Due diligence is one of those processes that everyone talks about but not everyone does well. In theory, it is straightforward: you review the facts before making a significant decision. In practice, especially for compliance professionals, it involves a lot of moving parts, a lot of documents, and a lot of people who all need access to the right information at the right time.
The pressure is real. Whether you are supporting a merger, helping a client close a property deal, or reviewing a vendor before onboarding them, the quality of your due diligence report can either build confidence or raise red flags. A poorly organized report, or one that is incomplete, can delay deals and damage credibility.
This guide walks you through everything you need to know about creating a solid due diligence report, from what it should include to how a virtual data room like Ellty can make the whole process smoother and more secure.
What is a due diligence report?
A due diligence report is a structured document that summarizes the findings of a review process. It captures what was examined, what was found, and what those findings mean for the decision at hand.
Think of it as a written record of your investigation. It tells the reader: here is what we looked at, here is what the evidence showed, and here are the risks or considerations you should be aware of before moving forward.
Due diligence reports are used in many contexts:
- Mergers and acquisitions, where buyers review the target company's legal, financial, and operational position
- Real estate transactions, where parties verify property ownership, liabilities, and compliance
- Vendor or third-party onboarding, where companies assess the risks of working with an external party
- Fundraising rounds, where investors review a company's structure, financials, and governance before committing capital
The format and depth of the report will vary depending on the deal type and the level of risk involved. But the core purpose stays the same: give decision-makers a clear, honest picture of what they are walking into.
Who can provide a due diligence report?
Due diligence reports can be prepared by internal teams, external advisors, or a combination of both.
Internal compliance or legal teams are often responsible for coordinating the process. They define the scope, manage document requests, and often write the final report.
External advisors such as lawyers, auditors, and financial consultants are brought in when specialist knowledge is required. For example, a tax lawyer might review the entity structure in an M&A deal, or an environmental consultant might assess site conditions in a real estate transaction.
Third-party due diligence firms specialize in running these processes on behalf of clients. They handle everything from document collection to final reporting.
In all cases, the person or team writing the report must have access to the right documents, the authority to ask questions, and enough time to review the material properly. Cutting corners at this stage often creates problems later.
What should your report include?
The exact contents of a due diligence report depend on the deal type, but most reports cover the following areas:
1. Executive summary
A short overview of the findings, written for decision-makers who need the key points quickly. This should be honest and direct. If there are material issues, they belong here.
2. Scope and methodology
A description of what was reviewed, what was not reviewed, and how the review was conducted. This sets expectations and limits liability for the reporting party.
3. Corporate and legal review
Ownership structure, incorporation documents, registered charges, outstanding litigation, regulatory standing, and any significant legal agreements.
4. Financial review
Historical financial statements, tax compliance, outstanding liabilities, revenue trends, and working capital position. This section often draws on work done by accountants or auditors.
5. Operational review
Key contracts, supplier and customer relationships, staffing, systems, and anything that affects day-to-day operations.
6. Compliance and regulatory review
Licenses, permits, regulatory filings, and any known compliance gaps. This is where a compliance professional's expertise is most directly applied.
7. Risk summary
A consolidated view of identified risks, categorized by severity and likelihood. Many reports use a simple red, amber, green (RAG) rating system here.
8. Recommendations
Suggested next steps based on the findings. This could include conditions to be satisfied before closing, further investigations required, or risk mitigations to be put in place.
What should a due diligence report look like?
Structure matters as much as content. A well-organized report makes it easier for the reader to find what they need and reduces the chance of something important being missed.
Here are a few principles to follow:
Keep it readable. Long, dense paragraphs are hard to work through. Use clear headings, short sections, and plain language. If you need to use technical terms, explain them.
Be specific. Vague statements like "some risks were identified" are not helpful. Name the risk, explain what it means, and tell the reader what to do about it.
Use consistent formatting. A report that looks consistent signals professionalism and makes the material easier to follow. Use a clear heading hierarchy, consistent table formats, and a numbered section structure.
Include a document index. List the documents you reviewed as part of the report. This supports transparency and helps anyone reviewing the work later understand what evidence underpins each finding.
Version control matters. Reports are often updated during the process as new information comes in. Make sure each version is clearly dated and labelled to avoid confusion.
Virtual data rooms: the backbone of due diligence
No matter how well-written your report is, the process behind it needs to work. Due diligence involves large volumes of sensitive documents, multiple reviewers, and tight timelines. Managing that with email threads and shared folders creates problems: version confusion, security gaps, and no clear record of who saw what.
A virtual data room (VDR) is purpose-built for exactly this. It gives you a secure, controlled environment where documents can be shared, reviewed, and tracked without the mess.
This is where Ellty comes in.
Ellty is a secure document sharing and analytics platform with full data room functionality. It is built for professionals who need to share sensitive documents in a controlled, trackable way, without the complexity or cost of legacy enterprise VDR platforms.
Here is what makes Ellty a strong fit for due diligence work:
Access controls. You decide who sees what. You can set granular permissions at the document or folder level, so each reviewer only accesses what they need. This is essential in multi-party deals where different advisors have different scopes.
NDA gating. Before any reviewer can access the data room, they can be required to accept a non-disclosure agreement inside the platform. This is built into the workflow, not bolted on as an afterthought.
Dynamic watermarking. Every document viewed in the platform can be watermarked with the viewer's details. This deters unauthorized sharing and makes it easy to identify the source if a document leaks.
Real-time activity tracking. You can see exactly who opened which documents, when, and for how long. This is valuable during due diligence because it tells you where reviewers are spending their time and what they might have questions about.
Full audit log. Every action in the data room is recorded. This creates a defensible record of the process, which matters in regulated deals or in any situation where the review might later be questioned.
Ellty pricing is flat and transparent. There are no per-user fees, no per-page charges, and no complex enterprise quotes. Plans start from $0/month for early-stage document tracking, with the Room plan at $149/month providing the full VDR feature set, including granular permissions, NDA gating, dynamic watermarking, and restricted visitor access. For heavier deals with multiple reviewer groups and up to 4,000 assets per data room, the Room Plus plan at $349/month gives you the additional control you need.
Whether you are running a small deal or managing a complex, multi-party transaction, Ellty gives you a professional data room without the overhead of an enterprise contract.
How to prepare your report in 5 steps
Step 1: Define the scope
Before you request a single document, agree on what the due diligence will and will not cover. A clearly defined scope protects you from scope creep and helps the target know exactly what to prepare. Document this in writing.
Step 2: Build your document request list
Create a structured list of everything you need. Group requests by category (legal, financial, compliance, operational) and assign them clearly. If you are using a data room, set up the folder structure now so documents are uploaded in an organized way from the start.
Step 3: Collect and organize the documents
As documents come in, review them for completeness and flag any gaps. Keep a running tracker of what has been received and what is outstanding. Do not wait until the end to discover that key documents are missing.
Step 4: Conduct the review
Work through the material systematically. Take notes as you go, flagging issues in real time rather than trying to reconstruct your thinking later. If advisors are involved, coordinate regularly to avoid duplicating work or missing handoffs.
Step 5: Write and finalize the report
Start with the executive summary last. Write the detailed sections first, then pull out the key points for the summary. Have the report reviewed by someone who was not involved in writing it, to catch gaps or unclear language. Once finalized, version it clearly and distribute it to the right people.
Can due diligence tools enhance your reporting?
The short answer is yes, significantly.
The right tools reduce manual work, improve accuracy, and make it easier to keep the process on track. Here is how they help across different parts of the workflow:
Document organization. A data room with a clear folder structure and upload controls ensures documents are filed correctly from the start, rather than scrambling to organize things at the end.
Collaboration. When multiple advisors are working in parallel, a shared platform keeps everyone aligned. Ellty activity tracking lets you see which sections are being reviewed and by whom, making it easier to manage the workload.
Security. Sharing sensitive documents by email is a real risk. A VDR with access controls, watermarking, and audit logs provides a level of security that email simply cannot.
Evidence trail. Your report is only as credible as the evidence behind it. A platform that logs every document access and every action creates a built-in evidence trail that supports your findings and protects you if the process is later reviewed.
Speed. When documents are organized, permissions are set correctly, and reviewers can access what they need without waiting for email attachments, the whole process moves faster. In time-sensitive deals, this matters a lot.
Using Ellty Standard plan at $69/month, you get unlimited documents, advanced analytics, and eSignatures - everything you need to run a professional document review for smaller deals. For full VDR functionality with NDA gating and dynamic watermarking, the Room plan at $149/month is built for exactly this kind of work.
Build a more effective due diligence program
One-off due diligence processes are fine for single deals. But if you are a compliance professional who runs these regularly, building a repeatable program pays off.
A good due diligence program includes:
Standard templates. A consistent report structure, a reusable document request list, and a standard scope definition that can be adapted for each engagement. This saves time and ensures nothing gets forgotten.
A defined workflow. Who coordinates the process, who conducts which parts of the review, and who signs off on the final report. Clear ownership makes the process faster and reduces errors.
Secure infrastructure. A data room solution that you know how to set up quickly, that is trusted by the parties you work with, and that gives you the audit trail you need. Ellty is built to be set up quickly without a long onboarding process, so you can run your first room in hours, not weeks.
Post-deal review. After each engagement, take stock of what worked and what did not. Where did documents come in late? Where was the report unclear? Build those lessons back into your templates and workflows.
The more structured and repeatable your program, the better your reports become, and the more trust you build with the clients, investors, and deal partners you work with.
FAQs
How long does a due diligence report take to produce?
It depends on the complexity of the deal and the volume of documents. A basic vendor due diligence report might take a few days. A full M&A due diligence process can take several weeks. Having a clear scope, organized document collection, and the right tools in place will significantly reduce the time required.
What is the difference between due diligence and a due diligence report?
Due diligence is the entire process of investigation and review. The due diligence report is the written output that summarizes what was found. The report is the deliverable; the process is what produces it.
Who should have access to the due diligence report?
Access should be limited to those who need it. In most deals, this includes senior decision-makers on both sides, key advisors, and potentially regulators or lenders. Use a data room with access controls to manage this carefully rather than distributing the report by email.
How should a due diligence report handle gaps in the documentation?
Gaps should be documented clearly in the report. If a document was requested but not provided, that should be noted, along with what was done about it and whether it affects the findings. Do not ignore gaps or paper over them.
Can a virtual data room replace a due diligence report?
No. A data room is where the underlying documents are stored and reviewed. The report is the analysis and synthesis of what those documents show. Both are necessary. The data room supports the process; the report communicates the findings.
What is NDA gating and why does it matter in due diligence?
NDA gating means that before a reviewer can access any documents in a data room, they are required to accept a non-disclosure agreement within the platform. This is important because it creates a legally recorded agreement before any sensitive information is shared, which protects the disclosing party.
Is Ellty suitable for regulated industries?
Yes. Ellty audit logs, access controls, and NDA gating are aligned with the kind of controlled document sharing that regulated industries require. The platform gives you a clear, time-stamped record of who accessed what, which supports compliance obligations in sectors like financial services, legal, and real estate.
Final thoughts
A good due diligence report is not just a formality. It is the foundation of an informed decision. Done well, it protects everyone involved: the buyer, the seller, the advisors, and the compliance professionals who stake their credibility on the quality of the work.
The process does not have to be chaotic. With a clear structure, a defined scope, reusable templates, and a secure data room that keeps everything organized and traceable, you can run due diligence that is both thorough and manageable.
Ellty is built for exactly this kind of work. Whether you are running your first data room or your fiftieth, the platform gives you the access controls, audit trails, and document management tools you need, at a price that makes sense without a complicated enterprise contract.
Ellty is a secure document sharing and analytics platform with full virtual data room functionality. Plans start from $0/month, with no per-user fees and no surprise charges.
