A red flag report is the short version of diligence. Instead of describing everything in the data room, it lists only what could change the price, the structure or the decision to proceed, and says what to check next. Financial, legal and commercial advisers all produce them, usually early, so a deal team can decide where to spend the rest of the budget. The format matters more than it looks: a red flag report that can't be checked quickly gets either ignored or over-trusted.
Red flag report vs full diligence report
| Red flag report | Full diligence report | |
|---|---|---|
| Question it answers | What could stop or reprice this deal? | What is true about this business? |
| Coverage | Exceptions only | Everything in scope |
| Timing | Early, often on a partial data room | Before signing |
| Reader | Deal lead deciding where to dig | Committee, lenders, insurers |
| Length | Pages | Volumes |
The two get confused in one dangerous direction: a red flag report with nothing in it is read as a clean bill of health. It isn't. It is a statement that nothing surfaced in the documents reviewed, at the depth reviewed.
The five parts every finding needs
- The claim, in one sentence. "The largest customer can terminate on a change of control." Not "customer concentration concerns".
- The evidence: a quote and a location. The exact sentence, the document and the section. A finding without a quote forces the reader to redo the work, and a finding whose quote isn't in the source shouldn't be in the report at all.
- Severity, with the reason. Why it matters for this deal: share of revenue, size against the purchase price, whether it can stop closing.
- Whether it has happened. A lawsuit that has been filed is not the same as a risk factor saying lawsuits could be filed. Reports that blur the two turn boilerplate into alarm.
- The next step. The question for the seller, the document to request, or the specialist to involve.
How to rank findings
Most red flag reports rank by severity alone. Two other dimensions decide what a deal team should actually do first:
- Is it a deal-blocker category? Some areas can stop a transaction outright: sanctions exposure, a regulatory approval that can't be obtained, an unfixable title defect in key IP. A medium-severity finding in one of those deserves attention before a high-severity finding that only affects price.
- How strong is the evidence? A finding quoted directly from a signed contract outranks one inferred from a management presentation. Say which is which.
Silence is a finding too
The most common gap in red flag reports is what they don't mention. If the data room contains nothing about anti-bribery controls, the report should say "not addressed: request from seller", not stay quiet. A reader can't distinguish "checked and clean" from "never looked" unless the report tells them.
The section most reports skip: limitations
Every red flag report should end with what it did not do:
- which documents were reviewed, and which were missing or unreadable;
- whether anything was independently verified, or only read;
- the date of the data room it reflects, because data rooms keep filling;
- any document that was too long to review in full.
A worked example: how our screening report is laid out
Anweshna produces an AI-generated version of this, titled a Risk Assessment Report rather than a due diligence report, because it screens documents and doesn't verify them. It is laid out to follow the structure above:
| Section | What it does |
|---|---|
| Executive summary | The headline, led by what the evidence supports rather than a score |
| Verified Risk Register (summary) | How many findings were traced to the source text, and at what level of support |
| Risk category breakdown | Scores and findings across 15 M&A categories; a banner at the top when a deal-blocking category trips |
| Verification plan | Ranked follow-up tasks, with identical tasks merged |
| Recommended next steps and limitations | What to do, and what the scan did not cover |
| Appendix: register detail | Every finding, row by row, with its evidence status |
Three of its rules map directly onto the parts above. Every finding is checked against the source text, and one that can't be traced is marked unverified. A deal-blocking category with no findings at all is reported as a diligence gap rather than as clean. And the report says, in the body rather than an appendix, when its verification step didn't run, because an empty register is never a clean one.
Common mistakes
- Listing everything. A red flag report with 200 items is a full report without the structure.
- Paraphrasing without quoting. It saves the author time and costs every reader more.
- Counting boilerplate. Standard risk-factor language describes what could happen. On its own, it isn't a red flag.
- No date. A red flag report on last week's data room may already be out of date.
Who writes it, and when
Red flag reports are usually written by the advisers who will later do the full work: accountants for financial red flags, counsel for legal ones, consultants for commercial ones. They are typically delivered within the first weeks of access, often on an incomplete data room, and often in more than one round as documents arrive. That timing is why the limitations section matters: the second round should say clearly what has changed since the first, and which earlier findings were confirmed, withdrawn or still open.
Bottom line
A good red flag report is short, quoted, ranked by what can actually stop the deal, honest about silence, and explicit about its limits. For the flags themselves, see our guide to M&A due diligence red flags. For where a screening pass fits in the process, see Confirmatory vs Exploratory Due Diligence.
Sources
This page describes common practice and our own report format; it makes no external statistical claim. We cite only sources we have retrieved and read; see our methodology. Nothing here is legal advice.