping rules give the reason. In the EU, a manager investing in illiquid assets after a negotiation must keep records of that diligence work for five years or more (Delegated Regulation 231/2013, Article 19(2)), and a US registered adviser keeps written communications about advice, given or proposed, for at least five years too (17 CFR 275.204-2). The earlier versions show what the committee knew and when.

A checklist before the report goes to the committee

Before the report is signed, the deal lead should be able to answer eight questions about it without opening another document. Each is a test of whether the committee can act on the report as written.

A report that passes these tests can go to the committee with its open flags visible and its numbers traceable. To see the sample report built from decisions, open Virtual Data Room Due Diligence.

Questions people ask

What should a red flag report due diligence template include?

A summary, then one section for each thing a buyer can do with a finding: price items, purchase agreement protections, closing conditions and 100-day plan items. Add a section for questions still with the seller and a coverage statement. Each line should carry the finding, its size, its treatment, its source page and who decided it.

What is a red flag tax due diligence report?

It is the tax adviser's list of tax exposures serious enough to act on: open audits, assessments not disclosed, transfer-pricing positions and similar. The Akorn trial record cites one by that name. In the sample deal, an undisclosed PLN 14.2 million Polish transfer-pricing assessment and an open Swedish tax audit with SEK 9 million of costs challenged are the kind of items it holds.

What counts as a red flag in due diligence?

An issue above the buyer's materiality line that should change the price, the agreement, the conditions or the post-closing plan. Typical examples are a customer that can terminate on a change of control, add-backs that recur, an undisclosed tax assessment, unprovisioned remediation and a regulator's inquiry. The sample firm sets its line at $1 million or 1% of EBITDA.

Is a sell-side red flag report the same as a buyer's?

No. A seller commissions a vendor red flag report to find and fix issues before buyers see them, and its scope is the seller's choice. A buyer's report is written to price and protect the buyer, and the purchase agreement usually limits what the buyer may rely on to the agreement itself. The difference is set out in buy-side due diligence.

Who reads the red flag report?

The investment committee decides on it, and the people negotiating the purchase agreement use it to draft price adjustments, protections and conditions. Compliance may later need it to show what the firm knew before signing. That is why every line should be traceable to its page and its decision.