Red Flags in Due Diligence: What an Investigation Can Surface That the Data Room Won't

A Red Flag Is a Question, Not a Verdict

In due diligence, a red flag is a fact that changes the risk a buyer, investor or lender is taking on, or that does not square with what the other side has represented. It is a signal that something needs explaining. It is not yet a finding against anyone: a lawsuit may have been meritless, a lien may have been paid, a name on a list may belong to someone else. What turns a signal into a conclusion is the work done after it surfaces.

Most published lists of due diligence red flags are lists of what the documents show: revenue recognition, customer concentration, change-of-control clauses, aggressive adjustments to earnings. Those are found by reading what the target provides, and they are the work of accountants and deal counsel. This article covers the other kind: flags held in records the target does not control and is not obliged to volunteer. For each family of flag, it sets out where the flag tends to surface and what it takes to resolve it. Why this layer exists at all is set out in what investigative due diligence is; the full pre-acquisition sequence it fits inside is the enhanced due diligence checklist.

Resolution runs through four routes, and most serious flags use more than one:

• A document request: the specific record that explains the flag — the pleading, the settlement agreement, the lien release, the ownership chart down to natural persons
• A scope extension: another jurisdiction, another set of entities, another period, or interviews, where the first pass raised a question it cannot answer
• A contractual protection: a specific representation, a special indemnity, an escrow or holdback, or a closing condition, drafted by deal counsel around what was found
• A specialist review: sanctions counsel, regulatory counsel, a forensic accountant or a licensing expert, where the open question is one of law or accounting rather than fact

Ownership and Control

The flags: owners who are not the people on the capitalization table; nominee directors or managers; affiliates that share an address, a registered agent or an officer with the target but appear nowhere in the disclosures; a landlord, supplier or customer quietly owned by a principal; and transfers of ownership in the months before a sale.

Where they surface. State business filings give formation dates, registered agents, amendments, dissolutions and, where the state requires them, officers or managers. Read across a principal's whole history, they also show the other companies that person has run. Many states, Delaware among them, do not put owners on the public record at all, so ownership is usually established by reconciling several sources rather than read off one. County property records show who owns the premises the target occupies. UCC financing statements, filed in the debtor's home state, name secured parties, which sometimes turn out to be affiliates.

Foreign registries carry the layer above a U.S. entity held from abroad; the UK's register of people with significant control is the most accessible.

U.S. companies have not had to report beneficial ownership to FinCEN since its March 2025 interim final rule, and FinCEN's final rule, announced on 11 August 2026 and effective 14 August 2026, made that exemption permanent; the information reported earlier was never public. As the Corporate Transparency Act now stands, ownership in a U.S. deal is established by investigation.

What resolves it. A document request comes first: an ownership chart traced to natural persons, shareholder agreements and any side letters, and a complete list of related-party contracts. Where a foreign holding layer cannot be read from the United States, the scope extends into that jurisdiction's registries and courts. What is confirmed is then protected in the contract: a capitalization representation, a related-party disclosure schedule and, where a principal owns the landlord or a key supplier, renegotiation or termination of that contract as a condition of closing. If any owner proves to be foreign, the sanctions questions below apply to the whole ownership chain, not only to the target's name.

Litigation and Regulatory History

The flags: suits the disclosure schedule omits; suits against principals personally, or against companies they ran before; patterns, such as repeated wage claims, repeated customer fraud claims or repeated disputes with former partners; and regulatory action such as consent orders, license suspensions or enforcement settlements. A principal's legal history carries weight beyond the single case. The Association of Certified Fraud Examiners' Occupational Fraud 2026: A Report to the Nations, drawn from 2,402 cases in 143 countries and territories, lists "past legal problems" among the behavioral red flags with the highest median losses: $400,000 in the occupational fraud cases where the perpetrator showed it.

Where they surface. Federal civil, criminal and bankruptcy cases are on PACER. State courts hold most commercial and employment disputes, and there is no single national index of them: they are searched court by court, in the counties where the company and its principals have lived and operated, and some smaller courts can only be searched in person. Most arbitration is private, although FINRA publishes securities arbitration awards and an award taken to court for confirmation enters the public docket.

Regulators publish their own records: SEC enforcement actions and litigation releases, FINRA BrokerCheck, state attorneys general, and sector databases such as OSHA's inspection records and the EPA's ECHO system. A docket entry says a case exists. The pleading says what was alleged, and the final order says how it ended. Only the documents distinguish a dismissed nuisance claim from a settled fraud claim.

What resolves it. A document request for the pleadings, any settlement agreements, insurers' coverage positions and correspondence with the regulator. A specialist review by litigation or regulatory counsel to size the exposure and judge whether a consent order is being complied with. A scope extension where courts in other states are plausible. In the contract, a known matter generally needs its own protection: representation and warranty insurance (often called rep and warranty insurance, or RWI) policies typically exclude matters the buyer knew of before signing, so a flag found in diligence is usually handled by a special indemnity, an escrow or the price rather than by the policy. This is general information, not legal advice; how a given matter is allocated is for deal counsel.

Financial Distress

The flags: federal or state tax liens; judgment liens; a run of recent UCC filings by alternative lenders, which can indicate stacked short-term financing; mechanics' liens on property; collection suits by suppliers; a lis pendens on real estate; a principal's earlier bankruptcy; and recent layoff notices. Each can be absent from management accounts, or present only as a reclassified line.

Where they surface. Notices of federal tax lien are filed under 26 U.S.C. § 6323 in the state or county office that state law designates, alongside state tax liens and judgment liens. UCC financing statements show who has taken security and over what, and their dates show when the borrowing started. PACER carries bankruptcy filings for the company, its affiliates and its principals. State court dockets carry suppliers' collection suits, which often arrive before any default appears in the accounts. Under the WARN Act, employers with 100 or more employees must give 60 days' notice of a plant closing or mass layoff to employees, the state's dislocated-worker unit and local government, and many states publish those notices.

What resolves it. A document request for payoff letters, lien releases and UCC termination statements, then a reconciliation of every lien found against the debt shown in the financial statements, a task for the buyer's financial diligence provider once the investigation has supplied the list. In the contract, release of the liens at or before closing becomes a condition, debt is settled through the funds flow, and an escrow covers what cannot yet be quantified. A lien the balance sheet cannot account for is more than a payoff problem. It is a question about the reliability of the financial statements, and it widens the financial review.

Integrity and Reputation

The flags: adverse press; a failed prior venture missing from the biography; a departure for cause; allegations of misconduct by former partners or employees; and a pattern of falling out with the people a principal does business with. These are the flags most easily dismissed as gossip and the most likely to matter after closing, because the business usually depends on the person.

Where they surface. Licensed news archives reach further back than search engines, and local, trade and foreign-language press reach what national English-language media never covered. Archived versions of web pages, the Internet Archive's Wayback Machine being the best known, show what a company or a person said before revising it. Court records of earlier companies often explain a gap in a career. Interviews with former colleagues, partners and industry sources supply context no record holds. They are conducted openly and lawfully: no pretexting, respect for any confidentiality obligation the interviewee owes, and attention to the Fair Credit Reporting Act wherever the work will inform an employment decision.

What resolves it. The first step is classification. Every reputational item is recorded as established fact, unproven allegation, or something that could not be established, because an allegation repeated in three articles is still an allegation. Where it matters, the scope extends to further interviews or to the original source. Where the deal team judges it appropriate, the point is put to the subject, and the explanation is tested in turn. What remains is usually addressed through the structure of the deal, such as governance rights, key-person conditions or deferred consideration, because reputation is hard to warrant in a contract. How allegations are weighed is set out in our reputational due diligence playbook.

Sanctions and PEP Exposure

The flags: a name match against a sanctions list; an owner, director or counterparty who is a sanctioned person or is owned by one; operations, customers or suppliers in sanctioned jurisdictions; and politically exposed persons among the owners, or government-linked customers in higher-risk markets.

Where they surface. OFAC's Sanctions List Search covers the SDN List and OFAC's other sanctions lists; the EU, the UK and the UN Security Council maintain their own. A list check alone is not enough. Under OFAC's 50 Percent Rule, an entity owned 50 percent or more, directly or indirectly, by one or more blocked persons is itself blocked whether or not it is named, so screening has to follow the ownership chain established above. PEP status comes from commercial databases and official sources, applying the FATF definition of a person entrusted with a prominent public function.

What resolves it. Most name matches are resolved on identifiers such as date of birth, nationality and registration numbers, and closed as false positives on the record; how a PEP hit gets resolved is a discipline of its own. A confirmed match goes to sanctions counsel, who decide whether the transaction can proceed at all and on what license. PEP status is a reason for enhanced scrutiny, never a finding against the person. The question it raises is where the money came from, which is the work of source of wealth and source of funds verification. In the contract: sanctions and anti-corruption representations, a closing condition, and a termination right where exposure cannot be ruled out.

Credentials and Track Record

The flags: a degree that was never conferred; a professional license that has lapsed, carries discipline, or was never held; titles and dates that do not match the record; and an earlier company that collapsed while the principal ran it, left out of the biography. In a business that holds licenses or trades on its people's expertise, a false credential is an operating risk as much as an integrity one.

Where they surface. State bars and licensing boards publish license or admission status and, often, disciplinary history for lawyers, physicians, engineers, accountants, contractors and insurance producers, among others. FINRA BrokerCheck and the SEC's Investment Adviser Public Disclosure site cover securities professionals; NMLS Consumer Access covers mortgage licensees. Degrees are confirmed with the issuing institution or its verification service, which frequently requires the subject's written authorization. Corporate filings and archived company pages place a person in a role on a date, which is how inflated titles and omitted employers come to light.

What resolves it. Direct verification with the issuer, with the subject's authorization requested as a document. Where the business depends on a license, a specialist review of whether that license survives the change of control, since many do not transfer automatically, and a closing condition that it does. Where the record and the biography disagree, the gap is put to the subject before any conclusion is drawn. For funds vetting a management team, the wider method is in investigative due diligence for private equity.

When a Red Flag Is Found

What happens after a flag surfaces matters as much as the flag. First, confirm it belongs to the subject and is current: most false alarms are wrong-person matches or records later vacated, released or dismissed. Second, record it in the language of what is known (established, alleged, or unestablished) with its source and its date. Third, take it to the deal lead and counsel with a recommended route: the document that would explain it, the scope that would settle it, the protection that would cover it, or the specialist who should judge it.

Flags raised early are cheaper to resolve. A lien found before exclusivity is a negotiating point; the same lien found the week before closing is a delay. That is the case for a focused first pass on ownership, litigation, liens and sanctions at the start of a deal, with the wider work running alongside confirmatory diligence.

An investigation can surface these flags. It cannot guarantee that every one has been found. Some jurisdictions keep thin records, some courts cannot be searched remotely, and some facts were never written down. A clean result from a closed jurisdiction proves less than it appears to, and a defensible report says what could not be reached. Fortaris runs investigative due diligence as a senior-led engagement, licensed in Michigan (Private Investigator License #3701207862) and working nationally through vetted licensed specialists, and reports the limits of each search alongside its findings.