A due diligence report is a structured document that summarizes the findings of a thorough investigation into a company’s financial health, legal standing, commercial position, and operational risks. It gives investors, buyers, or lenders the factual foundation they need to make an informed decision. The sections below answer the most common questions about what a due diligence report actually contains and how the process works in practice.
What sections are typically included in a due diligence report?
A due diligence report is typically divided into six core sections: financial, legal, tax, commercial, HR, and technical. Each section covers a distinct area of the business and is assessed independently before the findings are brought together into a consolidated view. The exact scope depends on the type of transaction and the complexity of the business being reviewed.
Here is what each section generally covers:
- Financial due diligence: Annual accounts, management reports, forecasts, cash flow, and business plans
- Legal due diligence: Incorporation documents, shareholder register, contracts, and legal liabilities
- Tax due diligence: Corporate income tax filings, VAT and payroll tax records, innovation box approvals, and any existing tax rulings
- Commercial due diligence: Key customer relationships, supplier contracts, and market position
- HR due diligence: Employment contracts, pension schemes, and personnel-related obligations
- Technical due diligence: Software documentation, patents, and intellectual property rights
A well-prepared company will have documentation for all of these categories stored in a structured virtual data room, organized by category and consistently dated. This makes the review process significantly faster and gives the other party immediate confidence that the business is in control.
What does the financial analysis section of a due diligence report include?
The financial analysis section of a due diligence report covers historical performance, current financial position, and forward-looking projections. It examines annual accounts, management reports, cash flow statements, working capital trends, debt structure, and the assumptions underlying the company’s financial forecasts. This section forms the backbone of any due diligence investigation.
In practice, the financial section answers several critical questions that any investor or buyer needs before committing:
- What does the revenue and margin trend look like over the past three to five years?
- What is the current cash position, and when does the company reach its zero moment of cash?
- How is the company financed, and what obligations are attached to existing debt?
- Are the financial forecasts realistic and supported by clear assumptions?
- What are the key financial KPIs, and how are they tracked?
The quality of this section depends heavily on how well the company has maintained its financial records. Businesses that produce accurate monthly management reports and maintain up-to-date forecasts throughout the year are far better positioned to move quickly through this stage. A CFO or finance manager who applies the “always due diligence ready” principle will have most of this information available on demand.
How are risks presented in a due diligence report?
Risks in a due diligence report are typically presented in a structured risk register or summary table, categorized by area (financial, legal, tax, commercial, HR, technical) and rated by likelihood and potential impact. Each risk is described with supporting evidence from the data room, and where possible, a recommended mitigation or follow-up action is included.
The goal is not to present risks as obstacles, but to give decision-makers a clear and honest picture of what they are taking on. A transparent risk presentation actually builds trust: it shows the reviewing party that the analysis has been thorough and that nothing is being hidden.
Risks are generally grouped into three tiers:
- Low-impact observations: Minor issues that are noted for awareness but do not affect the transaction
- Medium-impact findings: Items that require attention or adjustment, often reflected in deal terms or warranties
- High-impact risks: Significant concerns that could affect valuation, deal structure, or the decision to proceed
The clearer and more structured the risk presentation, the easier it is for both sides to negotiate a path forward.
What’s the difference between a red flag and a deal-breaker in due diligence?
A red flag is a finding that raises concern and requires further investigation or explanation, but does not automatically stop a transaction. A deal-breaker is a finding so material that it fundamentally undermines the basis of the deal, whether that is the valuation, the legal structure, or the commercial viability of the business.
The distinction matters because not every red flag becomes a deal-breaker. A red flag might be an inconsistency in financial reporting, a customer concentration risk, or a pension liability that was not fully disclosed upfront. These are serious, but they can often be addressed through adjusted deal terms, price corrections, or additional warranties.
A deal-breaker, by contrast, is typically something that cannot be resolved within the transaction itself. Common examples include undisclosed litigation with significant financial exposure, fundamental inaccuracies in the financial statements, or a regulatory compliance failure that threatens the company’s ability to operate.
Experienced reviewers distinguish between the two carefully. Labeling something a deal-breaker when it is actually a red flag can unnecessarily derail a transaction. Underestimating a genuine deal-breaker can expose the buyer or investor to serious risk after closing.
Who writes a due diligence report, and who should read it?
A due diligence report is written by the party conducting the investigation, typically a team of financial, legal, and tax advisors working on behalf of the investor, buyer, or lender. Each specialist contributes their section, and the findings are consolidated into a single report. The CFO of the company being reviewed plays a central role in supplying the information that makes the report possible.
The primary audience for the report is the decision-maker commissioning the investigation: a private equity partner, a strategic acquirer, a founder considering a merger, or a bank evaluating a refinancing request. The report gives them the factual basis to decide whether to proceed, renegotiate, or walk away.
In some cases, the report is also shared internally within the target company after the transaction, particularly when it contains recommendations about process improvements, system upgrades, or risk mitigations that need to be addressed post-closing. The findings in that scenario become an action plan rather than just an assessment.
How long does it take to produce a due diligence report?
Producing a due diligence report typically takes between two and eight weeks, depending on the size and complexity of the business, the scope of the investigation, and the quality of the documentation provided. A well-prepared company with a structured data room can significantly compress this timeline.
The biggest variable is how quickly the target company can supply accurate, organized information. When a company is not due diligence ready, meaning it still has to gather, produce, or reconstruct documents during the process, the timeline stretches considerably. This creates friction, raises questions about the company’s internal control, and can weaken the negotiating position with investors or buyers.
For start-ups and scale-ups preparing for a funding round or exit, the most effective way to shorten the due diligence timeline is to maintain a continuously updated virtual data room with all relevant financial, legal, tax, commercial, HR, and technical documentation. Organized by category, consistently dated, and kept current, this single habit can turn a six-week process into two weeks.
How Greyt supports due diligence
We approach due diligence from a CFO perspective, focused on clarity, risk reduction, and protecting value at every stage of a transaction. Whether you are preparing for a funding round, refinancing, or an acquisition, we provide hands-on expert support for transactions that goes beyond document review.
Our due diligence services cover three distinct situations:
- Finance Maturity Assessment (FMA): A structured review of your financial organization, processes, systems, and reporting, to determine whether your finance function is ready to support your growth ambitions. This is the factual baseline we recommend before any M&A or funding process begins.
- Refinancing due diligence: We assess your financial health, cash flow, and debt structure to help you enter bank negotiations from a position of strength.
- Acquisition due diligence: We conduct a thorough review of a target company’s financials, operations, and risks, surfacing hidden liabilities, testing the valuation, and confirming strategic fit before you commit.
Our team of experienced (interim) CFOs guides the entire process and delivers clear, action-oriented reports. If you want to know where you stand before a transaction, or want to make sure you are always due diligence ready, get in touch with us and we will tell you exactly what the next step looks like.
Frequently Asked Questions
How do I know if my company is actually due diligence ready before a process starts?
The clearest signal is whether you can produce accurate, organized documentation across all six due diligence categories — financial, legal, tax, commercial, HR, and technical — within 48 hours of being asked. A practical self-check is to run an internal data room audit: if you find missing contracts, outdated forecasts, or financial records that need to be reconstructed, those are gaps that will slow down a real process. A Finance Maturity Assessment (FMA) is a more structured way to get an objective baseline before any transaction begins.
What are the most common mistakes companies make when preparing their documentation for due diligence?
The most frequent mistakes are inconsistent document dating, missing board resolutions or shareholder agreements, and financial forecasts that lack clearly documented assumptions. Another common issue is uploading documents to a virtual data room without organizing them by category, which forces reviewers to search for information and creates the impression of poor internal control. Companies often underestimate how much a disorganized data room signals risk to investors and buyers — presentation quality directly influences perception of the business itself.
Can a due diligence report be used to renegotiate the deal price, and how does that typically work?
Yes, this is one of the most practical outcomes of a due diligence report. When medium- or high-impact findings surface — such as an undisclosed liability, a weaker revenue trend than initially presented, or working capital that falls below agreed targets — the buyer or investor uses those findings as the factual basis for a price adjustment, an escrow arrangement, or additional warranties in the purchase agreement. The risk register in the report essentially becomes a negotiation document, which is why clear, evidence-backed risk ratings matter so much.
What is a virtual data room, and do I really need one for due diligence?
A virtual data room (VDR) is a secure, cloud-based repository where companies store and share confidential documents with reviewers during a due diligence process. While it is technically possible to share documents through other means, a dedicated VDR is strongly recommended because it provides access controls, audit trails, and structured folder organization that protect sensitive information and keep the process efficient. For any serious M&A, funding, or refinancing transaction, most professional advisors and investors will expect documents to be provided through a VDR.
What happens if a significant risk is discovered late in the due diligence process?
A late-stage finding significantly complicates a transaction because it introduces uncertainty at a point when both parties have already invested considerable time and resources. Depending on the severity, it can trigger a deal pause, a renegotiation of terms, or in the case of a genuine deal-breaker, a withdrawal. For sellers and companies seeking investment, this is exactly why proactive preparation matters: identifying and addressing risks before the process begins — rather than during it — preserves deal momentum and negotiating leverage.
Is due diligence only relevant for large companies, or should early-stage startups prepare for it too?
Due diligence is relevant at every stage, and early-stage startups are increasingly subject to rigorous review even at seed or Series A funding rounds. Investors at these stages focus heavily on legal structure, cap table cleanliness, IP ownership, and the credibility of financial forecasts rather than years of historical accounts. Building good documentation habits early — clean contracts, organized equity records, and realistic financial models — means that when a funding round or acquisition opportunity arrives, the company is not scrambling to reconstruct its history under time pressure.
How is a due diligence report different from an audit, and can an audit replace it?
An audit verifies that a company's financial statements present a true and fair view in accordance with accounting standards — it is backward-looking and follows a defined regulatory framework. A due diligence report is forward-looking and transaction-specific: it goes beyond accounting compliance to assess commercial risks, legal exposures, operational vulnerabilities, and the quality of future earnings. An audit can be an important input into financial due diligence, but it does not replace it — investors and buyers need answers that an audit is simply not designed to provide.