Business and Investment Research
Due Diligence Research Workflow: Build a Cited Evidence Base From Multiple Sources
A repeatable due diligence research workflow for defining scope, collecting and rating evidence, tracking contradictions, and producing a defensible cited conclusion.
A good due diligence research workflow does not start with “collect everything.” It starts with the decision being made, turns that decision into answerable questions, builds a planned source set, records evidence at the claim level, resolves contradictions, and ends with a cited conclusion that a reviewer can audit.
The output is not a folder full of PDFs or a polished but uncited memo. It is an evidence base: what is known, how confidently it is known, which sources support it, what conflicts with it, what remains missing, and which decision or risk each finding affects.
Updated November 9, 2026.
What a defensible due diligence research workflow should produce
Due diligence is a structured investigation before a decision: acquisition, investment, vendor approval, financing, litigation strategy, partnership, hiring, licensing, compliance review, or counterparty assessment. In an acquisition context, Yale’s search fund diligence note describes it as evaluating the target company in granular detail to understand whether the business is what the buyer believes it is: Yale School of Management.
A defensible research process should produce four things:
A question register that defines what the diligence must answer and why each question matters.
A source inventory that shows which primary and secondary sources were collected, requested, unavailable, or excluded.
An evidence record that links each material finding to exact pages, passages, tables, timestamps, or source-system exports.
A conclusion with limits that states confidence, unresolved conflicts, assumptions, and next actions.
The boundary matters. This workflow supports professional legal, financial, accounting, compliance, investment, and investigative judgment. It does not guarantee detection of fraud, undisclosed liabilities, related-party arrangements, or every material risk.
1. Define the diligence questions, scope, and decision criteria
Start by translating the assignment into specific questions. “Review this company” is not a research scope. “Can we rely on the reported recurring revenue for valuation?” is a diligence question. So is “Are key contracts assignable on change of control?” or “Does the counterparty have regulatory exposure in the jurisdictions where we operate?”
Define the frame before collecting documents:
Entity scope: parent company, subsidiaries, affiliates, funds, operating units, founders, executives, beneficial owners, counterparties.
Time period: trailing twelve months, audited periods, post-close period, period since a regulatory event, period covered by a contract.
Jurisdictions: incorporation, tax residence, operating markets, data-processing locations, litigation venues, licensing regimes.
Transaction boundaries: asset purchase, share purchase, minority investment, vendor onboarding, financing, partnership, licensing.
Materiality threshold: what level of variance, liability, contract exposure, customer concentration, or compliance issue changes the decision.
Confidentiality rules: restricted documents, clean-team materials, personal data, privileged information, export-controlled material.
Deadline and escalation path: when the answer is due, who owns it, and what triggers specialist review.
Build a question register. For each question, record:
The question.
The decision it informs.
Evidence needed to answer it.
Source categories expected.
Owner.
Due date.
Status.
Escalation trigger.
Current answer, if any.
Confidence level.
Keep facts, assumptions, hypotheses, and exclusions separate. A working assumption such as “customer churn is stable” should not become a conclusion unless the evidence record supports it. A hypothesis such as “reported growth may be driven by price increases rather than volume” should be tested against invoices, cohort data, customer interviews, management commentary, and market evidence where available.
For financial diligence, an AI-assisted financial analysis workflow can help organize filings, statements, decks, and supporting documents. The judgment still comes from the evidence standard you set at the start.
2. Build a source plan across the major diligence categories
A source plan prevents two common failures: collecting whatever is easiest to obtain, and over-weighting the first coherent narrative. The source plan should connect each diligence question to the evidence categories most likely to answer it.
Cover the major categories.
Financial evidence
Use filings, audited financial statements, management accounts, budgets, board packs, debt documents, cap tables, revenue schedules, tax records, trial balances, working-capital schedules, and transaction materials. For market-facing companies, compare management metrics with public disclosures and investor materials.
Legal and regulatory evidence
Use contracts, licenses, permits, litigation records, IP records, regulatory notices, compliance policies, privacy documentation, employment agreements, lease documents, sanctions or watchlist checks where appropriate, and correspondence with regulators. For legal research, secondary sources can help orient the search, but primary authority and primary records carry the weight. The Library of Congress describes legal secondary resources as tools for analysis and for locating primary law: Library of Congress legal secondary resources guide.
Company and management evidence
Use investor presentations, strategy documents, product materials, organizational charts, policies, committee materials, board minutes where available, management interviews, employee materials, and internal performance reports. Treat management narratives as evidence of what management says, not proof that the underlying condition exists.
Market and customer evidence
Use industry reports, customer references, procurement data, renewal information, product reviews, pricing evidence, competitor materials, win-loss notes, channel checks, user interviews, and public customer commentary. Distinguish broad market trends from evidence about the specific company, product, geography, or segment.
Operational and technical evidence
Use system exports, product analytics, security materials, data-flow maps, vendor lists, uptime records, engineering documentation, manufacturing records, service-level reports, and process documentation. If the diligence concerns software, data, infrastructure, quality systems, or supply chain resilience, source-system evidence often matters more than management summaries.
News, expert, and industry sources
Use news, analyst commentary, expert interviews, industry podcasts, conference talks, videos, transcripts, trade publications, and specialist databases as context and leads. They can surface events, reputational risks, market claims, and inconsistencies. They should not substitute for primary evidence when the finding is material.
For every category, define the expected primary sources, useful secondary sources, date range, access method, owner, and question served. If a source is unavailable, record that fact early. Missing evidence is not an administrative issue; it may change what can be concluded.
3. Collect primary evidence first, then use secondary sources strategically
Primary evidence is closest to the event, obligation, transaction, statement, or record being evaluated. In due diligence, primary evidence often includes signed agreements, original filings, audited statements, regulator records, official registers, source-system exports, invoices, board minutes, direct interviews, and company disclosures.
Secondary sources explain, interpret, summarize, report, or point toward primary evidence. They are useful, especially at the start of unfamiliar legal, market, or technical terrain. The University of Arizona’s legal research text describes secondary sources as a “map of the legal landscape”: University of Arizona Open Textbook.
Use that map, but do not confuse the map with the territory.
A practical collection rule:
Use primary sources to support material findings.
Use secondary sources to generate leads, frame the issue, locate primary records, and identify inconsistencies.
Trace material secondary-source claims back to the underlying document, direct quote, dataset, interview, filing, or record before relying on them.
Capture metadata at intake:
Original file name or URL.
Source title or identifier.
Issuing body or author.
Publication date or effective date.
Access date.
Version.
Page, section, exhibit, table, or timestamp.
Restrictions on access, confidentiality, privilege, or reuse.
Source type: primary, secondary, management assertion, expert opinion, media report, customer comment, system export, legal record, financial record.
Preserve the evidence in its original form where practical. A summary without the underlying source weakens later review. That applies to PDFs, web pages, spreadsheets, contracts, transcripts, audio, video, screenshots, and exported data.
Also preserve context. A clause extracted from a contract may change meaning when read beside definitions, schedules, termination provisions, governing law, assignment restrictions, and amendments. A revenue number may change meaning depending on whether it is gross or net, booked or billed, recognized or collected, recurring or one-time.
4. Create an evidence record for every material finding
A due diligence memo is only as strong as the evidence record behind it. The record should sit between the raw corpus and the final conclusion. It prevents the team from relying on memory, broad summaries, or unsupported impressions.
For each material finding, record:
Claim: the specific finding being supported.
Source title or identifier: the document, file, interview, register, transcript, or dataset.
Publication, effective, or access date: whichever is relevant.
Exact location: page, clause, table, exhibit, section, row, timestamp, or passage.
Source type: primary record, audited financials, management assertion, regulatory record, media report, expert interview, customer reference, system export.
Confidence level: high, medium, low, or a defined numeric scale if your team uses one.
Corroborating evidence: other sources that support the same claim.
Conflicting evidence: sources that contradict or complicate it.
Scope of claim: entity, subsidiary, product, geography, reporting period, customer segment, contract, or jurisdiction.
Decision or risk affected: valuation, closing condition, indemnity, regulatory approval, pricing, covenant, integration, reputational exposure, go/no-go decision.
Distinguish the type of statement:
Documented fact: directly supported by the source.
Inference: derived from multiple pieces of evidence.
Estimate: calculated from incomplete or approximate inputs.
Interpretation: reasoned reading of a document, event, or pattern.
Management assertion: stated by the company or its representatives.
Expert opinion: stated by a specialist, analyst, lawyer, accountant, engineer, investigator, or market participant.
Unresolved hypothesis: plausible but not yet supported enough to conclude.
Rate source quality with reasons, not just labels. Useful criteria include:
Provenance: where did the source come from?
Independence: is the source independent of the subject?
Recency: does the date match the question?
Relevance: does it address the exact entity, period, jurisdiction, and issue?
Completeness: is it full, partial, amended, excerpted, or missing schedules?
Potential bias: does the source have a promotional, adversarial, anonymous, negotiated, or self-interested character?
Verifiability: can the claim be traced to an original record or corroborated elsewhere?
Scope control is critical. Evidence that supports “Subsidiary A had no recorded litigation in Jurisdiction X during 2024–2026” does not support “the group has no litigation risk.” Evidence that supports one customer cohort does not automatically support the entire revenue base.
Use claim-level citations in drafts. A reviewer should be able to move from a conclusion to the exact page or passage without searching a folder. For a deeper note-taking pattern, see how to take notes from multiple sources without losing citations.
5. Analyze the corpus by claims, themes, and risk—not document by document
A document-by-document summary feels orderly, but it usually fails at diligence. The real question is not “what does each document say?” It is “what does the evidence base support about the decision?”
Organize analysis around questions and risks:
Revenue quality.
Customer concentration.
Contract assignability.
Change-of-control restrictions.
Regulatory exposure.
Debt obligations.
Tax risk.
IP ownership.
Data privacy obligations.
Litigation history.
Management credibility.
Market growth.
Product dependency.
Supplier concentration.
Operational resilience.
Reputational risk.
Then compare evidence across categories. If management says churn is low, check customer schedules, cohort analyses, renewal data, invoices, CRM exports, customer interviews, support logs, and public reviews. If a company claims defensible IP, check assignments, employment agreements, patent records, contractor agreements, open-source usage, litigation, and product documentation.
When analyzing figures, compare like with like:
Periods: month, quarter, fiscal year, trailing twelve months.
Definitions: revenue, ARR, bookings, billings, GMV, adjusted EBITDA, net retention.
Units: currency, customer count, seats, usage, geography, product line.
Basis: audited, unaudited, pro forma, management-adjusted, source-system export.
Timing: booked, billed, recognized, collected, deferred.
Many apparent contradictions are timing, scope, or definition issues. Some are not. The workflow should make both visible.
Look for patterns that are often material:
Concentration in customers, vendors, geographies, channels, executives, licenses, or systems.
Dependency on a founder, supplier, platform, regulator, reseller, or single customer.
Unusual adjustments that change the story materially.
Missing owners for obligations or risks.
Related-party relationships.
Contractual restrictions on assignment, termination, exclusivity, pricing, audit rights, data use, or non-competes.
Changes in policy, definitions, reporting periods, or organizational boundaries.
Gaps between public claims and internal records.
Interviews and expert sources are useful, but record their evidentiary status. Was the statement firsthand? Was it independently corroborated? Is it attributable? Can it be verified? Does the speaker have incentives that shape the answer?
Keep analysis separate from judgment. First state what the evidence supports. Then explain the implication, uncertainty, and decision relevance.
[[OTIO_INLINE_PROMO:%7B%22title%22%3A%22How%20will%20your%20sources%20support%20each%20risk%3F%22%2C%22description%22%3A%22Bring%20filings%2C%20contracts%2C%20transcripts%2C%20spreadsheets%2C%20and%20notes%20into%20one%20library%20to%20compare%20claims%2C%20locate%20cited%20passages%2C%20and%20surface%20gaps%20for%20review.%22%7D]]
6. Track contradictions, gaps, and escalation decisions explicitly
Contradictions are not housekeeping issues. They are often where the diligence value is.
Maintain a contradiction log with:
Disputed claim.
Sources in conflict.
Exact passages, pages, rows, clauses, or timestamps.
Possible explanations.
Materiality.
Current status.
Owner.
Next action.
Deadline.
Escalation trigger.
Classify discrepancies:
Resolved: additional evidence explains the conflict.
Explained by scope: sources refer to different entities, geographies, products, customers, or legal obligations.
Explained by timing: sources refer to different periods, versions, or cut-off dates.
Unresolved but immaterial: not likely to affect the decision under the defined threshold.
Unresolved and material: affects valuation, risk allocation, closing, approval, compliance, or go/no-go.
Requires specialist review: legal, accounting, tax, regulatory, technical, cyber, clinical, environmental, investigative, or other expert judgment is needed.
Maintain a separate gap log. It should include missing documents, unavailable periods, unanswered questions, inaccessible registers, incomplete schedules, unverified assumptions, and evidence that would materially change the conclusion if obtained.
Common gap examples:
Contract schedules referenced but not provided.
Amendments missing from a “final” agreement set.
Management accounts provided without source-system support.
Customer churn analysis missing a definition.
Litigation search performed for one entity but not subsidiaries.
Regulatory review limited to one jurisdiction.
Interview claims not corroborated by documents.
Data exports provided without field definitions.
Financial figures inconsistent across decks, filings, and accounts.
Define escalation criteria before final write-up. For example:
A material unexplained variance between reported revenue and supporting schedules.
An adverse litigation, regulatory, or sanctions-related record.
A missing contract that governs a key customer or supplier.
A source conflict affecting the investment thesis.
A privacy, employment, tax, or licensing issue outside the reviewer’s expertise.
A management assertion contradicted by primary evidence.
An unavailable document that prevents a conclusion.
Do not force consensus between sources. Preserve the disagreement. Explain which evidence is stronger, why it is stronger, and what additional work would reduce uncertainty.
Silence is not proof. A clean search result means the defined scope produced no identified issue. It does not mean every possible issue has been eliminated.
7. Draft a cited conclusion with limitations and next actions
The final report should be structured around the decision, not around the order in which documents were reviewed.
A useful structure:
Scope and methodology: what was reviewed, what was requested, what was excluded, date range, jurisdictions, entities, source types, and cut-off date.
Executive findings: the main conclusions relevant to the decision.
Material risks: ranked by significance, likelihood, evidence strength, and decision impact.
Supporting evidence: claim-level citations to exact passages.
Contrary evidence: conflicts, adverse evidence, and unresolved inconsistencies.
Assumptions: what the conclusion depends on.
Limitations: missing documents, inaccessible records, excluded entities, time limits, reliance on management-provided information, specialist areas not reviewed.
Recommended next actions: document requests, follow-up questions, expert review, validation work, monitoring, negotiation points, revised pricing, warranties, indemnities, conditions, or acceptance of residual uncertainty.
Give each significant conclusion a confidence level. Do not bury contrary evidence in an appendix if it affects the decision.
For example:
High confidence: supported by multiple primary sources with consistent scope and dates.
Medium confidence: supported by credible evidence but with one unresolved limitation or partial corroboration.
Low confidence: based on incomplete, dated, management-provided, or uncorroborated evidence.
No conclusion: evidence is missing or contradictory in a way that prevents a defensible finding.
Separate findings from recommendations. Research can show that evidence is inconsistent, incomplete, or adverse. The legal, accounting, investment, compliance, or transaction decision may require a separate professional judgment.
Citations matter especially when AI tools have touched the workflow. Wiley’s guidance for research authors states that citations should directly support the specific claims being made and that cited sources should be confirmed against the arguments attributed to them: Wiley AI guidelines. The same discipline applies to diligence work.
End with an action register:
Request the missing schedule.
Ask management to reconcile figures.
Obtain specialist review.
Validate a contract interpretation.
Interview a customer or former employee.
Check a regulatory register.
Re-run a search for subsidiaries or prior names.
Monitor a post-cut-off event.
Accept the residual uncertainty and document why.
For a broader reporting pattern, see how to create a source-linked research brief from mixed documents.
How a permanent multi-source workspace can support the process
Due diligence breaks down when evidence is scattered across browser tabs, local folders, virtual data rooms, email attachments, chat threads, note apps, and one-off AI conversations. A permanent multi-source workspace helps after discovery: it gives the team a project library where sources, notes, citations, and working analysis stay together.
Otio fits that role as a research workspace for multi-source projects. Use it to bring PDFs, web pages, contracts, CSVs, transcripts, videos, audio, and notes into one project library, then organize them by entity, diligence question, risk category, or source type.
A practical setup:
Create a dedicated space for the diligence project. Separate the transaction, counterparty, or investigation from other work.
Add the source inventory first. Include requested, received, unavailable, and excluded materials.
Create folders or tags by question and source category. For example: financials, contracts, regulatory, customers, management, market, interviews, open items.
Store the original source alongside notes. Do not let summaries replace the evidence.
Ask cited questions across the collected material. Use them to locate passages, compare claims, extract figures, and identify gaps.
Verify every important answer against the source. Agreement from an AI system is not independent corroboration.
Move useful passages into structured evidence notes. Keep claim, citation, confidence, conflict, and decision impact together.
For long PDF-heavy reviews, Otio’s AI PDF reader can help with page-level questioning, source navigation, and citation support. For ambiguous or high-stakes interpretation, use multiple AI models to compare reasoning or retry an analysis, but treat model disagreement as a signal to inspect the source, not as a vote.
For legal-heavy diligence, pair workspace review with appropriate legal methods and professional judgment; Otio’s AI for legal research use case is relevant when the source set includes cases, statutes, contracts, filings, or regulatory materials. In regulated or specialist matters, involve the qualified reviewer.
The practical next action: build your due diligence evidence base in Otio by bringing your source documents, web pages, transcripts, spreadsheets, and notes into one cited research workspace.
FAQ
Q: What is the first step in a due diligence research process?
A: Start by defining the decision, scope, entities, time period, jurisdictions, materiality thresholds, and specific questions the research must answer. This prevents uncontrolled document collection and makes gaps measurable.
Q: What should be included in a due diligence evidence record?
A: Record the claim, source, publication or access date, exact page, passage, or timestamp, confidence level, corroborating and conflicting evidence, and the decision or risk affected. Also distinguish fact, inference, assertion, and unresolved hypothesis.
Q: How should contradictions between due diligence sources be handled?
A: Log each conflict with the exact passages, possible explanations, materiality, owner, and next action. Resolve it through scope, timing, definition, or additional evidence where possible; otherwise preserve the uncertainty and escalate material conflicts.
Q: Can AI complete due diligence research without human review?
A: No. AI can help organize mixed sources, locate passages, compare claims, and produce cited working answers, but important findings must be checked against original documents and reviewed with appropriate legal, financial, accounting, compliance, investment, or investigative judgment.
[[OTIO_FOOTER_PROMO:%7B%22title%22%3A%22Apply%20this%20workflow%20to%20your%20source%20set%22%2C%22description%22%3A%22Add%20your%20own%20due%20diligence%20materials%20to%20a%20cited%20workspace%2C%20then%20test%20findings%20against%20original%20documents%20before%20drawing%20conclusions.%22%7D]]
