What Red Flags Do Institutional Investors Look for in Due Diligence?

Institutional investors do not simply ask whether a company has uploaded the right documents. They test whether revenue connects to real activity, whether cash can be confirmed, whether ownership is clear and whether the people running the business understand their risks. The recurring warning sign, from GoMechanic to FTX, is contradiction rather than paperwork.

GoMechanic was raising what was reported as a $75 million to $80 million SoftBank-led round when the story changed.

The Gurugram vehicle-servicing startup had expanded to more than 1,000 service centres. Growth at that scale makes a powerful fundraising slide. Yet EY’s diligence found accounting irregularities. On 18 January 2023, investors said the founders had knowingly misstated facts, including inflated revenue. Co-founder Amit Bhasin acknowledged “grave errors” in financial reporting. The round collapsed. GoMechanic then announced layoffs affecting roughly 70% of its staff.

Reports said questionable activity involved about 60 service centres. The important detail was not the number of folders in the company’s data room. It was that prospective investors tested reported revenue against activity at individual locations.

That is where most people stop looking. They assume due diligence means assembling incorporation papers, audited accounts and contracts. It does include those things. But the real question is harder: can the company prove that its important claims are true?

GoMechanic showed why investors test reported growth against activity at individual operating locations. Photo: PRABHAKAR SALAVE / Pexels, Pexels licence (free commercial use).

The missing file is not always the problem

Think of an investor inspecting a house. A missing light bulb is irritating, but fixable. Damp behind a freshly painted wall is different. The damp matters because it suggests the visible surface is concealing a deeper failure.

Gunderson Dettmer, the law firm, draws a useful line between deal-stoppers and problems that can be cured before or after closing. Insufficient insurance, for example, may be a weakness that a legitimate company can remedy. Revenue that does not tie back to customers, cash or operating activity is a different category.

This is an important test of the Trace-Back Test later in this article. Imagine a legitimate early-stage company whose insurance cover is insufficient. The claim is not “we have perfect insurance”. It is “we have identified the gap, assigned an owner, obtained the required cover and can show the policy.” The trail works. The weakness is real, but manageable.

Now compare that with GoMechanic. If reported revenue cannot be traced to the underlying service centres, no additional folder fixes the underlying problem.

Cooley GO’s venture-capital request list covers corporate approvals, ownership, litigation, intellectual property, employees, debt, material contracts, financial statements and environmental liabilities. Modern technology transactions can add commercial data, tax, HR, cybersecurity, privacy and technical architecture.

That sounds like administration. It is actually an investigative map.

A data room, the secure collection of documents shared with investors, can make the process easier. It cannot turn unreliable source data into reliable source data.

KPMG’s 2024 technology-deal survey puts this in fundraising terms. When an investor is deciding whether a startup’s growth can support a valuation and survive after the money arrives, unreliable financial and operating data can stop that decision cold. Accuracy and completeness of that data ranked among the top two diligence challenges for 25% of corporate buyers and 19% of private-equity respondents. For private-equity respondents, platform scalability ranked first for 21%. Privacy and cybersecurity led for 16% of corporate buyers.

The paperwork is not the point. The pressure points are.

Why the money asks awkward questions

Institutional investors are often investing money entrusted to them by clients or limited partners. That changes the psychology of the process.

A founder can see a diligence request as an accusation: why do they not believe us? An investment committee sees it differently. If a claimed cash balance disappears, if customer activity was overstated or if a regulated business has weak safeguards, the loss is not merely financial. It can damage the institution’s standing with the people whose capital it manages.

The NBER survey of 885 institutional venture capital investors adds a useful complication. More than 55% regarded the team as the most important investment factor. Investors are not choosing spreadsheets over people. They are asking whether the people can build an organisation whose numbers and controls deserve belief.

So they seek a record they can defend. They need to show why they believed the numbers, what they checked and where the remaining risks sat when they made the decision.

The cash that reports could not settle

Abraaj Group, the Dubai-based investment manager, managed more than $13 billion and raised an $850 million emerging-markets healthcare fund. It had the institutional status that many investors take as reassurance.

Then limited partners asked for evidence of where their capital was held. They hired an outside consultant rather than accepting manager reports alone.

The US Securities and Exchange Commission alleged in an amended complaint dated 16 August 2019 that Abraaj Investment Management and founder Arif Naqvi transferred at least $230 million from the healthcare fund to group companies, commingled the money and used it for unrelated expenses. Abraaj entered liquidation in June 2018.

The lesson is not that audited reporting has no value. It plainly has value. But an audit is evidence, not a substitute for tracing cash directly. For a fund or financial business, investors may need confirmation from third parties of bank accounts, beneficial ownership, capital calls and related-party transfers.

Put GoMechanic and Abraaj side by side and a pattern appears that neither case states outright. One business had a question over revenue at individual service centres. The other had a question over where investor capital was held. Different markets. Different sectors. Same investigative move: follow the headline claim back to the underlying record.

When reputation became the answer

Wirecard, the German payments company, made the next mistake look more sophisticated.

SoftBank agreed in April 2019 to a €900 million convertible-bond investment in Wirecard while the company faced public allegations about its Asian operations. In June 2020, Wirecard said that €1.9 billion in purported trust-account cash probably did not exist. It filed for insolvency on 25 June.

The subsequent reviews matter because they show this was not merely a company-level embarrassment. ESMA’s November 2020 review identified deficiencies in Germany’s financial-reporting supervision. In its follow-up of 18 July 2024, ESMA said Germany had replaced the two-tier enforcement system and strengthened BaFin’s powers and independence.

Here is the twist: a regulated, listed company can create more false comfort than a young startup. A startup expects to be examined. A familiar name with formal assurance can tempt people to stop examining too soon.

Wirecard showed that external assurance cannot settle contradictions over cash and counterparties. Photo: Leo Molatore / Wikimedia Commons, CC BY-SA 2.0.

When whistleblowers, counterparties and reported economics point in different directions, reputation is not the answer. It is another thing to test.

Scale is not a control system

FTX handled as many as 26 million transactions a day, operated across 250 jurisdictions and controlled tens of billions of dollars. Those figures suggest a formidable operating machine.

Its 9 April 2023 bankruptcy report described something else. Critical entities lacked CFO, risk, internal-audit and treasury functions. Fifty-six entities produced no financial statements. Thirty-five used QuickBooks. Approximately 80,000 transactions sat in “Ask My Accountant” accounts. Alameda secretly had a $65 billion borrowing limit on FTX.com.

The company had scale. It did not have an operating institution proportionate to its custody risk.

Sophisticated technology does not demonstrate sophisticated financial operations. For a company holding or moving customer assets, investors need evidence of segregation of duties, meaning no individual controls an entire sensitive process alone, as well as access controls, treasury reporting and independent oversight.

The question is not whether management promises these systems will exist after funding. It is whether they can demonstrate what exists now.

The Ghana warning, with an important limit

Dash, the African payments startup, raised $86.1 million in five years. Its board placed founder and CEO Prince Boakye Boampong on indefinite administrative leave on 24 January 2023 pending a forensic financial audit. Dash shut down in October 2023.

TechCabal reported allegations of fabricated transaction and user figures and an unaccounted-for shortfall. But the audit findings were never publicly released. That means the public record does not establish causation or responsibility, and pretending otherwise would be precisely the kind of careless leap this article warns against.

Still, the case presents the right question for a payments business. Is high transaction volume verified revenue, verified liquidity and verified customer activity? Or is it simply a management dashboard figure? Processor records, bank balances, customer wallets and accounting entries should reconcile.

In India, investors checked service-centre activity. In the UAE, limited partners sought direct evidence of cash. In Germany, reported trust-account cash became the question. In Ghana, the unresolved issue was whether claimed activity could be independently reconciled. The countries change. The investigative instinct does not.

Build the evidence trail before the term sheet

Uncomplicated early-stage financings can take roughly three to four weeks at the fast end, or six to seven weeks on an extended timetable, after a term sheet is signed, according to Gunderson Dettmer. Complexity, rather than data-room size alone, extends the process.

A term sheet is not a release of funds. As the risk of signed documents not releasing funds makes clear, the evidence can still change the decision.

Founders need a practical operating routine, not a last-minute document chase. For every material claim, create an evidence register with five fields:

1. 1.The claim: revenue, cash, active customers, ownership, intellectual property, licences, contracts, employees or liabilities.
2. 2.The evidence owner: name the person accountable for producing and explaining the original record.
3. 3.The refresh date: record when the evidence was last updated and when it must next be refreshed.
4. 4.The independent reconciliation: identify the second record or outside party that tests the claim. Revenue might be checked against customer contracts and cash receipts. Cash might be checked against bank confirmation and accounting records.
5. 5.The unresolved issue: state the weakness, the remedy, the responsible owner and the expected completion date.

The interesting part is that this checklist is not only for investors. It tells a founder where the business is fragile before an outsider discovers it. As reported ARR becomes a bankability question, the supporting trail matters as much as the headline number.

Do not bury a weakness. Explain it. A disclosed insurance gap with a credible remedy is different from a contradiction uncovered by someone else.

GI Network’s view: A company is better prepared for scrutiny when management can show what is verified, what is curable and what still needs an investor’s attention, without confusing a tidy folder with a proven business.

Where a company asks GI Network to review its readiness, the practical work is to test the investment narrative against underlying records before outreach: identify claims that lack support, expose inconsistencies between operating and financial information, assign evidence owners and reconciliation steps, and prepare management for the objections an investment committee is likely to raise. The aim is not to make risk disappear. It is to make the risk legible before it becomes a surprise.

Use the Trace-Back Test

The cases in India, Ghana, the UAE, Germany and the Bahamas produce one usable rule: every important claim should survive a journey back to its source.

Call it the Trace-Back Test.

1. 1.Name the claim. What exactly is driving the investment case: revenue, cash, customer activity, intellectual property or a licence?
2. 2.Find the source. Which original record supports it: an outlet transaction, contract, bank account, processor record or ownership document?
3. 3.Confirm it independently. Can the claim be checked against a third party or another record that management does not control?
4. 4.Locate the control. Who owns the process, when was it last refreshed, and what stops the claim becoming wrong tomorrow?

A clean trail does not mean a company has no weaknesses. The insurance example shows the opposite. A healthy business can have a visible, owned and fixable weakness. What investors cannot underwrite is a claim that breaks when they trace it backwards.

If the answer breaks at any point, do not merely request another file. Ask why the trail broke.

That is the red flag investors are really looking for.