Corporate Finance & CFO
Due Diligence Red Flags: 50 Questions Investors Ask Finance Teams
A finance-led diligence checklist that tests whether reported numbers reconcile to legal and operating evidence.
Investor diligence is not a document-upload contest. It tests whether the company’s story is consistent: revenue with contracts and bank receipts, ownership with registers and filings, liabilities with tax and legal records, and forecasts with operating data. The fastest diligence comes from strong monthly records.
Reconcile
Investors compare decks, books, bank, tax, contracts, cap table and statutory filings.
Explain exceptions
A known issue with evidence and remediation is better than a hidden surprise.
Control access
Use a structured data room, request log and authorised answer owner.
No reconstruction
Do not create backdated approvals or unsupported documents to fill gaps.
1. The operating framework
| Area | Questions investors ask | Evidence |
|---|---|---|
| Corporate and cap table | Are all issuances, transfers, options and rights valid and reconciled? | Registers, certificates, PAS-3, agreements and fully diluted model. |
| Financial statements | Do audited numbers tie to management accounts and bank? | Audited accounts, TB, reconciliations and audit differences. |
| Revenue quality | Is revenue recurring, concentrated, disputed, refundable or dependent on acceptance? | Contracts, cohort data, invoices, collections and credit notes. |
| Tax and regulatory | Are GST, income tax, TDS, FEMA and labour positions supported? | Returns, reconciliations, notices and opinions. |
| Debt and commitments | What covenants, guarantees, security and off-balance obligations exist? | Facilities, charge records, guarantees and covenant file. |
| People/IP/data | Do employment, ESOP, IP assignment, POSH and data controls work? | Contracts, registers, policies and incident records. |
| Litigation and related parties | What disputes, founder dealings and contingent liabilities exist? | Legal register, Board approvals and ledger extracts. |
2. CFO playbook
- Build the data-room index from investor questions but source each answer from existing control evidence.
- Use a request log with owner, due date, version and approval.
- Reconcile deck KPIs to management accounts and explain non-GAAP definitions.
- Prepare a cap-table tie-out and exit waterfall before sharing headline ownership.
- Create a tax-notice and litigation schedule with amount, stage, counsel view and accounting treatment.
- Disclose related-party and founder transactions transparently with approval and commercial rationale.
- Maintain a red-flag remediation list; never backdate or fabricate evidence.
3. Practical example
The pitch deck says annual recurring revenue is ₹30 crore, audited revenue is ₹24 crore and invoices total ₹28 crore. These can all be legitimate, but the company must define ARR, bridge it to contracts, show billing and collection, and explain cancellations, implementation fees and foreign-exchange effects.
4. Common failure points
- Uploading inconsistent versions without a request log.
- Hiding small notices that reveal a systemic process failure.
- Treating a signed contract as evidence of revenue or cash.
- Sharing personal data without access controls and purpose limitation.
- Answering legal or tax questions orally without approved written position.
5. Evidence folder
- Data-room index and access log
- Request/response tracker
- Financial and KPI bridge
- Cap-table/register tie-out
- Tax, litigation and compliance schedules
- Material-contract summary
- Red-flag remediation tracker
50 investor diligence questions
- Can issued, paid-up and fully diluted capital be reconciled to statutory registers and filings?
- Are all share certificates or depository credits complete and properly stamped?
- Were rights issues, private placements, ESOPs and conversions completed through the correct route?
- Are investor rights in the cap-table model consistent with the Articles and shareholder agreement?
- Are beneficial-interest and significant-beneficial-ownership filings complete?
- Do audited financial statements reconcile to the final trial balance?
- What audit adjustments were passed or left unadjusted?
- Are all bank accounts, payment gateways and deposits included in the books?
- Are balance-sheet reconciliations current and independently reviewed?
- Is the accounting-software audit trail enabled and preserved?
- How is revenue recognised for each major product or contract type?
- Do contract value, invoicing, revenue and collection reconcile?
- What percentage of revenue comes from the top ten customers?
- How much receivable is overdue, disputed or subject to credit note?
- Are refunds, rebates, warranties and service credits adequately provided?
- Are GST returns reconciled to books, e-invoices and financial statements?
- Are TDS deductions, deposits and returns reconciled to expense ledgers?
- Are income-tax positions and carried-forward losses supported?
- What notices, audits, demands or refunds are open?
- Are related-party transactions approved, priced and disclosed?
- Are foreign investments supported by valuation, FC-GPR/FC-TRS and FLA reporting?
- Are overseas investments supported by Form FC, UIN, APR and repatriation evidence?
- Are export/import transactions closed in EDPMS/IDPMS?
- Are transfer-pricing agreements, studies and accountant reports complete?
- Are cross-border payments supported by withholding and FEMA documentation?
- What debt facilities, guarantees, letters of comfort and security exist?
- Are ROC charges complete and reconciled to lender records?
- Are financial and non-financial covenants currently met?
- Has any lender issued a reservation, default or recall notice?
- Are short-term borrowings being used for long-term purposes?
- Are employee offer letters, IP assignments and confidentiality obligations complete?
- Does the ESOP register reconcile to grants, vesting, exercises and payroll tax?
- Are PF, ESI, gratuity, bonus and state labour obligations current?
- Is the POSH Internal Committee correctly constituted and trained?
- Are employee exits, assets and system access closed promptly?
- Who owns core IP and were founder/contractor contributions assigned?
- What open-source or third-party licence obligations apply?
- What personal data is processed and under what contractual/security controls?
- What cyber incidents or material control failures have occurred?
- Are customer data and security commitments consistent with actual controls?
- What material contracts contain uncapped liability, indemnity or onerous SLA terms?
- Which contracts can terminate on change of control?
- Are auto-renewal and minimum-commitment obligations tracked?
- What litigation, arbitration, notices or threatened claims exist?
- Are provisions and contingent liabilities consistent with counsel’s assessment?
- What founder, director or employee related-party balances remain open?
- Are corporate-card and reimbursement exceptions resolved?
- What regulatory licences or sector approvals are essential to revenue?
- What assumptions drive the next 24-month forecast and cash runway?
- Which top five issues could delay closing, reduce valuation or require indemnity?
6. Finin2min takeaway
Design the evidence before the transaction.
Reliable compliance is the result of clear ownership, timely action, reconciled records and a documented escalation route—not a last-minute filing exercise.
Frequently Asked Questions
Should every issue be fixed before diligence? â–¼
Not always possible. Identify, quantify, disclose and remediate with a credible plan rather than hiding it.
Who should answer investor questions? â–¼
Assign one accountable owner per workstream and central quality control. Avoid conflicting founder, finance and counsel answers.
How much data should be shared? â–¼
Share what is necessary for the diligence stage under confidentiality and access controls; redact sensitive personal or customer data where appropriate.