Red Flag Report

What is a red flag report?

Red flag report (report on material risks) refers to a due diligence report that is limited to findings that matter for the decision on a transaction, the price or the drafting of the contract. Unremarkable matters are not described. The name comes from the image of a red warning flag that marks a finding requiring action. The red flag report is therefore not a separate type of review but above all a way of presenting its results concisely.

The report is usually prepared by the advisers of an investor or buyer, that is, by law firms, auditing firms and tax advisers, as part of due diligence. The addressees are the decision-making bodies on the buyer side, such as the investment committee of a venture capital investor (the body that decides on investments), the management of a strategic buyer or the financing banks. In funding rounds the format is widespread because it confines the review to what is material.

Two uses of the red flag report

Reporting format of a full review

Due diligence is often carried out in full, but the report is written in red flag format. The advisers review all agreed areas but report only on deviations above a materiality threshold. This threshold is set in the engagement, for example as an amount per individual risk or as a share of the valuation.

Preliminary short review

The term also refers to a shortened review carried out before the actual due diligence. It looks specifically for findings that argue against the transaction or change the valuation fundamentally. Only if it produces no such findings does the buyer commission the full review, with the corresponding adviser costs.

Structure of a red flag report and classification of findings

The report is compact, often a short memorandum or a tabular overview. It usually opens with a summary of the most serious findings. Each finding then follows the same pattern: facts, legal or economic assessment, estimated impact and recommended action. A three-level classification, often shown as a traffic light, is common:

• High priority (red): Findings that call the transaction into question in its planned form. Examples are missing rights to the core technology that cannot easily be obtained retrospectively, unclear ownership of shares in the company or signs of impending insolvency.
• Medium priority (yellow): Findings that must be remedied or contractually secured before closing, such as missing shareholder resolutions, undocumented promises of equity or deficiencies in data protection.
• Low priority (green): Findings that do not hold up closing but feed into the valuation, warranties or later planning, such as customer concentration or dependence on key persons.

The level describes urgency, not the size of the risk in euros. Even a low-priority finding can change the price, for example if a major customer may terminate after a sale.

Typical findings at technology companies

• Gaps in the chain of title to shares: An earlier transfer of shares was not notarised and is therefore invalid (Section 15(3) of the German Limited Liability Companies Act, GmbHG). A related finding: the list of shareholders (Gesellschafterliste) differs from the cap table, the internal overview of the ownership structure.
• Missing grant of rights: Software comes from freelancers or agencies that have not granted the company exclusive rights of use (IP assignment).
• Undocumented promises: Shares or virtual shares were promised to advisers or early employees by email or orally.
• Licence obligations: Components under copyleft licences are integrated into distributed products in such a way that obligations to disclose source code may arise (open source). Copyleft licences require the same licence terms for derived software.
• Change of control clauses: Material customers may terminate on a change of control (change of control). In a minority round this usually does not apply, but in a later sale it does.

Consequences for the contract and closing

Each finding is linked to a recommendation that is implemented in the contract negotiation. Remediable defects become closing conditions, such as the notarial repetition of an invalid share transfer. Quantifiable risks lead to indemnities, retentions or an adjustment of the valuation. Points that cannot be conclusively verified are covered by special warranties. What can only be remedied after closing is agreed as a time-limited obligation of the company, in funding rounds in some cases with a requirement to use part of the new funds for it.

Practical example: red flag report in a funding round

An investor is considering a stake in a software company with EUR 6 million in annual recurring revenue. After three weeks its law firm submits a red flag report with four findings:

• High priority: The transfer of 5% of the shares by a departed co-founder was agreed only in simple written form, without notarisation. It is invalid, and the list of shareholders is incorrect.
• Medium priority: The core product was programmed in the first two years by two freelance developers, and rights of use were never granted. Both can be reached and are willing to grant the rights retrospectively.
• Medium priority: An adviser was promised a 1% stake by email. Whether this gives rise to a claim is open.
• Low priority: The largest customer, with 25% of revenue, may terminate on a change of control. For the minority stake this is irrelevant, for a later sale it is not.

The first three findings become closing conditions. The co-founder cooperates in the notarial repetition of the assignment, and the developers grant the rights against a one-off payment. A final written agreement is concluded with the adviser. The fourth finding feeds into the investor's planning for the later exit. Closing is postponed by five weeks, the valuation remains unchanged.

Distinction: red flag report, due diligence report and legal opinion

• Full due diligence report: describes all matters reviewed, including unremarkable ones. It serves as a reference work, the red flag report as a basis for decisions.
• Vendor due diligence: commissioned by the seller and intended to be passed on to bidders. A buyer-side red flag report remains internal.
• Legal opinion: confirms to a recipient individual legal questions such as the existence and power of representation of a company. The red flag report, by contrast, assesses risks.
• Financial health check: internal review of the financial position and the finance function, commissioned by the management. It also assesses the quality of accounting, reporting and planning, whereas the red flag report covers only risks for a specific transaction.

Common mistakes

• Disputing findings instead of resolving them. The other side expects no justification but a plan with an action and a date. Anyone who plays down a finding prolongs the review.
• New risks during the review. Material contracts, separations from key persons or new promises made without coordination with the investor create further findings.
• Chain of title to shares not checked by the company itself. Formal defects in earlier share transfers are among the most protracted findings because everyone involved at the time has to cooperate.
• No materiality threshold in the engagement. Without a clear threshold the report grows in breadth and loses its function as a basis for decisions.
• Measures without an owner. Findings that are to be dealt with after closing need a responsible person and a deadline, otherwise they remain open.

Frequently asked questions

Does the target company get to see the red flag report?

As a rule, no. The report is an internal work product of the advisers for their client. The company recognises its focal points from targeted follow-up questions and from the demands in the draft contract.

How long does a red flag review take?

As a preliminary short review, usually a few days to a few weeks, depending on the scope and quality of the documents. If the report serves as the format of a full due diligence, the duration depends on its scope.

Does a finding of the highest level necessarily lead to the deal being abandoned?

No. It depends on whether it can be remedied or contractually secured before closing. An invalid share transfer can, for example, be remedied by a notarial repetition, provided the parties involved at the time cooperate.

What does a template for a red flag report look like?

Often a table with one row per finding and columns for facts, assessment, impact, action and traffic-light level. There is no binding model. Law firms and auditors work with their own templates.

Can a company commission a red flag report itself?

Yes. Sellers and companies ahead of a funding round often have their own law firm carry out a short review. Unlike a vendor due diligence, it is not intended for investors or buyers but serves the company's own preparation.

The Roemer Capital view

Roemer Capital goes through the topics that regularly appear in buyer-side red flag reports with the client's law firm before a funding round or a sale starts. These include reconciling the list of shareholders with the cap table, the rights to the software, the written basis of all promises of equity and change of control clauses in the largest customer contracts. The legal assessment rests with the law firm. Roemer Capital builds the remediation into the timetable.

Points that cannot be remedied in time are prepared for the data room with facts, impact and a proposed solution before the review begins. For measures that can only be completed after closing, Roemer Capital names a responsible person and a deadline so that they appear in the contract as a solvable task and not as an open risk.