A due diligence report brings together evidence about a person, business or transaction for a defined purpose. A useful report identifies its sources, explains the findings and states what remains uncertain. Its length alone tells you little about the quality or scope of the work.
Before relying on one, ask whether it addresses the decision you need to make. A corporate-status review cannot answer every question about ownership, litigation or financial health. Likewise, a name-screening result needs identity checks before it supports a finding about your counterparty.
This guide explains how to assess the report’s structure, evidence and limits. Compliance Officers can help define the review and coordinate the agreed research. The final decision remains with the responsible person or institution, subject to applicable law.
What a due diligence report should establish
The report should connect a question to the evidence examined and the conclusion reached. Searching a database is one part of that work. Verification asks whether a result concerns the correct subject and what the underlying record actually says.
For example, finding a lawsuit with a similar company name does not establish that your supplier is the defendant. The legal name, jurisdiction, identifying details and case documents may resolve the match. If they do not, the uncertainty should remain visible.
U.S. corporate and court records sit across different systems. Their coverage, available documents and update schedules vary. Therefore, the report should identify the relevant jurisdictions and sources instead of suggesting that one search covers every possible record.
Our guide to company due diligence explains the broader review. A written report should reflect the work commissioned, rather than imply that every risk area received the same attention.
The main sections of a due diligence report
A consistent structure makes the evidence easier to assess. The following sections help a reader understand what the assignment covered, how the findings were reached and where further work may be needed. Their detail should match the purpose and scope of the engagement.
| Section | What to look for | Question for the reader |
|---|---|---|
| Scope and dates | Questions, exclusions, jurisdictions and relevant dates | Does the work address this decision? |
| Subject identification | Legal identity and supporting identifiers | Is this the actual counterparty? |
| Sources | Named records, source dates and access dates | Can the findings be traced? |
| Findings | Evidence grouped by the agreed risk areas | What does each record support? |
| Limits and open items | Unavailable evidence and unresolved questions | What remains unknown? |
| Analysis and conclusion | Reasoning, rating method and proposed follow-up | Does the conclusion follow from the evidence? |
| Preparer and permitted use | Responsible preparer, issue date and intended recipients | Who may use or rely on it? |
A missing section does not automatically make a report worthless. However, the reader should be able to locate this information or understand why a particular element falls outside the agreed work. An unexplained omission can lead to an unsupported assumption.
Similarly, a report may appropriately reach a limited conclusion or state that evidence is insufficient. A confident rating is not helpful if the sources cannot support it. The basis for the assessment matters more than the label.
Read the scope before relying on the summary
The executive summary gives an overview, but the scope determines what was examined. Read the exclusions and limitations alongside it. If financial verification was excluded, a favorable corporate-record finding should not become a conclusion about financial stability.
Dates also need separate attention. A report’s issue date may be later than the dates of its underlying searches and records. A commercial source may have its own update cycle. The report should make those differences clear where they affect the findings.
A “no records found” result applies to the sources and search parameters used. It does not prove that no relevant record exists anywhere. Names, date ranges, languages, jurisdiction coverage and access restrictions can affect what a search returns.
The due diligence checklist can help define the expected document set. It should be adapted to the transaction rather than treated as a universal list for every assignment.
Separate facts, allegations and analysis
A fact in a report should be tied to an identified source. For instance, a docket may show that a complaint was filed on a particular date. That establishes the filing; it does not establish that every allegation in the complaint is true.
An allegation should retain its attribution and procedural context. A pending claim, dismissed case, settlement and judgment can have different meanings. The report should avoid presenting them as equivalent outcomes.
Analysis explains what the evidence may mean for the review. It should state the reasoning and its limits. For example, a shared registered-agent address can justify checking the operating address, but it does not alone prove that a company lacks operations.
This distinction also applies to adverse media. Identify the publication, date and underlying claim. Repetition across several websites may reflect one original story rather than independent corroboration. Where relevant, later corrections or developments belong in the assessment.
Ownership and sanctions findings need their own evidence
Corporate formation records do not necessarily disclose the full ownership chain. A registered agent, officer or incorporator is not automatically an owner. Ownership analysis may require internal records and supporting evidence from more than one jurisdiction.
FinCEN’s BOI reporting regime also has a specific scope. Its August 2026 final rule, effective August 14, exempted U.S.-created entities and U.S. persons from the applicable reporting requirements. Certain foreign-formed entities registered in the United States may remain covered, subject to exemptions.
Those changes do not establish that no ownership evidence exists elsewhere. FinCEN’s BOI system is not a general public ownership-search service. The report should explain the actual sources used to assess ownership and any gaps in them.
Sanctions review can extend beyond names appearing on a list. Under OFAC’s 50 Percent Rule, entities owned 50 percent or more, directly or indirectly and in aggregate, by blocked persons can themselves be blocked. A name-only search may therefore leave relevant ownership questions unanswered.
Our guide to the beneficial owner explains why roles and ownership should be distinguished. Potential sanctions exposure requires assessment under the applicable program and facts, with qualified advice when needed.
How a due diligence report handles gaps
An unavailable record should appear as a limitation, with an explanation where known. Possible reasons include restricted access, an unavailable public index, a pending request or missing information from the subject. Silence can otherwise look like completed coverage.
Open items should describe what remains unresolved and what evidence could address it. A vague instruction to “investigate further” gives the decision-maker little direction. A specific request for the relevant ownership record or case disposition is easier to assess.
However, an empty open-items list does not automatically mean the report is unreliable. A narrow review may resolve its defined questions. The important issue is whether the report’s evidence supports its stated scope and conclusion.
Where ordinary records cannot resolve a material concern, enhanced due diligence may be appropriate. The recommendation should explain the concern and the proposed additional work. More database pages alone may not resolve the gap.
Legal requirements depend on the purpose
There is no single report format that makes every business compliant with every rule. FinCEN’s CDD Rule applies to specified covered financial institutions. An ordinary operating business is not automatically subject to that rule merely because it reviews a supplier.
FinCEN’s February 13, 2026 relief changed certain repeated beneficial-owner checks at new account openings. It retained checks at the initial relationship, when prior information becomes unreliable, and as required by risk-based ongoing procedures. Institutions may choose to retain broader checks.
Sanctions obligations are separate. OFAC can impose civil penalties under a strict-liability standard for applicable violations. Buying a report does not transfer the client’s legal obligations to its preparer or guarantee that a transaction is permitted.
The intended use also matters when a report concerns an individual. For example, the FTC’s employment-background guidance explains disclosure, authorization and adverse-action requirements when applicable consumer reports are used. A general business report should not be reused for an unrelated regulated purpose without review.
Criminal records and media searches have limits
A commercial background search and an FBI Identity History Summary are different records. Neither should be described as a guaranteed account of every event involving a person. The FBI’s summary reflects specified information associated with fingerprint submissions retained by the agency.
The FBI’s guidance also distinguishes personal-record access from purpose-specific background-check routes. Employment, licensing or adoption may require an authorized channel. A preparer should establish the permitted purpose and access before including personal records.
Media coverage requires similar care. The report should identify relevant search languages, periods and source types. A limited English-language review may leave reporting in other languages outside scope; that limitation should remain visible.
A negative result should use wording that matches the work. “No relevant articles located in the stated sources” is more precise than a claim that the subject has never faced adverse reporting.
Risk ratings, updates and sharing
A risk rating should explain both the concern and its relevance to the proposed transaction. An unresolved ownership question may matter differently in a small purchase and a regulated financial relationship. The rating method should make that distinction understandable.
Reports also age. A new filing, ownership change, sanctions designation or material event may call for an update. There is no universal expiry period for every due diligence report. Timing should reflect the purpose, risk and applicable requirements.
Early review can help parties address findings before they commit. However, findings after signing do not always leave withdrawal as the only option. The agreement, remaining conditions and legal rights determine what responses remain available.
Before sharing a report, check the engagement terms, confidentiality obligations and intended recipients. Permission to receive a copy may differ from a right to rely on it. Personal data and allegations should only be disclosed for an authorized purpose through an appropriate channel.
Frequently asked questions about a due diligence report
How should I read a due diligence report?
Read the scope, dates and limitations alongside the findings and summary. Confirm the subject’s identity, trace material findings to their sources and examine unresolved items. Ask how the conclusion follows from the evidence and whether it addresses your actual decision.
What determines the cost and timing?
The scope, jurisdictions, available records and depth of review affect both. Ownership research, court documents, additional languages and pending official requests can add work. The engagement should explain the expected deliverable and dependencies without promising a universal deadline.
Am I legally required to obtain a report?
That depends on your activities and applicable obligations. Some regulated institutions must perform specific checks, while other reviews support commercial decisions or contractual requirements. A report’s title alone does not establish compliance with the rules governing its use.
Can I share the report with a bank or investor?
Check the permitted recipients, reliance terms and confidentiality requirements first. A new recipient may need additional work or a separate agreement. Tell the preparer at the outset who needs to receive and rely on the report.
How long does a report remain current?
Its findings relate to the dates and evidence stated. Changes in the subject or relevant records may require a targeted update. The review schedule should reflect the transaction and risk, rather than assume a fixed validity period for every report.
Discuss your review with Compliance Officers
Compliance Officers can help define the subject, purpose, jurisdictions and evidence needed for your due diligence report. The agreed scope should state exclusions, intended recipients and the approach to unresolved findings. Record availability and third-party responses can affect the work.
Contact Compliance Officers at +1 305 647 3000, through WhatsApp or at info@complianceofficers.org. Describe the decision you are considering so the team can assess an appropriate scope and secure way to exchange documents.
This article provides general information. It is not legal advice, a finding about any person or company, or a guarantee of regulatory compliance. Requirements depend on the purpose, jurisdiction and facts.
