In recent years, the concept of due diligence has become a key element in assessing business operations. It appears in the context of tax settlements, anti-money laundering, personal data protection, and broadly defined compliance. At the same time, this concept, despite its widespread use, is often understood in practice in a simplified manner. Many businesses equate due diligence with the mere fact of taking specific actions. However, from the perspective of regulatory bodies, what matters most is whether these actions can be reliably demonstrated.
Experience from audits conducted by authorities such as the National Revenue Administration, the Inspector General for Financial Information, and the President of the Personal Data Protection Office leads to a clear conclusion: due diligence that is not properly documented is practically nonexistent. An audit is not an assessment of a business's declarations or intentions, but an analysis of evidence. In this sense, documentation ceases to be merely an organizational element and becomes a fundamental instrument of legal protection.
The essence of due diligence is not the implementation of a single, specific solution, but the creation of a coherent decision-making and risk management system. Regulatory authorities do not use a single, closed definition of this concept. The assessment is always made in relation to the specific circumstances, taking into account the nature of the business, its scale, industry, and the type of transactions undertaken. This means that the same level of verification may be deemed sufficient in one case and completely insufficient in another. In practice, therefore, the goal is not to meet an abstract standard, but to demonstrate that the entrepreneur acted rationally, adequately to the identified risks, and in a verifiable manner.
The key moment for verifying due diligence is an audit conducted after a specific event has occurred. The authority does not evaluate actions in real time, but reconstructs them based on available documents. In this context, the manner in which the entrepreneur documents its decisions and processes is particularly important. Lack of documentation or its fragmentation leads to a situation in which the authority – unable to reconstruct the entrepreneur's reasoning – often adopts the least favorable interpretation.
In practice, this means that documenting due diligence should encompass not only the verification activities themselves, but also the decision-making process. Merely checking a contractor's credentials against available registers is insufficient if it is impossible to demonstrate what conclusions were drawn from that verification and why, despite potential red flags, the decision was made to engage in cooperation. Authorities are increasingly examining not only whether a business had access to specific information, but also whether they were able to interpret it correctly.
This is particularly evident in the area of economic relations, where due diligence involves verifying the counterparty. In practice, due diligence is not limited to a formal check of registry data but encompasses a broader analysis of credibility and risk. In situations involving unusual circumstances—such as an unusual transaction structure, a lack of transparency on the counterparty's part, or connections to high-risk jurisdictions—the lack of in-depth analysis may be considered a lack of due diligence. Importantly, even conducting such an analysis will be meaningless if it is not reflected in the documentation.
In this context, one of the most common problems revealed during inspections is a lack of systemic approach. In many companies, compliance activities are reactive and incidental. They are undertaken in response to specific situations, but are not embedded in a coherent system of procedures. This model of operation leads to evidence gaps that are difficult to fill during an inspection. Authorities do not analyze individual activities in isolation, but rather assess the entire risk management system.
An equally significant problem is the creation of documentation after the fact, meaning only when the risk of an audit arises. Such actions are usually easy to identify, both due to the time-inconsistency of the documents and their schematic nature. In practice, such documentation not only fails to protect the entrepreneur but can actually worsen their situation, undermining the credibility of the entire system.
Equally important are situations in which a business has extensive procedures in place, yet these operate solely at a formal level. Authorities are increasingly verifying not only the existence of documents but also their actual application. In the event of discrepancies between the content of procedures and operational practice, documentation loses its evidentiary value. In this sense, compliance cannot be limited to document creation—it must be a truly implemented and applied system.
From an audit preparation perspective, ensuring consistency between operational activities and documentation is crucial. This requires implementing solutions that enable ongoing recording of actions and decisions. In practice, this often means moving away from a model based on individual documents towards systems that integrate verification, decision-making, and archiving processes. This isn't about implementing advanced technological tools, but rather ensuring that every significant step of the process can be recreated based on available data.
In the context of legal liability, the role of documentation as a protective element for management board members is particularly important. In situations where a company's actions are questioned, documentation constitutes the primary evidence demonstrating due diligence in the management of its affairs. The lack of such documentation can lead not only to administrative or tax consequences, but also to liability under fiscal criminal law, and in certain cases, even criminal law.
In practice, this means that documenting due diligence should not be treated as a formal obligation, but rather as an element of a risk management strategy. With the increasing intensity of controls and increasingly restrictive approaches by authorities, the ability to demonstrate the rationality and adequacy of undertaken actions is becoming a key factor in a business's legal security.
Ultimately, due diligence is neither an abstract nor a purely theoretical concept. It is a construct whose real significance is revealed only at the moment of an audit or dispute. It is then that it becomes clear whether the solutions adopted were genuine or merely declarative. In this sense, documentation is not an adjunct to compliance, but its core – the only element that allows a business to move from the level of declaration to the level of evidence.
This article is for informational purposes only and does not constitute legal advice
Legal status as of March 18, 2026.
Author:
Series editor:
