Red Flag Due Diligence Report: Spotting Key Risks in M&A

The importance of a red flag due diligence report is highlighted in the case of German pharmaceutical company Bayer’s acquisition of US business Monsanto. Had Bayer been aware of the risks associated with the $63 billion (€54 million) transaction, it would have discovered that one of Monsanto’s products, a herbicide called Roundup, was the subject of numerous litigation cases suggesting it caused a variety of cancers.

In less than a decade since the M&A deal went through, Bayer has paid more than $10 billion (€8.5 billion) to settle claims, with tens of thousands of lawsuits still pending. When entering any such deal, whatever the value of the acquisition, buyers must understand where the risks lie and whether they can be mitigated in a manner that still represents value once it is completed. Otherwise, it can lead to financial and reputational damage in the future.

This article explores red flag due diligence reports as commissioned by the seller in an M&A deal, which is important for displaying transparency and avoiding disputes between parties later on.

Key takeaways

• Red flag due diligence helps sellers identify major legal, financial, operational and compliance risks before buyers uncover them during M&A negotiations.
• A focused red flag report is faster and more targeted than the full vendor due diligence process, concentrating on the issues most likely to affect valuation, timing or buyer confidence.
• Sellers use red flag reports to fix problems early and create a more transparent and defensible negotiation process.
• Common red flag areas include litigation, tax exposure, customer concentration, GDPR compliance, cybersecurity resilience and key operational dependencies.
• Structuring a secure VDR around the findings helps sellers manage disclosures, support Q&A workflows, maintain audit trails and reduce the risk of post-deal disputes.

What is a sell-side red flag due diligence report?

A sell-side red flag due diligence report is a focused review commissioned by the seller before going to market in an M&A process. It is used to highlight major legal, financial, operational, regulatory or compliance issues that could affect the valuation of your company, delay the transaction, discourage buyers or cause post-deal disputes.

Unlike a full vendor due diligence process, a red flag report is more focused and faster. It doesn’t analyse every aspect of the business in depth, but rather concentrates on the issues that are most likely to create concern when the buyer undertakes their own due diligence.

The report allows sellers to address problems before buyers discover them, including those that might jeopardise the process, the so-called “deal breakers”. This helps management prepare explanations, fix issues where possible and reduce the risk of price reductions or disputes later in the deal. It can help guide the buyer towards the areas that need additional attention before negotiations move forwards.

With the results of the red flag report, you can prepare your virtual data room (VDR) with a structure that allows for easy analysis of the key risk areas. You can also create a disclosure strategy that allows you to inform the buyer of potential problems and mitigation processes you have in place.

Why sellers commission red flag reports

• Control the narrative before buyers set it by understanding your business’s weaknesses in advance and preparing clear explanations and mitigation plans before the buyer’s due diligence uncovers these concerns.
• Identify issues early enough to remediate rather than just disclose so you have time to fix gaps in contracts, governance, compliance or reporting, for example, before they affect your valuation or delay the transaction.
• Accelerate the buyer’s diligence process and reduce process drag because better-prepared documentation and fewer surprises allow buyers and advisors to review your information more efficiently and with greater confidence.
• Strengthen your negotiation position by demonstrating transparency and showing that management understands the business’s risks and has taken proactive steps to manage them rather than hiding them and reacting defensively during negotiations.
• Support warranty and indemnity (W&I) insurance underwriting where applicable by helping insurers assess known risks more clearly. This can improve confidence and reduce the chance of exclusions or extended negotiations over what coverage is available.

Key risk areas to review on the sell side

What to do with your findings

Remediate

The red flag due diligence report will often uncover issues that could be of concern to any prospective buyer. These might be matters that you already knew about, but have managed effectively, or it could be a surprise to you. The idea of the report is to understand how your business looks from the perspective of an outsider who is interested in acquiring it. Matters that you may not realise could be a concern, having lived with them, may appear different to an external view.

This is your opportunity to carry out one of the following:

• Build a case as to why a matter that has raised a red flag will be less impactful than it appears.
• Remediate any issues that surface, if you have time and available budget to do so before the buyer’s due diligence begins.
• Create an action plan to remediate the issue before the deal closes.
• Implement an indemnity into the contract to reimburse the buyer if a particular issue causes financial loss after completion.

Disclose proactively

In the cases where it is not possible to remediate, you can build trust with buyers by being proactive about disclosing red flags. Rather than waiting for them to discover them in their due diligence, showing that you are open and honest about the status of your company helps them build the confidence that you are not knowingly hiding any other matters that may cause concern later on.

However, it is important to add context to this report. Help them understand why the matter is unresolved and how it fits into your operational processes. Develop a narrative to explain how you, or the buyer, can mitigate the risk and move forwards in a positive manner.

Proactive disclosure can save time for both parties and protect your valuation, whilst streamlining the transaction and helping keep it on track.

Structure your data room

Create a clear and easy-to-navigate structure for your virtual data room so that buyers and their external advisors and experts can find all the information they need on these red flags. These findings can be sensitive for your organisation as, taken out of context, they could affect your valuation or the perception of your business.

Ensure you use a VDR with robust security protocols and access controls. This allows you to interact with the buyer’s stakeholders in a confidential manner, working out a mitigation plan without unauthorised individuals accessing the information.

Brief your advisors

It is not only the buyer’s team that needs to know about risks as a result of your red flag due diligence report. You should also be open with your stakeholders. This includes your legal, financial and tax experts who need insight into the detail and to be part of creating a consistent and aligned action plan for managing the issue.

Inform warranty and indemnity (W&I) insurers about any significant risks so they can assess how the findings might affect insurance cover, exclusions or policy pricing.

How to organise your data room around the findings

• Use the red flag report as a blueprint for the structure of your data room. You can prioritise the most important matters accordingly, storing them high up in the hierarchy so that buyers can find the documents they need to assess the red flag.
• Ensure sensitive documents are access-controlled. Only those with a need to know and view the information should be able to see it and take action.
• Maintain a clear audit trail of what was made available and when so that you can prove that stakeholders from the buyer knew about issues at this stage of the deal. This is useful in the event they raise a dispute after signing.
• Use Q&A functionality to manage buyer queries arising from disclosed issues. This allows you to carry out the necessary conversations in confidence and save answers to common queries so that all prospective buyers receive the same information on the issue.
• Keep the data room updated as remediation progresses so that all users have access to the most recent versions of documents and are aware of the status of issues. Without this, buyers might pull out because they think there are still red flags over the deal.

FAQ

References and further reading

• VDR security features
• Audit trails in VDR
• How a VDR works for M&A due diligence
• Set up a VDR for M&A
• Step-by-step corporate due diligence process