---
title: "Due Diligence Report in 2026: 9 Sections and the Reliance Letter Trap"
lang: en
canonical_url: https://www.papermark.com/blog/due-diligence-report
last_updated: 2026-10-13
published: 2026-10-13
category: [mergers-and-acquisitions]
author: "Marc Seitz"
summary: "What a due diligence report contains, who may rely on it, how severity ratings become price adjustments, and how to run a data room for due diligence reporting."
---

# Due Diligence Report in 2026: 9 Sections and the Reliance Letter Trap

A due diligence report is the written output of a diligence workstream: a structured document recording what was reviewed, what was found, how serious each finding is, and what the buyer should do about it. It is addressed to one named client, and only parties named in a reliance letter can actually sue on it.

## Quick recap

- A due diligence report follows a standard anatomy: executive summary, scope and limitations, methodology, workstream chapters, findings register, quantified adjustments, recommendations, and appendices.
- Buy-side reports are commissioned by the acquirer, vendor reports by the seller for issue to bidders, and red-flag reports cover only issues above a materiality threshold.
- Buyers commission a red-flag report first because it typically lands in 2 to 3 weeks, before full-scope fees are committed.
- Only the addressee and parties named in a reliance letter can bring a claim; everyone else reads the report under a non-reliance or hold-harmless letter.
- Reliance letters cap the adviser's liability, and lenders require reliance on the financial, tax and legal reports as a condition precedent to drawdown.
- Warranty and indemnity insurers read the full reports during underwriting but always on a non-reliance basis, so the hold-harmless letter is signed before anything is sent.
- Every finding carries a severity rating that maps to one of four remedies: price adjustment, specific indemnity, condition precedent, or post-close action.
- A master report consolidates 8 workstream reports: financial, tax, legal, commercial, IT, operational, ESG, and insurance.
- A data room for due diligence reporting holds one controlled copy of each report and gives every recipient a scoped link, which is how a 180-page report reaches a lender and an insurer without a PDF leaving the room.
- Papermark hosts a data room for due diligence reporting with granular file-level permissions, dynamic watermarking, and per-recipient analytics from €99/month.

Most guidance on due diligence describes the investigation and stops there. The report is where the investigation becomes a commercial instrument: the document the investment committee approves against, the document the lender conditions its facility on, and the document a warranty insurer reads before underwriting anything.

This guide covers what goes in the report, how buy-side, vendor and red-flag versions differ, how reliance and liability caps work, how a severity rating becomes a number in the sale and purchase agreement, and how the report is circulated and archived. Circulating it is the hard part, and a **data room for due diligence reporting** gives each recipient its own link over one controlled copy. Section 9 covers the setup.

## 1. What is a due diligence report?

A due diligence report is a formal written deliverable prepared by an adviser at the end of a diligence exercise. It records what was examined, the sources used, the findings, an assessment of how serious each is, and recommendations the deal team can act on. A checklist tells you what to ask for; the report tells you what the answers mean.

The report has a legal identity as well as a commercial one. It is addressed to a specific client, usually the acquirer or an investment committee, and the adviser owes a duty of care to that addressee alone. Anyone else reads it either with permission and no right to complain, or under a reliance letter that extends the duty of care on defined terms. Section 4 covers that distinction.

Reports differ in shape by workstream but not in logic. A financial report and a legal report look nothing alike, yet both define what was and was not reviewed, list what was found with a severity assessment, and convert findings into deal actions. A report that describes findings without saying what to do about them is an information memorandum, not a diligence report.

In a competitive process the buyer receives a short red-flag report before the second-round bid, a draft full report a week or two before signing, and a final report dated at signing. Only the final version belongs in the closing file, because drafts contain findings that were later withdrawn. For the request lists behind all of this, see our [M&A due diligence checklist](/blog/m-and-a-due-diligence-checklist.md).

## 2. What goes into a due diligence report

The anatomy of a due diligence report is consistent across advisers, jurisdictions and workstreams, because it serves several readers at once. An investment committee wants the first four pages. The deal lawyer wants the findings register, which becomes disclosure schedules and indemnity clauses. The lender wants the scope statement and the reliance page. Each gets a different section of the same document.

That is why the executive summary is not a courtesy. It is the only section most decision-makers read in full, and a good one states the conclusion in the first paragraph: proceed, proceed with adjustments, or do not proceed. Below it sits scope and limitations, which records what was reviewed, what was excluded, the cut-off date, and any area where the seller failed to provide documents. Every unanswered request belongs here as a stated limitation rather than quietly disappearing.

Methodology and sources names the documents reviewed, the interviews held, and the version of the data room index the work was performed against. This is the section a warranty insurer reads most carefully, because it shows whether the diligence behind a given warranty was real or nominal. A tax compliance warranty means little if the tax chapter reviewed three filings and interviewed nobody.

| # | Section | What it contains | Who reads it |
| --- | --- | --- | --- |
| 1 | Executive summary | Conclusion, ranked key findings, recommended deal actions | Investment committee, board |
| 2 | Scope and limitations | What was reviewed, exclusions, cut-off date, unanswered requests | Lender, insurer, counsel |
| 3 | Methodology and sources | Documents reviewed, interviews held, data room index version | W&I underwriter, counsel |
| 4 | Workstream chapters | Detailed analysis by discipline with supporting evidence | Deal team, workstream leads |
| 5 | Findings register | Every issue with severity rating, owner, status, remedy | Deal team, SPA drafters |
| 6 | Quantified adjustments | Impact on EBITDA, net debt, working capital, capex | CFO, investment committee |
| 7 | Recommendations | Price, indemnity, condition precedent, post-close action | Deal team, legal counsel |
| 8 | Appendices | Contract summaries, schedules, data tables, source extracts | Analysts, counsel |
| 9 | Reliance and disclaimer | Addressee, permitted reliance parties, liability cap | Lender, insurer, counsel |

The findings register is the operational heart of the document. Each row carries an identifier, a description, the evidence behind it, a severity rating, an estimated financial impact where one can be sized, a remedy, and an owner. In a mid-market deal it runs to between 50 and 150 rows, and almost everything in the sale and purchase agreement that is not boilerplate traces back to a numbered row in it. The appendices behind it, often twice the length of a 180-page master report, are the evidence base the archive has to preserve.

![Due diligence report and workstream documents organised in a Papermark data room](https://assets.papermark.io/upload/file_FqMQsQjpZ6iDcnKoGU4gQ6-investment-banking-data-room-documents.png)

_The report and its supporting evidence live in the same room, so a finding can be traced back to the document that produced it._

## 3. Buy-side, vendor, and red-flag reports

Three report types dominate mid-market deals, and confusing them causes real problems. A buy-side report is commissioned by the acquirer, addressed to the acquirer, and written in the acquirer's interest. It is free to say the business is worth less than the asking price and free to recommend walking away, which is why it reaches the other side only as a redacted extract, if at all.

A vendor due diligence report is commissioned and paid for by the seller before the process launches, then distributed to bidders alongside the information memorandum. The logic is efficiency: rather than five bidders each running their own review over the same numbers, the seller pays once for a report every bidder can read, and gets an early view of problems while there is still time to fix them. These are prepared to a professional standard, but a reader should remember who chose the scope.

The reliance mechanics are the interesting part. During the process, bidders read the vendor report with no right of reliance at all. At signing, the adviser issues a reliance letter to the winning bidder, usually with a negotiated liability cap, and often to the lender at the same time. That flip is worth raising early, because an adviser unwilling to extend reliance materially reduces the value of its report to a buyer.

A red-flag report is a scope decision rather than a different genre. The adviser reports only on issues above an agreed materiality threshold and states plainly that nothing below it was examined. Buyers commission these first because they are cheaper and faster, typically 2 to 3 weeks, and because the point of a first-round review is to find a reason not to proceed. Our breakdown of [due diligence cost](/blog/due-diligence-cost.md) compares those fee stages by deal size.

## 4. Reliance letters, non-reliance, and capped liability

This is the part of the report deal teams skip and lawyers read first. A due diligence report is addressed to a named client, and under English law and most comparable systems the adviser owes a duty of care to that addressee only. If a lender, co-investor or insurer relies on it and suffers a loss because it was wrong, they have no claim unless the adviser has agreed in writing to extend that duty. The instrument that does this is a reliance letter.

A reliance letter is short and does six things. It defines precisely which report and version is covered. It restates the scope and disclaims responsibility for anything outside it. It grants the named recipient the right to rely for one stated purpose, typically financing a specific transaction. It records acknowledgements by the recipient. It imposes confidentiality. And it caps the adviser's liability at a stated amount, often a multiple of the fee or a fixed figure agreed deal by deal.

The mirror image is the non-reliance or hold-harmless letter. When the buyer wants to hand a report to a party the adviser will not take on as a client, that party signs a letter confirming the report is for information only and that no claim can be brought against the author. This is standard for warranty and indemnity insurers: the underwriter needs the financial, tax and legal reports to price the policy and set exclusions, but no adviser will accept liability to an insurer.

Lenders sit differently. On a leveraged deal the facility agreement usually lists reliance on the financial, tax and legal reports as a condition precedent to first drawdown, which makes reliance letters a closing item and a classic source of last-week delay: the lender's counsel asks for reliance on a report the adviser was never told would be shared, and the cap is negotiated from scratch on the critical path. Agreeing the reliance perimeter at engagement removes that.

Two consequences follow. The distribution list is a legal artefact, not an administrative one, and every recipient should map to a category: addressee, reliance party, or non-reliance recipient. And the record of who received which version has to survive the deal, because a reliance claim three years later turns on exactly that. Running distribution through a **data room for due diligence reporting** produces that record automatically.

## 5. Severity ratings and how a finding becomes a number

A finding with no rating is an observation. A rated finding is a negotiating position. Most advisers use a three or four level scale, and although labels vary the logic is the same: severity depends on how confident the adviser is that the issue is real, how large the exposure could be, and whether it can be fixed before completion.

That matters because each severity band has a natural commercial remedy, and the remedy determines who carries the risk after closing. A quantified, recurring issue reduces the earnings base and so reduces price at the full multiple, which is why a €1M error in maintainable EBITDA can move a headline price by €5M or more. An unquantifiable issue cannot sensibly move price, so it goes to a specific indemnity where the seller pays only if the risk crystallises. A fixable issue becomes a condition precedent.

Reviewers get this wrong in a predictable direction: they over-rate items that are alarming but immaterial and under-rate items that are dull but structural. A pending employment claim reads as serious and is usually worth a warranty. A customer contract terminable on change of control, covering a fifth of revenue, reads as administrative and is often the most important row in the register.

| Severity | What it means | Commercial remedy in the SPA |
| --- | --- | --- |
| Critical | Threatens the deal rationale, legality or financeability | Walk away, or restructure the transaction |
| High, quantified | Confirmed, sized, and recurring in future periods | Price reduction at the full multiple |
| High, unquantified | Confirmed but the exposure cannot be reliably sized | Specific indemnity, separately capped |
| Medium, fixable | Can be remedied by the seller before completion | Condition precedent with evidence at closing |
| Medium, residual | Ordinary course risk with no evidence of a problem | Specific warranty plus disclosure review |
| Low | No deal impact, integration or housekeeping item | Post-close action with a named owner and date |

Quantified adjustments need their own discipline. Only recurring adjustments should be capitalised into price, while net debt and working capital items move euro for euro rather than at a multiple. Classifying an item as debt-like, working capital, or an EBITDA adjustment is often the most contested paragraph in the report. Our guide to [financial due diligence](/blog/financial-due-diligence.md) covers how quality of earnings produces those numbers.

## 6. The workstream reports behind the master report

On any deal above the smallest end of the market, the due diligence report is a consolidation rather than a single document. Eight workstreams produce their own reports, each written by a different adviser with a different house style, rating scale, and view of what counts as material. Turning that into one coherent document falls to the lead corporate finance adviser or the buyer's corporate development team.

Consolidation is harder than it sounds because the workstreams overlap. A revenue concentration flagged as commercial in one report appears as a change-of-control risk in the legal report and as a covenant headroom issue in the financial model. Left unreconciled, the same fact gets counted three times in the adjustment schedule, or once in an appendix nobody read. The job is to give every material fact a single owner, severity rating, and remedy.

| Workstream | Usually written by | What it feeds into the master report |
| --- | --- | --- |
| Financial | Accounting firm transaction services team | Maintainable EBITDA, net debt, working capital |
| Tax | Tax practice of the same or another firm | Historic exposures, structuring, indemnity scope |
| Legal | Deal counsel | Title, contracts, litigation, disclosure schedules |
| Commercial | Strategy consultancy or in-house team | Market view, customer concentration, forecast credibility |
| IT | Specialist IT advisory | Run-rate cost, licensing, integration effort |
| Operational | Operations consultancy | Capacity, supply chain, synergy validation |
| ESG | Environmental and sustainability adviser | Contamination, reporting obligations, supply chain risk |
| Insurance | Broker or risk adviser | Cover gaps, claims history, standalone premium cost |

The drafting cycle is where timelines slip. Workstreams issue first drafts in week four or five, the buyer marks them up in week six, the seller answers follow-ups through the data room, and final versions are dated at signing. Two review rounds is normal and three is common when the seller is slow, and the binding constraint is document availability rather than adviser capacity. Our [legal due diligence checklist](/blog/legal-due-diligence-checklist.md) sets out what has to be in the room before drafting starts.

One detail trips up first-time acquirers: drafts and finals are not interchangeable. A draft circulated to a lender or an insurer creates a version-control problem that lasts for years, because that recipient's file now holds findings which were later corrected or withdrawn. A **data room for due diligence reporting** makes the separation enforceable by scoping the draft folder to the deal team and opening the final folder only when the final version is dated.

## 7. Worked scenario: the report on Nordvik Logistik

A mid-market fund agrees exclusivity on Nordvik Logistik, a €140M revenue contract logistics business with 620 employees across Denmark and Norway, at an enterprise value of €81M. A red-flag review comes back in 3 weeks with nothing disqualifying, so scope expands to full review across financial, tax, legal, commercial, IT and insurance.

The master report runs to 180 pages with 240 pages of appendices, and the findings register carries 84 entries. Nine are rated high, 31 medium, and 44 low. A framework agreement with the largest customer, representing 18 percent of revenue, terminates on a change of control and has not been consented. A Norwegian VAT treatment on cross-border haulage is under-provisioned by an estimated €1.4M, with an exposure the tax adviser cannot bound precisely. And €1.3M of the €16.2M reported EBITDA turns out to be non-recurring, which at the agreed 5x multiple removes €6.5M of value.

The remedies split along the severity lines. The EBITDA correction becomes a €6.5M price reduction. The VAT exposure becomes a specific indemnity capped at €2M and surviving seven years. The customer consent becomes a condition precedent. The 44 low-severity findings go to the integration lead as a hundred-day plan with named owners.

Distribution is the last problem. The final report goes to seven parties: the deal team, the investment committee, the fund's counsel, the lender, the lender's counsel, the warranty and indemnity underwriter, and the board. The lender receives reliance letters capped at €5M per report; the underwriter signs hold-harmless letters and gets read-only access. Nothing is emailed, and the access log becomes part of the closing file.

## 8. Who receives which version, and where reports leak

The distribution list is the most common failure point in the reporting process, and it fails in an unglamorous way. Someone attaches a 180-page PDF to an email so the lender's analyst can start, that analyst forwards it to a colleague, the colleague forwards it to a credit committee inbox, and within a week the buyer's confidential assessment of the target sits in a dozen mailboxes.

Different recipients also need different versions. The board sees the executive summary and the adjustment schedule, not the workstream detail. The lender sees the financial, tax and legal reports in full but has no reason to see the commercial report's view of competitive weakness. The insurer sees everything, because it is pricing the warranties. The seller, if it sees anything, sees a redacted extract limited to the findings justifying a price adjustment. Managing four scopes as four PDF attachments guarantees the wrong one eventually goes out.

![Per-recipient link permissions controlling access to a due diligence report](https://assets.papermark.io/upload/file_2Ne6hZvpaoh2CwpxRxfThZ-papermark-link-permissions.png)

_One report, one room, one link per recipient, with folder scope and download rule set on the link._

Three further mistakes recur. Circulating drafts to reliance parties leaves withdrawn findings permanently in a lender's file. Failing to record who received what removes the one fact a reliance claim will turn on. And treating the report as finished at signing ignores how long it has to last: warranty and indemnity policies typically run three years for general warranties and seven for tax, so a claim in year six needs the report, the appendices, and evidence of what was disclosed.

Archiving is therefore part of reporting rather than an afterthought. What should survive is the final report, the appendix set, the data room contents as they stood at signing, the reliance and non-reliance letters, and an access log. Keeping all of it in one **data room for due diligence reporting** that can be frozen and exported at completion turns a seven-year retention obligation into a single archived file. Our guide to [data rooms for M&A transactions](/blog/virtual-data-room-for-mergers-and-acquisitions.md) covers how that fits into the wider process.

## 9. Data room for your due diligence reporting

A room built for reporting is a different artefact from the seller's disclosure room. The disclosure room holds hundreds of source documents flowing from seller to buyer. The reporting room holds a handful of very high-value documents flowing outward to a legally defined list of recipients, each with a different scope, reliance status, and download entitlement. The document count is far smaller and the access control problem is harder.

That asymmetry is the case for running a **data room for due diligence reporting** separately: one controlled copy of each report, one link per recipient, download disabled where reliance has not been granted, and a per-recipient log that survives the transaction.

[Papermark](/data-room.md) is a secure, fully customizable, and developer-friendly data room built for modern dealmakers, with page-by-page analytics, dynamic watermarking, and transparent pricing (open-source and self-hosting available).

![Papermark data room holding due diligence reports with folders by workstream and version](https://img.papermarkassets.com/upload/file_35DtVER7SdS1G6unRE8unv-papermark-data-room.png)

_A reporting room separates drafts from finals and workstream reports from the master report, so permissions follow the folder._

### Why you need a data room for due diligence reporting

Reports still travel by email on most deals, and it is the document class where that habit carries the clearest cost. There are four reasons a dedicated data room for due diligence reporting earns its place on any deal with a lender or an insurer involved. If you are choosing a platform, our comparison of the [best virtual data rooms](/blog/best-virtual-data-rooms.md) covers pricing model, bidder management and compliance.

**The recipient list is a legal construct.** Everyone who receives a report is either the addressee, a reliance party under a signed letter, or a non-reliance recipient under a hold-harmless letter, and that only means something if you can prove who received what. A room where access is granted per link and logged per view produces the proof as a by-product; an email thread produces forwarded attachments and no record of where they went.

**Four recipients need four different scopes.** The lender needs the financial, tax and legal reports and nothing else. The warranty insurer needs all of them plus the appendices. The board needs the executive summary and the adjustment schedule. The seller, if anything, needs a redacted extract. Sending four different PDFs is how the wrong one gets sent; scoping four links over one folder tree makes that impossible.

**Drafts and finals must not mix.** A draft contains findings that were later withdrawn, and a copy sitting in a lender's file is a liability for the adviser and the buyer alike. Keeping drafts scoped to the deal team, and opening the final folder only once the version is dated, enforces that without relying on anyone to remember it.

**The archive is the deliverable.** A warranty claim in year six needs the final report, the appendices, the disclosure set as it stood at signing, and the access record: three years of retention for general warranties and seven for tax, long after the deal team has moved on.

### Step 1: separate drafts, finals, and the evidence base

Build three top-level folders: draft reports, final reports, and appendices with supporting evidence. Within each, one subfolder per workstream plus one for the master report. That structure is what makes differentiated access possible later, and it is why folder-scoped permissions beat picking documents one by one across seven recipients.

Upload workstream reports as they arrive rather than waiting for the full set. **Automatic file indexing** on the Data Rooms Plus plan maintains the index as documents land, which matters because reports arrive in waves and the index is what the lender's counsel navigates.

### Step 2: set the scope on the link, not on the file

This is where a reporting room differs most from a disclosure room. Five recipient types typically need five views of the same reports, and the scope belongs on the link so that adding a person to the lender's team does not mean rebuilding permissions.

| Recipient | Folders granted | Rights | Download |
| --- | --- | --- | --- |
| Buyer deal team | Drafts, finals, appendices | Full access | ✔️ |
| Lender | Final financial, tax and legal reports | View, watermarked | ✔️ |
| W&I insurer | All final reports plus appendices | View only, watermarked | - |
| Board | Executive summary and adjustment schedule | View only | - |
| Seller | Redacted findings extract | View only, watermarked | - |

**Granular file-level permissions** are set per link rather than per user, so each recipient gets a link carrying its own folder scope, **email allowlist** or domain restriction, and download rule. Access is link-based, so nobody creates an account, which removes the friction that stops a busy credit analyst opening the room at all.

![Granular folder-level permissions applied per recipient link in a Papermark data room](https://assets.papermark.io/upload/file_LkU4BNY6MKUKMgDucSzzFg-papermark-granular-permissions.png)

_Permissions are scoped per link, so the lender and the warranty insurer see different folders of the same reporting room._

### Step 3: watermark everything that leaves under a non-reliance letter

Switch the insurer and seller links to view-only and turn on **dynamic watermarking**, which stamps every page with the viewer's email, IP address and timestamp as it renders. On a document whose value depends on staying inside a defined recipient list, that converts an anonymous leak into an attributable one.

The honest limit is worth stating: a downloaded file is legally treated as read, and no platform can recall it. That is why download is disabled rather than discouraged for non-reliance recipients, and why the lender's copy is watermarked.

![Dynamic watermark showing viewer email, IP address and timestamp on a due diligence report page](https://assets.papermark.io/upload/file_Ks2dtpU7UXaoreiAAtXr54-watermarked-document.png)

_Dynamic watermarking renders recipient identity onto every page, which is what makes a leak traceable to a named viewer._

### Step 4: gate the reports behind the reliance paperwork

Reliance and hold-harmless letters have to be signed before a report is shared, and under time pressure that sequencing collapses. Attaching **NDA agreements** or a One-Click NDA to the link puts the acknowledgement in front of the recipient as they open the report, and records acceptance against the visitor rather than in a mailbox.

Follow-up questions from a credit team or an underwriter belong in the same place. The **Q&A module** attaches each question to the report page that prompted it, with permissions controlling who sees which threads, so the insurer never reads the lender's questions.

### Step 5: read the analytics, then freeze the room

**Page-level analytics** show which recipient opened which report, when, and for how long. That is a live signal: an underwriter who has spent an hour in the tax chapter is heading toward an exclusion, and you will know days before the policy draft arrives.

![Per-recipient analytics across due diligence reports in a Papermark data room](https://assets.papermark.io/upload/file_YVZLbYwELYa8SxfjBg3mGe-virtual-data-room-analytics-.png)

_Per-recipient analytics show which reports each party opened and for how long._

At completion, **data room freeze** makes the room immutable and exports it as an archived ZIP with a certificate. When a warranty claim surfaces in year four or a tax claim in year six, that archive is the record of the final report, the appendices, and who received which version.

### What it costs

The [Data Rooms plan](https://www.papermark.com/pricing.md?view=datarooms) is **€99/month** with a 7-day free trial and includes 3 team members, unlimited data room visitors, unlimited data rooms, unlimited documents, custom domain, dynamic watermarking, NDA agreements, and granular file-level permissions. **Data Rooms Plus at €249/month** adds 5 team members, the Q&A module, the audit log, automatic file indexing, and SOC 2 Type II. **Premium at €549/month** adds 10 team members, AI redaction, the public API, SSO, and white-labelling. **Data Rooms Unlimited at €999/month** removes per-seat charges entirely, so teams that add reviewers mid-deal pay one number regardless of headcount, and it carries every Premium capability including AI redaction. Because rooms are unlimited, running a reporting room alongside the disclosure room costs nothing extra, which is not true of platforms priced per project or per page.

_No credit card required._

## FAQ

### What is a due diligence report?

It is the written output of a diligence exercise, recording scope, methodology, findings with severity ratings, quantified adjustments, and recommendations. A standard report has 9 sections and is addressed to one named client; anyone else reads it under a reliance or non-reliance letter.

### What should a due diligence report include?

An executive summary, scope and limitations, methodology and sources, workstream chapters, a findings register, quantified adjustments to EBITDA and net debt, recommendations, appendices, and the reliance page. In a mid-market deal the findings register alone runs to between 50 and 150 rows.

### Who prepares a due diligence report?

Each workstream is written by its own adviser: transaction services teams for financial, deal counsel for legal, tax practices for tax, and specialists for IT, commercial, ESG and insurance. A full-scope deal produces 8 workstream reports, consolidated by the lead corporate finance adviser.

### What is a red flag due diligence report?

A report scoped to material issues only, above an agreed threshold, with everything below it expressly excluded. Buyers commission one first because it typically takes 2 to 3 weeks and costs a fraction of a full review, which is enough to establish whether there is a reason not to proceed.

### What is vendor due diligence and who pays for it?

The seller commissions and pays for it before launch, then issues it to bidders with the information memorandum so that 5 bidders do not each duplicate the same review. Bidders read it with no reliance during the process, and the adviser issues a capped reliance letter to the winning bidder at signing.

### What is a reliance letter in due diligence?

A short agreement extending the adviser's duty of care to a named third party such as a lender. It does 6 things: defines the report and version covered, restates the scope, grants reliance for one stated purpose, records acknowledgements, imposes confidentiality, and caps liability. Without one, a third party has no claim if the report is wrong.

### Can a lender rely on the buyer's due diligence report?

Only under a signed reliance letter. On leveraged deals the facility agreement usually makes reliance on the financial, tax and legal reports a condition precedent to first drawdown. Agree the perimeter and the liability cap at engagement rather than in the final week, because renegotiating a cap sits on the critical path.

### Why does a warranty insurer read the reports if it cannot rely on them?

The underwriter prices the policy on the quality of the diligence behind each warranty and uses the reports to set exclusions. They are shared on a strict non-reliance basis, so the adviser signs a hold-harmless letter first. Policies typically run 3 years for general warranties and 7 for tax.

### How long does it take to produce a due diligence report?

First drafts typically arrive in week 4 or 5 of a mid-market process, with 2 full review rounds before a final version dated at signing. Red-flag reports land faster, usually in 2 to 3 weeks. The binding constraint is document availability from the seller rather than adviser capacity.

### How much does a due diligence report cost?

The report is part of the workstream fee rather than a separate line. Mid-market deals between $10M and $100M typically run $50,000 to $150,000 in total diligence fees, with financial due diligence at $40,000 to $100,000 of that. Deals from $100M to $1B run $150,000 to $500,000.

### Do I need a data room for due diligence reporting, or is email enough?

Email gives you one permission set and no record of where an attachment ended up, and a reporting distribution needs at least 4 scopes: deal team, lender, insurer, and board. A data room for due diligence reporting sets the scope on the link, watermarks copies going out under non-reliance letters, and produces the access log a claim turns on years later. The Data Rooms plan is €99/month with 3 team members.

## Related resources

- [Best virtual data rooms in 2026](/blog/best-virtual-data-rooms.md)
- [M&A due diligence checklist](/blog/m-and-a-due-diligence-checklist.md)
- [Financial due diligence](/blog/financial-due-diligence.md)
- [Due diligence cost](/blog/due-diligence-cost.md)
- [Legal due diligence checklist](/blog/legal-due-diligence-checklist.md)
- [Data rooms for M&A transactions](/blog/virtual-data-room-for-mergers-and-acquisitions.md)

---

_Markdown version of [this article](https://www.papermark.com/blog/due-diligence-report) for AI agents and LLMs._
_More Papermark content: [llms.txt](https://www.papermark.com/llms.txt) · [full index](https://www.papermark.com/llms-full.txt)._