How to Read a Due Diligence Report

A due diligence report lands on your desk. You scan for the verdict: clean or not clean? Approve the deal, or walk away? More often than not, what  you find instead is a conclusion written in shades of grey, such as “no verifiable evidence of operations was found,” or “the company could not be confirmed as operationally active”.

While that phrasing can feel unsatisfying, it’s actually how a properly conducted due diligence investigation is supposed to sound.Understanding why will change how you interpret every due diligence report you receive moving forward. 

A real example: The company that looks fine on Paper

A prospective supplier is legally incorporated. Its ultimate beneficial owner is transparent. They have no litigation history and don’t appear on any sanction list. On paper, it looks like a pass. 

Now add a second layer of facts: the company operates from a virtual office and has no website, customer references, or documented projects that can be independently verified. Three very different reports could come out of this:

• A weak report that simply lists both sets of facts side by side, leaving you to guess what they mean. 
• An overconfident report that jumps straight to “this is a paper company” without any corroborating evidence.
• A properly reasoned report that tells you what was tested, what could not be identified, and how certain you can be about that gap.

The company’s legal existence is established. Its business substance is not. That is a meaningfully different statement than a simple pass or fail. 

Why investigators write findings as probabilities, not verdicts

Due diligence investigators are not simply collecting information, they are testing and processing it as part of an intelligence process. Instead of asking, “Is this a paper company?,” a rigorous investigator asks the reverse question, “What evidence would reasonably persuade me that it is not?”.

They then look for evidence that would substantiate existing claims: completed projects, real customers, procurement records, an operating facility, anything that would demonstrate genuine commercial activity.

When that search comes up empty, the honest conclusion isn’t “this is a paper company.” It’s “this company’s operations could not be independently verified”—a statement of probability, not certainty. That distinction matters because the same underlying facts can support more than one explanation, and a due diligence report exists to help you weigh those explanations instead of ignoring them.

This is also why a well-written report will flag its own limits: what could not be checked, what sources were unavailable, and what would change the conclusion if new information surfaced.

Due diligence vs. fraud investigation

It helps to know what kind of report you’re reading. Due diligence and fraud or criminal investigation are often lumped together, but they answer different questions.

Fraud, criminal, and accident investigations look backward: their job is to reconstruct exactly what happened, often to support legal action or a formal finding of fault. Due diligence looks forward. Its job is to reduce uncertainty before you make a decision, not to prove guilt or innocence.

Clients rarely commission due diligence to confirm what they already believe. They commission it to see what a decision would look like, with less uncertainty attached. Judged against that goal, a report that says “proceed with caution—operational activities unverified” has done its job, even without a dramatic conclusion.

Red flags to take seriously when you read a report

You don’t need an investigator’s training to read a report more critically. A few patterns are worth watching for in any due diligence or vendor screening report:

• No verifiable physical presence, website, or customer base behind an otherwise clean legal profile
• Beneficial ownership or directors that changed shortly before the relationship or transaction was proposed
• Revenue or contract values that look disproportionate to headcount or visible infrastructure
• Related entities sharing addresses, directors, or transaction patterns without a clear business rationale
• A report that reaches a firm conclusion without explaining what was checked and what wasn’t

None of these, on their own, establishes wrongdoing. What matters is how many appear together, and whether the report you’re reading explains that reasoning rather than jumping to a verdict.

What this means for you as a decision-maker

The next time you receive a due diligence report, a few questions can tell you far more than a simple pass/fail stamp:

• What exactly was checked, and what specifically could not be verified?
• Does the conclusion match the strength of the evidence, or does it overreach?
• What would change this conclusion if new information came to light?
• Given the uncertainty that remains, what additional checks—interviews, site visits, ongoing monitoring—would close the gap?

A good due diligence partner will welcome these questions. If a report can’t answer them, that’s a red flag in itself.