Approach
The evidence standard behind every finding.
A diligence report is only useful if a deal team can see what was checked, how, and where the checking stopped.
Three methods
Read it, ask about it, run it.
- 01
Document review
Architecture papers, model cards, data-room material, contracts, and licences, read against what management has claimed.
- 02
Management interviews
Structured conversations with engineering and product leads, documented and reconciled to the evidence rather than taken at face value.
- 03
Lab testing
Where the agreed scope includes it, research-lab testing of data readiness, specific claims, and model performance at scale, on data you choose to share. It does not cover an application or production system the lab has no access to.
Evidence standard
What a finding must show.
- Each finding names the claim, the evidence observed, and where the evidence stops.
- Severity and confidence are stated in words, and they are kept separate: a high-severity finding can carry low confidence.
- Open questions are listed as open. They are never smoothed into a conclusion.
- Every recommended follow-up has a named owner.
Worked example
See the standard applied to one company, from both sides.
A buyer’s assessment and a seller’s preparation guide, each with a confidence rating on every section, a list of what was not tested, and open questions with owners.
Limitations
Stated up front.
- The security review is a posture review. It is not a penetration test or a compliance certification.
- Testing covers only what was authorized and provided. Anything outside it is reported as not tested.
- Findings support your decision. They do not guarantee a deal outcome.