A due diligence report is the written output of a diligence workstream: a structured document recording what was reviewed, what was found, how serious each finding is, and what the buyer should do about it. It is addressed to one named client, and only parties named in a reliance letter can actually sue on it.
Most guidance on due diligence describes the investigation and stops there. The report is where the investigation becomes a commercial instrument: the document the investment committee approves against, the document the lender conditions its facility on, and the document a warranty insurer reads before underwriting anything.
This guide covers what goes in the report, how buy-side, vendor and red-flag versions differ, how reliance and liability caps work, how a severity rating becomes a number in the sale and purchase agreement, and how the report is circulated and archived. Circulating it is the hard part, and a data room for due diligence reporting gives each recipient its own link over one controlled copy. Section 9 covers the setup.
A due diligence report is a formal written deliverable prepared by an adviser at the end of a diligence exercise. It records what was examined, the sources used, the findings, an assessment of how serious each is, and recommendations the deal team can act on. A checklist tells you what to ask for; the report tells you what the answers mean.
The report has a legal identity as well as a commercial one. It is addressed to a specific client, usually the acquirer or an investment committee, and the adviser owes a duty of care to that addressee alone. Anyone else reads it either with permission and no right to complain, or under a reliance letter that extends the duty of care on defined terms. Section 4 covers that distinction.
Reports differ in shape by workstream but not in logic. A financial report and a legal report look nothing alike, yet both define what was and was not reviewed, list what was found with a severity assessment, and convert findings into deal actions. A report that describes findings without saying what to do about them is an information memorandum, not a diligence report.
In a competitive process the buyer receives a short red-flag report before the second-round bid, a draft full report a week or two before signing, and a final report dated at signing. Only the final version belongs in the closing file, because drafts contain findings that were later withdrawn. For the request lists behind all of this, see our M&A due diligence checklist.
The anatomy of a due diligence report is consistent across advisers, jurisdictions and workstreams, because it serves several readers at once. An investment committee wants the first four pages. The deal lawyer wants the findings register, which becomes disclosure schedules and indemnity clauses. The lender wants the scope statement and the reliance page. Each gets a different section of the same document.
That is why the executive summary is not a courtesy. It is the only section most decision-makers read in full, and a good one states the conclusion in the first paragraph: proceed, proceed with adjustments, or do not proceed. Below it sits scope and limitations, which records what was reviewed, what was excluded, the cut-off date, and any area where the seller failed to provide documents. Every unanswered request belongs here as a stated limitation rather than quietly disappearing.
Methodology and sources names the documents reviewed, the interviews held, and the version of the data room index the work was performed against. This is the section a warranty insurer reads most carefully, because it shows whether the diligence behind a given warranty was real or nominal. A tax compliance warranty means little if the tax chapter reviewed three filings and interviewed nobody.
| # | Section | What it contains | Who reads it |
|---|---|---|---|
| 1 | Executive summary | Conclusion, ranked key findings, recommended deal actions | Investment committee, board |
| 2 | Scope and limitations | What was reviewed, exclusions, cut-off date, unanswered requests | Lender, insurer, counsel |
| 3 | Methodology and sources | Documents reviewed, interviews held, data room index version | W&I underwriter, counsel |
| 4 | Workstream chapters | Detailed analysis by discipline with supporting evidence | Deal team, workstream leads |
| 5 | Findings register | Every issue with severity rating, owner, status, remedy | Deal team, SPA drafters |
| 6 | Quantified adjustments | Impact on EBITDA, net debt, working capital, capex | CFO, investment committee |
| 7 | Recommendations | Price, indemnity, condition precedent, post-close action | Deal team, legal counsel |
| 8 | Appendices | Contract summaries, schedules, data tables, source extracts | Analysts, counsel |
| 9 | Reliance and disclaimer | Addressee, permitted reliance parties, liability cap | Lender, insurer, counsel |
The findings register is the operational heart of the document. Each row carries an identifier, a description, the evidence behind it, a severity rating, an estimated financial impact where one can be sized, a remedy, and an owner. In a mid-market deal it runs to between 50 and 150 rows, and almost everything in the sale and purchase agreement that is not boilerplate traces back to a numbered row in it. The appendices behind it, often twice the length of a 180-page master report, are the evidence base the archive has to preserve.
The report and its supporting evidence live in the same room, so a finding can be traced back to the document that produced it.
Three report types dominate mid-market deals, and confusing them causes real problems. A buy-side report is commissioned by the acquirer, addressed to the acquirer, and written in the acquirer's interest. It is free to say the business is worth less than the asking price and free to recommend walking away, which is why it reaches the other side only as a redacted extract, if at all.
A vendor due diligence report is commissioned and paid for by the seller before the process launches, then distributed to bidders alongside the information memorandum. The logic is efficiency: rather than five bidders each running their own review over the same numbers, the seller pays once for a report every bidder can read, and gets an early view of problems while there is still time to fix them. These are prepared to a professional standard, but a reader should remember who chose the scope.
The reliance mechanics are the interesting part. During the process, bidders read the vendor report with no right of reliance at all. At signing, the adviser issues a reliance letter to the winning bidder, usually with a negotiated liability cap, and often to the lender at the same time. That flip is worth raising early, because an adviser unwilling to extend reliance materially reduces the value of its report to a buyer.
A red-flag report is a scope decision rather than a different genre. The adviser reports only on issues above an agreed materiality threshold and states plainly that nothing below it was examined. Buyers commission these first because they are cheaper and faster, typically 2 to 3 weeks, and because the point of a first-round review is to find a reason not to proceed. Our breakdown of due diligence cost compares those fee stages by deal size.
This is the part of the report deal teams skip and lawyers read first. A due diligence report is addressed to a named client, and under English law and most comparable systems the adviser owes a duty of care to that addressee only. If a lender, co-investor or insurer relies on it and suffers a loss because it was wrong, they have no claim unless the adviser has agreed in writing to extend that duty. The instrument that does this is a reliance letter.
A reliance letter is short and does six things. It defines precisely which report and version is covered. It restates the scope and disclaims responsibility for anything outside it. It grants the named recipient the right to rely for one stated purpose, typically financing a specific transaction. It records acknowledgements by the recipient. It imposes confidentiality. And it caps the adviser's liability at a stated amount, often a multiple of the fee or a fixed figure agreed deal by deal.
The mirror image is the non-reliance or hold-harmless letter. When the buyer wants to hand a report to a party the adviser will not take on as a client, that party signs a letter confirming the report is for information only and that no claim can be brought against the author. This is standard for warranty and indemnity insurers: the underwriter needs the financial, tax and legal reports to price the policy and set exclusions, but no adviser will accept liability to an insurer.
Lenders sit differently. On a leveraged deal the facility agreement usually lists reliance on the financial, tax and legal reports as a condition precedent to first drawdown, which makes reliance letters a closing item and a classic source of last-week delay: the lender's counsel asks for reliance on a report the adviser was never told would be shared, and the cap is negotiated from scratch on the critical path. Agreeing the reliance perimeter at engagement removes that.
Two consequences follow. The distribution list is a legal artefact, not an administrative one, and every recipient should map to a category: addressee, reliance party, or non-reliance recipient. And the record of who received which version has to survive the deal, because a reliance claim three years later turns on exactly that. Running distribution through a data room for due diligence reporting produces that record automatically.
A finding with no rating is an observation. A rated finding is a negotiating position. Most advisers use a three or four level scale, and although labels vary the logic is the same: severity depends on how confident the adviser is that the issue is real, how large the exposure could be, and whether it can be fixed before completion.
That matters because each severity band has a natural commercial remedy, and the remedy determines who carries the risk after closing. A quantified, recurring issue reduces the earnings base and so reduces price at the full multiple, which is why a €1M error in maintainable EBITDA can move a headline price by €5M or more. An unquantifiable issue cannot sensibly move price, so it goes to a specific indemnity where the seller pays only if the risk crystallises. A fixable issue becomes a condition precedent.
Reviewers get this wrong in a predictable direction: they over-rate items that are alarming but immaterial and under-rate items that are dull but structural. A pending employment claim reads as serious and is usually worth a warranty. A customer contract terminable on change of control, covering a fifth of revenue, reads as administrative and is often the most important row in the register.
| Severity | What it means | Commercial remedy in the SPA |
|---|---|---|
| Critical | Threatens the deal rationale, legality or financeability | Walk away, or restructure the transaction |
| High, quantified | Confirmed, sized, and recurring in future periods | Price reduction at the full multiple |
| High, unquantified | Confirmed but the exposure cannot be reliably sized | Specific indemnity, separately capped |
| Medium, fixable | Can be remedied by the seller before completion | Condition precedent with evidence at closing |
| Medium, residual | Ordinary course risk with no evidence of a problem | Specific warranty plus disclosure review |
| Low | No deal impact, integration or housekeeping item | Post-close action with a named owner and date |
Quantified adjustments need their own discipline. Only recurring adjustments should be capitalised into price, while net debt and working capital items move euro for euro rather than at a multiple. Classifying an item as debt-like, working capital, or an EBITDA adjustment is often the most contested paragraph in the report. Our guide to financial due diligence covers how quality of earnings produces those numbers.
On any deal above the smallest end of the market, the due diligence report is a consolidation rather than a single document. Eight workstreams produce their own reports, each written by a different adviser with a different house style, rating scale, and view of what counts as material. Turning that into one coherent document falls to the lead corporate finance adviser or the buyer's corporate development team.
Consolidation is harder than it sounds because the workstreams overlap. A revenue concentration flagged as commercial in one report appears as a change-of-control risk in the legal report and as a covenant headroom issue in the financial model. Left unreconciled, the same fact gets counted three times in the adjustment schedule, or once in an appendix nobody read. The job is to give every material fact a single owner, severity rating, and remedy.
| Workstream | Usually written by | What it feeds into the master report |
|---|---|---|
| Financial | Accounting firm transaction services team | Maintainable EBITDA, net debt, working capital |
| Tax | Tax practice of the same or another firm | Historic exposures, structuring, indemnity scope |
| Legal | Deal counsel | Title, contracts, litigation, disclosure schedules |
| Commercial | Strategy consultancy or in-house team | Market view, customer concentration, forecast credibility |
| IT | Specialist IT advisory | Run-rate cost, licensing, integration effort |
| Operational | Operations consultancy | Capacity, supply chain, synergy validation |
| ESG | Environmental and sustainability adviser | Contamination, reporting obligations, supply chain risk |
| Insurance | Broker or risk adviser | Cover gaps, claims history, standalone premium cost |
The drafting cycle is where timelines slip. Workstreams issue first drafts in week four or five, the buyer marks them up in week six, the seller answers follow-ups through the data room, and final versions are dated at signing. Two review rounds is normal and three is common when the seller is slow, and the binding constraint is document availability rather than adviser capacity. Our legal due diligence checklist sets out what has to be in the room before drafting starts.
One detail trips up first-time acquirers: drafts and finals are not interchangeable. A draft circulated to a lender or an insurer creates a version-control problem that lasts for years, because that recipient's file now holds findings which were later corrected or withdrawn. A data room for due diligence reporting makes the separation enforceable by scoping the draft folder to the deal team and opening the final folder only when the final version is dated.
A mid-market fund agrees exclusivity on Nordvik Logistik, a €140M revenue contract logistics business with 620 employees across Denmark and Norway, at an enterprise value of €81M. A red-flag review comes back in 3 weeks with nothing disqualifying, so scope expands to full review across financial, tax, legal, commercial, IT and insurance.
The master report runs to 180 pages with 240 pages of appendices, and the findings register carries 84 entries. Nine are rated high, 31 medium, and 44 low. A framework agreement with the largest customer, representing 18 percent of revenue, terminates on a change of control and has not been consented. A Norwegian VAT treatment on cross-border haulage is under-provisioned by an estimated €1.4M, with an exposure the tax adviser cannot bound precisely. And €1.3M of the €16.2M reported EBITDA turns out to be non-recurring, which at the agreed 5x multiple removes €6.5M of value.
Worked scenario. The 9 high-severity findings account for every price and indemnity change, while the 44 low-severity items become the hundred-day plan.
The remedies split along the severity lines. The EBITDA correction becomes a €6.5M price reduction. The VAT exposure becomes a specific indemnity capped at €2M and surviving seven years. The customer consent becomes a condition precedent. The 44 low-severity findings go to the integration lead as a hundred-day plan with named owners.
Distribution is the last problem. The final report goes to seven parties: the deal team, the investment committee, the fund's counsel, the lender, the lender's counsel, the warranty and indemnity underwriter, and the board. The lender receives reliance letters capped at €5M per report; the underwriter signs hold-harmless letters and gets read-only access. Nothing is emailed, and the access log becomes part of the closing file.
The distribution list is the most common failure point in the reporting process, and it fails in an unglamorous way. Someone attaches a 180-page PDF to an email so the lender's analyst can start, that analyst forwards it to a colleague, the colleague forwards it to a credit committee inbox, and within a week the buyer's confidential assessment of the target sits in a dozen mailboxes.
Different recipients also need different versions. The board sees the executive summary and the adjustment schedule, not the workstream detail. The lender sees the financial, tax and legal reports in full but has no reason to see the commercial report's view of competitive weakness. The insurer sees everything, because it is pricing the warranties. The seller, if it sees anything, sees a redacted extract limited to the findings justifying a price adjustment. Managing four scopes as four PDF attachments guarantees the wrong one eventually goes out.
One report, one room, one link per recipient, with folder scope and download rule set on the link.
Three further mistakes recur. Circulating drafts to reliance parties leaves withdrawn findings permanently in a lender's file. Failing to record who received what removes the one fact a reliance claim will turn on. And treating the report as finished at signing ignores how long it has to last: warranty and indemnity policies typically run three years for general warranties and seven for tax, so a claim in year six needs the report, the appendices, and evidence of what was disclosed.
Archiving is therefore part of reporting rather than an afterthought. What should survive is the final report, the appendix set, the data room contents as they stood at signing, the reliance and non-reliance letters, and an access log. Keeping all of it in one data room for due diligence reporting that can be frozen and exported at completion turns a seven-year retention obligation into a single archived file. Our guide to data rooms for M&A transactions covers how that fits into the wider process.
A room built for reporting is a different artefact from the seller's disclosure room. The disclosure room holds hundreds of source documents flowing from seller to buyer. The reporting room holds a handful of very high-value documents flowing outward to a legally defined list of recipients, each with a different scope, reliance status, and download entitlement. The document count is far smaller and the access control problem is harder.
That asymmetry is the case for running a data room for due diligence reporting separately: one controlled copy of each report, one link per recipient, download disabled where reliance has not been granted, and a per-recipient log that survives the transaction.
Papermark is a secure, fully customizable, and developer-friendly data room built for modern dealmakers, with page-by-page analytics, dynamic watermarking, and transparent pricing (open-source and self-hosting available).
A reporting room separates drafts from finals and workstream reports from the master report, so permissions follow the folder.
Reports still travel by email on most deals, and it is the document class where that habit carries the clearest cost. There are four reasons a dedicated data room for due diligence reporting earns its place on any deal with a lender or an insurer involved. If you are choosing a platform, our comparison of the best virtual data rooms covers pricing model, bidder management and compliance.
The recipient list is a legal construct. Everyone who receives a report is either the addressee, a reliance party under a signed letter, or a non-reliance recipient under a hold-harmless letter, and that only means something if you can prove who received what. A room where access is granted per link and logged per view produces the proof as a by-product; an email thread produces forwarded attachments and no record of where they went.
Four recipients need four different scopes. The lender needs the financial, tax and legal reports and nothing else. The warranty insurer needs all of them plus the appendices. The board needs the executive summary and the adjustment schedule. The seller, if anything, needs a redacted extract. Sending four different PDFs is how the wrong one gets sent; scoping four links over one folder tree makes that impossible.
Drafts and finals must not mix. A draft contains findings that were later withdrawn, and a copy sitting in a lender's file is a liability for the adviser and the buyer alike. Keeping drafts scoped to the deal team, and opening the final folder only once the version is dated, enforces that without relying on anyone to remember it.
The archive is the deliverable. A warranty claim in year six needs the final report, the appendices, the disclosure set as it stood at signing, and the access record: three years of retention for general warranties and seven for tax, long after the deal team has moved on.
Build three top-level folders: draft reports, final reports, and appendices with supporting evidence. Within each, one subfolder per workstream plus one for the master report. That structure is what makes differentiated access possible later, and it is why folder-scoped permissions beat picking documents one by one across seven recipients.
Upload workstream reports as they arrive rather than waiting for the full set. Automatic file indexing on the Data Rooms Plus plan maintains the index as documents land, which matters because reports arrive in waves and the index is what the lender's counsel navigates.
This is where a reporting room differs most from a disclosure room. Five recipient types typically need five views of the same reports, and the scope belongs on the link so that adding a person to the lender's team does not mean rebuilding permissions.
| Recipient | Folders granted | Rights | Download |
|---|---|---|---|
| Buyer deal team | Drafts, finals, appendices | Full access | |
| Lender | Final financial, tax and legal reports | View, watermarked | |
| W&I insurer | All final reports plus appendices | View only, watermarked | |
| Board | Executive summary and adjustment schedule | View only | |
| Seller | Redacted findings extract | View only, watermarked |
Granular file-level permissions are set per link rather than per user, so each recipient gets a link carrying its own folder scope, email allowlist or domain restriction, and download rule. Access is link-based, so nobody creates an account, which removes the friction that stops a busy credit analyst opening the room at all.
Permissions are scoped per link, so the lender and the warranty insurer see different folders of the same reporting room.
Switch the insurer and seller links to view-only and turn on dynamic watermarking, which stamps every page with the viewer's email, IP address and timestamp as it renders. On a document whose value depends on staying inside a defined recipient list, that converts an anonymous leak into an attributable one.
The honest limit is worth stating: a downloaded file is legally treated as read, and no platform can recall it. That is why download is disabled rather than discouraged for non-reliance recipients, and why the lender's copy is watermarked.
Dynamic watermarking renders recipient identity onto every page, which is what makes a leak traceable to a named viewer.
Reliance and hold-harmless letters have to be signed before a report is shared, and under time pressure that sequencing collapses. Attaching NDA agreements or a One-Click NDA to the link puts the acknowledgement in front of the recipient as they open the report, and records acceptance against the visitor rather than in a mailbox.
Follow-up questions from a credit team or an underwriter belong in the same place. The Q&A module attaches each question to the report page that prompted it, with permissions controlling who sees which threads, so the insurer never reads the lender's questions.
Page-level analytics show which recipient opened which report, when, and for how long. That is a live signal: an underwriter who has spent an hour in the tax chapter is heading toward an exclusion, and you will know days before the policy draft arrives.
Per-recipient analytics show which reports each party opened and for how long.
At completion, data room freeze makes the room immutable and exports it as an archived ZIP with a certificate. When a warranty claim surfaces in year four or a tax claim in year six, that archive is the record of the final report, the appendices, and who received which version.
Papermark is our #1 VDR provider for M&A transactions right now. In two deals we used custom branding, dynamic watermarking, and granular permissions.
Tyler
The Data Rooms plan is €99/month with a 7-day free trial and includes 3 team members, unlimited data room visitors, unlimited data rooms, unlimited documents, custom domain, dynamic watermarking, NDA agreements, and granular file-level permissions. Data Rooms Plus at €249/month adds 5 team members, the Q&A module, the audit log, automatic file indexing, and SOC 2 Type II. Premium at €549/month adds 10 team members, AI redaction, the public API, SSO, and white-labelling. Data Rooms Unlimited at €999/month removes per-seat charges entirely, so teams that add reviewers mid-deal pay one number regardless of headcount, and it carries every Premium capability including AI redaction. Because rooms are unlimited, running a reporting room alongside the disclosure room costs nothing extra, which is not true of platforms priced per project or per page.
No credit card required.
Environmental due diligence in 2026: Phase I and Phase II ESA scope, ASTM E1527-21, the 180-day rule, costs, and the data room for environmental due diligence.
Cybersecurity due diligence in 2026: the 9 control domains, the SOC 2 scope trap, inherited breach duties, and the data room for cybersecurity due diligence.
AI due diligence in 2026: the 9 domains, training-data provenance, wrapper margins, EU AI Act tiers, and how to run it in a data room for AI due diligence.
