How to Judge the Evidence Behind a Diligence Red Flag

A red flag arrives as a sentence. Customer concentration. Revenue recognition irregularity. Key person dependency. Each one reads like a finding, and some are. But a flag is a claim that something raises risk, and a claim carries whatever evidence sits behind it and nothing more. The work on the receiving end is to find out what that is, before the flag moves price, structure or scope.

What a Red Flag Review Is, and Where Its Scope Ends

A red flag review is a deliberately shallow first pass. Reviewers read what the seller has released, against an agreed scope, and surface the items that could break the deal or change its price. An exception list with a date on it. Not a resolution of anything.

Two consequences get forgotten in the room.

• Silence is not clearance. Nothing surfaced means nothing surfaced inside that scope, with the documents available that week.
• A flag is not a conclusion. Someone decided an item was worth raising. That is a different act from proving it.

One disambiguation, because the searches collide. The Red Flags Rule is an identity theft obligation: it tells financial institutions and certain creditors how to develop, implement and administer a prevention program for covered accounts. It has nothing to do with a transaction.

Who runs the first pass, and what it covers, is its own question: due diligence services and the scoping lines of the due diligence checklist both deal with it. What follows assumes the flags are already on your desk.

Separate the Observation, the Inference and the Judgment

Most flags fuse three statements into one line. Customer concentration risk: the largest account is a large share of revenue. That line holds an observation (what the revenue ledger shows), an inference (that the business depends on a renewal decision made in someone else's building) and a judgment (that this rises to the level of a flag). Each rests on different evidence. The observation needs a document. The inference needs an argument. The judgment needs criteria.

Ask the reviewer to split them. When a flag cannot be split, the inference is usually doing work the evidence could not. Every workstream in due diligence produces flags built this way.

Trace Every Flag to the Document or Interview Behind It

A flag should name its source: the contract, the ledger extract, the ticket history, the named interview, and when each was produced. Where the trail stops at management advised, you have an unverified claim formatted like a finding.

This failure has a public record. In one enforcement matter, the securities regulator found reviewers who knew of repeated flags around a company's claim to hold an agreement with its lessor, and who failed to take reasonable steps to determine that the agreement existed, or that the employees counted as occupants were actually staying there. Nobody went looking for the document. The claim was described, and the description was accepted.

For each flag that could move the deal, ask:

• What artifact produced it. Name the file, the system, the meeting.
• Who made the artifact. The company, its advisors, or a party outside the relationship.
• When. Evidence has a date, and a valuation or a pipeline view ages faster than a contract.
• What was tested and what was described. A walkthrough is a test. A summary slide is a description.
• Where the reviewer ran out of access. That line is often the most useful one in the whole write-up.

Ask Whether the Evidence Is Independent of the Company's Management

Two weak links recur: age and source. In another matter, the same regulator found reviewers who relied principally on stale appraisals and on management's uncorroborated representations of current value, despite evidence that those estimates were biased and inconsistent with independent market data. The flags were visible. The evidence used to settle them came from the people the flags were about.

Auditing practice carries a rough ordering that travels well enough to use as a prompt: direct inspection and outside confirmation sit above documents the company produced for itself, and those sit above what someone said in a meeting. No published standard maps that ordering onto deal workstreams, so hold it as a habit rather than a rule. It is the same move as reading operating data against the management presentation.

Sufficient Evidence and Available Evidence Are Not the Same Thing

Asking is not evidence. Auditing standards say inquiry alone does not establish the absence of a material misstatement, and the research on reviewer behavior is blunter: when an explanation sounds plausible, even experienced reviewers often stop there. Inspectors have observed some of them seeking only the evidence that would support management's own judgments.

The countermeasure is sequence. Build your own expectation of how the business works, from the operating detail, before anyone explains the exception to you. An explanation offered against a view you already hold is testable. An explanation offered into a vacuum is just the first answer you heard.

Workstreams diverge here, and it is worth saying so plainly. Financial work has published literature to argue against, which is why a quality of earnings analysis can show each adjustment and have it contested line by line. A technology review and an operational review usually have no authoritative standard behind them, so the criteria are whatever the reviewer chose. Ask what they were.

Judge Severity by Criteria, Condition, Cause and Effect

Government auditing builds a finding out of parts. The federal rule for audits of organizations that spend federal awards lists what an audit finding must include, among them the criteria (what should be happening), the condition (what is happening), the cause (why) and the effect (what follows). The rule is published, which makes it a yardstick you can hold an advisor's wording against. A flag with no criteria is a preference. A flag with no cause gives you nothing to fix, and leaves you guessing whether it will recur. A flag with no stated effect has not been argued.

Severity is also where size gets mistaken for an argument. The securities regulator's materiality guidance says exclusive reliance on a numerical threshold has no basis in the accounting literature or the law, and that quantifying magnitude is only the beginning of the analysis. Small items decide things: when they trip a covenant, reverse a trend, obscure a related-party arrangement, or show that someone chose the number. Amber is not an argument either, and neither is a position on a risk grid. The diligence risk calculator orders the work. It does not settle it.

Look for the Evidence That Would Disprove the Flag

One question separates a tested flag from a repeated one. What would have to be true for this to be wrong, and did anyone go and look?

• Concentration. Contract terms, renewal history, how many relationships sit inside the account, and who holds them.
• A people flag. Leaver definitions before leaver counts, cut by team and by manager, and who decides which departures were regretted. This is the input to key person risk, and the hardest evidence to get before signing.
• Technical debt. Incident history, change failure, how long a release takes, and how many people can deploy without help.
• A control gap. Whether the control exists on paper, whether it ran, and whether anyone kept the artifact that proves it ran.

Disconfirming evidence catches the opposite error too: a flag that is real but small, raised because it was easy to see, while the risk that decides the deal sits in a workstream nobody scoped.

Decide What a Confirmed Flag Changes: Price, Structure or Scope

A flag that survives this treatment has honest destinations: price, deal structure, more evidence inside the time left, or a named owner and a date after close. Walking away is another, used more rarely than it should be.

What you do with a flag reaches past the deal. The Delaware Supreme Court recently revived a buyer's fraud claim after a trial court had held the buyer willfully blind for not chasing warning signs its own diligence surfaced. Willful blindness requires more than missed flags, the court held: a buyer must subjectively believe there is a high probability of the truth and then take deliberate steps to avoid learning it. This buyer could rely on the seller's representations because the seller concealed and answered untruthfully when pressed. Read it as an account of one decision, not as advice: what your own agreement and conduct mean for your position is a question for deal counsel.

The working test stays short. A flag with a named source, a date, corroboration that does not route back through management, and an argued effect is a finding, and you can act on it. Everything else is a question you are carrying into the deal, and it belongs in the memo as a question, with the missing evidence named beside it. A list of flags is not a position. Traced flags are.