How to capture 'pink flags' for VC due diligence purposes

Kassim Legal has served as a corporate boutique law firm in the Middle East for more than 50 years. A family-run firm, Kassim's services are tailored to international corporate matters. Based in Jordan, with affiliate offices in Cairo, Dubai, London, and Washington, D.C., the firm represents some of the leading corporations and private equity funds in the region.

Connect with Kassim Legal or message Hisham directly on his MAGNiTT profile

Almost every due diligence project starts with a well-constructed checklist, but an experienced investigator learns the telltale signs that lurk just below the surface. Experience matters.

“They’ve ticked all the boxes,” Henry said.

“I know, but I still cannot recommend that you invest in this company,” I said.

This was one of many conversations I had with Henry over the past several weeks about his upcoming investment in a technology startup that we’ll call Dolus.

“Why?” Henry asked.

He had every right to see my reluctance as just lawyers getting in the way of a good deal. Dolus had raised over $10M in venture capital financing from some of the largest venture capital firms. Dolus was growing very quickly and had generated some revenue over the past few years. We could not find any red flags in Dolus’ documentation, and they did seem to check all the boxes. Everything pointed to “go”. But still, there was something off about the company. That something was that one of our assumptions was flawed.

The 2008 housing crash and its flawed assumption

One of the many causes of the 2008 housing crash is that the mortgage-backed securities being sold were not properly rated in terms of their risk profile (mortgage-backed securities are a bundle or collection of home mortgages or loans which are grouped together and then sold to various investors.)

Those rating mortgage-backed securities also, many argued, had a flawed assumption when making their assessment. The rating agencies had grossly underestimated the risk of these securities or bonds as they are commonly referred to. For example, rating agencies had routinely rated mortgage-backed securities as AAA or AA (which carry much lower risk) when they should have been rating those securities as BBB or even lower (which carry much higher risk). The common perception or argument is that had the rating agencies properly rated these bonds it would have prevented many investors, especially large institutional investors, from buying them.

How, then, could the rating agencies and the large, sophisticated investors buying these securities have made such a basic and fundamental error? Why didn’t they rate and assess the risk of these securities properly? Why did they underestimate the risk of these bonds? There are, of course, scores of articles and books that have been published trying to answer these questions, but one common argument is that the rating agencies had made a fundamental error in one of their assumptions - the type of error that many investors make when they are faced with a consistent pattern of pink flags.

Understanding risk

Let’s say you represent a large pension fund and have to choose between investing in Bond A or Bond B. Each of these bonds is backed by ten different mortgages. All of the mortgages in Bond A and B are identical to one another. All of the borrowers have steady, high-paying jobs, they have more than 25% equity in their homes, they have good credit ratings, and have recently made large investments in their homes indicating that they expect their future earnings to continue. They were all identical except for one main characteristic.

The borrowers in Bond A all lived in Steelville, USA, a small town that had one major employer while the borrowers in Bond B lived all over the world. Which bond would you think is riskier and why?

Most would conclude that Bond A is riskier because if the major steel plant closed then there is a higher chance that all the mortgages in Bond A would default even if not all of the borrowers in Bond A worked for the steel plant. Having the town’s major employer close would have a ripple effect throughout the local economy. There would be fewer people working at the steel plant which would mean fewer wages and fewer people with disposable income to shop, dine out, and pay for other daily expenses.

Even though the mortgages in both bonds are nearly identical to one another, we can conclude that Bond A is riskier than Bond B and therefore Bond A should receive a lower credit rating. The high geographical concentration of the Bond A borrowers is what is called an antecedent variable or condition. If the steel plant closed, it would affect all the mortgages in Bond A.

Bond B does not have that issue since the mortgages are geographically dispersed. Therefore no one event, like the closing a steel plant, would have an adverse effect on the entire pool of mortgages in Bond B (unless there was a worldwide event which, we now know, with COVID, never happens).

Here, the mortgages in Bond A are correlated to one another, which means that if one defaults there is a high probability that the remaining mortgages will default. The mortgages in Bond B, however, are uncorrelated to one another. So, if one defaults, in theory, one default should have no bearing on the probability that the other mortgages would also default.

Many believe that the basic assumption that mortgages within bonds were uncorrelated is among the numerous errors rating agencies made when grading mortgage-backed securities. The rating agencies believed that the underlying mortgages in their bonds were uncorrelated to one another when there was strong evidence that they were correlated to one another. By changing this one basic assumption, the risk factor of these mortgage-backed securities would have increased exponentially.

Due diligence and pink flags 

Over the past ten years or so, there has been a strong trend in the venture capital industry to routinize and standardize the due diligence process. As part of this trend, many in the industry have resorted to conducting due diligence using checklists. Checklists are a great tool and very clearly delineate responsibility - so long as the person conducting the due diligence checks all the boxes on the checklist, then they have completed their job and the investment can proceed.

As with Henry, we checked all the boxes on our checklist but, still, there was something not quite right about the company that our checklist could not capture.

Checklists are great tools for capturing major issues or “red flags” - basic company and investor documentation, criminal background checks, and a major supplier and customer agreements. However, they are not very good at capturing less severe types of corporate mismanagement.

Examples of less severe types of corporate mismanagement can be consistently sloppy record-keeping, potentially suspicious related party transactions, large cash deposits and withdrawals, high founder salaries or bonuses, and so on. The list can be extensive. Each item on the less severe list (we call them “pink flags”) can usually be explained away and in many cases are perfectly legitimate. However, at some point, there can be just too many pink flags.

Changing assumptions

This is what gave us pause about Henry’s investment with Dolus. Dolus had checked all the boxes, but there were just too many pink flags in the company’s records. Our assumption therefore changed. At the outset, we believed that these pink flags were just random and uncorrelated to one another. However, after further investigation, we began to suspect that the pink flags were not random and that they were in fact correlated to one another. As we saw with the mortgage-backed securities example, once we changed this fundamental assumption, Dolus’ risk profile increased.

The abundance of pink flags may indicate that there is an antecedent or underlying variable that could be causing all of these pink flags which our checklist is failing to capture - the equivalent to high geographical concentration as we saw with the borrowers of Bond A. The underlying variable or condition can consist of a range of factors but usually includes some combination of having a poor management team and the company not performing as well as expected.

When to change our assumption that the pink flags are correlated versus uncorrelated is a judgment call that we routinely have to make. While we do not believe that the checklist approach to due diligence will go away any time soon, we hope that the industry adopts a more nuanced approach with more varied variables that will capture more pink flags and have those weighted accordingly.

Are you a startup looking for investment? Apply for funding to 110+ investors now