How to write an OSINT due diligence report (structure, sourcing and a template)

Short answer: a good OSINT due diligence report leads with the conclusion, separates what was found from what it means, and ties every finding to a dated, archived source with a reliability grade. Use this order: summary of findings, scope and method, subject profile, findings by theme (identity, corporate links, litigation and regulatory, sanctions and adverse media, online footprint), open questions, and an appendix of sources.

Most due diligence reports are read by someone who has five minutes and a decision to make: an investor, a lawyer, a compliance officer. They are also, occasionally, read line by line by someone trying to prove you wrong. The structure below is built for both readers.

#What a due diligence report has to do

A report succeeds when a reader can answer three questions without calling you:

1. What did you find? Stated plainly, most important first.
2. How sure are you? Each finding carries its evidence and how far that evidence can be trusted.
3. What didn't you check? Scope limits and open questions are part of the result, not an embarrassment to hide.

Everything else (methodology, screenshots, raw search logs) exists to support those three answers.

#The structure

#1. Summary of findings

Half a page at most. Lead with risk-relevant findings, each one sentence with a confidence word ("confirmed", "likely", "unverified") and a pointer to the section with the detail. If nothing adverse was found, say so explicitly and say what that covers: "No adverse media found in English-language national and regional press, 2010 to present" is a finding; "nothing found" is not.

#2. Scope and method

• Subject as instructed: full name, known aliases, date of birth or company number, jurisdictions.
• Question asked by the client, in their words.
• Sources searched: corporate registries, court records, sanctions and PEP lists, news archives, social platforms, domain records, the web archive.
• Period and languages covered.
• Limits: what you did not or could not search (paid databases, non-public records, other languages), and the date of the last search.

This section is what makes a "nothing found" result defensible.

#3. Subject profile

The identity you established and how. If the subject has a common name, show how you tied records to this person: matching date of birth, address history, a company registration that lists the same middle name. Mis-identification is the most damaging error in due diligence, and the profile section is where you prove you avoided it.

#4. Findings by theme

Group findings by what the reader cares about, not by the order you searched:

• Corporate interests: directorships, shareholdings, beneficial ownership, dissolved companies and why they were dissolved.
• Litigation and regulatory: civil and criminal cases, regulatory actions, bankruptcies, professional discipline.
• Sanctions, PEP and watchlists: what was screened, against which lists, on which date.
• Adverse media: what was reported, by whom, and whether it was later corrected or contradicted.
• Online footprint: domains, social accounts and what they show, with archived copies.

For each finding: one paragraph on what the source says, then a line on what it means for the client's question.

#5. Open questions and recommendations

Things that need a records request, a site visit, an interview or a paid database. Clients often value this section most, because it tells them where the remaining risk sits.

#6. Appendix: sources

Every source, numbered, with the URL, the date you accessed it, an archived copy, and its reliability grade.

#Cite and grade every source

Two disciplines separate a report that survives scrutiny from one that doesn't.

Archive at the time you look. Pages change and disappear, especially once a subject learns they are being looked at. Save each page to the Wayback Machine (or another archive) when you use it, record the archived URL, and keep your own copy or screenshot with the capture date.

Grade the source separately from the information. The widely used Admiralty (NATO) system grades source reliability from A (completely reliable) to F (cannot be judged), and the information itself from 1 (confirmed by other sources) to 6 (truth cannot be judged). A court judgment might be A1; an anonymous forum post repeating a rumour, E5 or F6. You don't have to use letters and numbers in a client report, but you should be able to say for every finding why you believe it.

Two practical rules follow:

• One source is a lead, two independent sources are a finding. "Independent" means one did not copy the other; three news sites rewriting the same wire story count once.
• Quote, don't paraphrase, anything contentious. If a court record says "the defendant admitted", quote it and cite the page.

#A copy-ready template

DUE DILIGENCE REPORT: [Subject]
Prepared for: [Client]        Reference: [Case no.]
Date of last search: [YYYY-MM-DD]        Analyst: [Name]

1. SUMMARY OF FINDINGS
   - [Finding] ([confirmed / likely / unverified]; see 4.x)
   - No [category] found in [sources], [period].

2. SCOPE AND METHOD
   Question: [as instructed]
   Sources searched: [list]
   Period / languages: [ ]
   Not searched / limits: [ ]

3. SUBJECT PROFILE
   Identity established from: [records that tie it together]
   Aliases / previous names: [ ]

4. FINDINGS
   4.1 Corporate interests
   4.2 Litigation and regulatory
   4.3 Sanctions, PEP and watchlists (lists, date screened)
   4.4 Adverse media
   4.5 Online footprint
   For each: what the source says [n] → what it means

5. OPEN QUESTIONS AND RECOMMENDED NEXT STEPS

APPENDIX A: SOURCES
   [n] Title, publisher, URL, accessed [date], archived [URL], grade [A–F/1–6]
APPENDIX B: TIMELINE OF KEY EVENTS

#Mistakes that undo good research

• Burying the conclusion under the method. Put method second.
• "Nothing found" without scope. Always say where you looked and when.
• Unarchived links. A dead link in a report is an unsupported claim.
• Screenshots without context. Every image needs the URL, capture date and what it shows.
• Mixing inference and fact. Keep "the registry lists X as director" separate from "X probably controls the company".
• Copying the subject's own claims (biography, LinkedIn, company website) as fact. Report them as claims, and check them.

#Building the report in DeepState

We built DeepState for exactly this workflow, because the slow part of due diligence is the reading and the copying between research and report.

• The research. Give the assistant the subject and the question. It searches corporate filings (SEC EDGAR), court records, sanctions lists, news, the Wayback Machine and social platforms, runs a username search across about 480 sites and, on Professional, a US public-records person search, and adds what it finds as linked people, companies and events, each citing its source.
• The identifiers. Right-click a domain, email or phone number for WHOIS, DNS, IP-owner and email checks, and see what several of them have in common.
• The evidence. Every node keeps its source and capture date; documents, posts, web pages and people (as sources) carry a credibility rating and verification status. Every page the assistant reads, every screenshot and every download is archived with its SHA-256 in a tamper-evident evidence log, and pages can also be saved to the Wayback Machine. Events land on a timeline with exact or approximate dates.
• The report. The dossier builder turns the nodes you select into a PDF with a sources appendix and an evidence-log appendix (each cited capture's time and SHA-256), following the structure above.

The judgement about what a finding means stays yours. Everything around it, the searching, the copying and the formatting, is what DeepState takes off your hands.

#Frequently asked questions

#What should an OSINT due diligence report include?

A summary of findings with confidence levels, the scope and method (sources searched, period, languages, limits), a subject profile showing how identity was established, findings grouped by theme (corporate, litigation and regulatory, sanctions and PEP, adverse media, online footprint), open questions, and an appendix listing every source with its access date, archived copy and reliability grade.

#How long should a due diligence report be?

As short as the question allows. A pre-engagement check on an individual is often three to six pages plus a source appendix; enhanced due diligence on a complex corporate structure can run to thirty. The summary should fit on one page either way.

#How do you grade sources in an OSINT report?

Many analysts use the Admiralty (NATO) system: source reliability from A (completely reliable) to F (cannot be judged) and information credibility from 1 (confirmed) to 6 (cannot be judged). Whatever scale you use, grade the source and the specific piece of information separately, and require two independent sources before stating something as confirmed.

#Do I need to archive web pages I cite?

Yes. Save each page to an archive such as the Wayback Machine at the time you use it and record the archived URL and capture date. Pages are edited and removed, sometimes because of the investigation itself, and an unarchived citation cannot be checked later.

#What software helps with writing due diligence reports?

DeepState is built for it: an AI assistant researches filings, court records, sanctions lists, news and social platforms and adds each finding with its source, and the dossier builder produces the PDF report with a sources appendix from the evidence itself. Many researchers otherwise combine a capture tool, a link-analysis tool and a word processor.