Guides

Forensic Underwriting: Re-Underwriting Seller Numbers

Forensic underwriting for CRE: where seller pro formas inflate NOI, how to reconcile the rent roll, T-12, and leases, plus a red-flag catalog for buyers.

The Gap Between the OM and the Deal

Every offering memorandum presents the seller’s best version of the property. The broker’s fee depends on the highest achievable sale price, and the document reads accordingly. The problem for a buyer is that the OM’s pro forma NOI, its market-rent assumptions, and its recovery income projections are frequently the ceiling of what the property can plausibly generate, and a buyer should underwrite well below that ceiling. Forensic underwriting is the discipline of taking every number in that package and independently proving it against the documents that actually generate it (the executed leases, the T-12 general ledger detail, the accounts receivable aging) before it enters an investment committee memo.

This is distinct from ordinary underwriting review, which typically works from the summary documents the seller provides and checks them for internal consistency. Forensic underwriting goes a level deeper: it assumes the summary documents may themselves be constructed to present a favorable picture, and it traces every material line item back to its primary source. The distinction matters most on deals where pricing is aggressive relative to trailing performance, the deals where a seller has the strongest incentive to present optimistic assumptions as if they were already achieved.

Where OMs Inflate: Market-Rent Marks

The single most common inflation technique is the market-rent mark: a pro forma that replaces a tenant’s actual in-place rent with a “market rent” assumption on the theory that the space would command a higher rate if re-leased today. Market-rent upside is a legitimate component of many value-add underwriting theses. The problem is how frequently it gets presented as though it were already captured, with no discount for the time, cost, and leasing risk required to actually achieve it.

A forensic review of a market-rent mark asks three questions: What is the actual remaining term on the below-market lease, and can the landlord reasonably access the mark before that term expires? What tenant improvement allowance and leasing commission cost will re-leasing at market actually require, and has that cost been reflected anywhere in the pro forma? And is the “market rent” comp set genuinely comparable in size, location, and lease structure, or is it built from a handful of favorably selected transactions that don’t represent the true clearing rent for this specific space?

Cross-referencing every market-rent assumption against the rent roll’s actual lease expiration schedule is the mechanical first step. A mark applied to a tenant with eight years remaining on their term is functionally worthless to a five-year hold, no matter how compelling the comp set looks.

Where OMs Inflate: Recovery Assumptions

Recovery income (CAM, tax, and insurance reimbursements collected from tenants) is the second most common inflation point, and it is often the hardest to catch because it requires cross-referencing three separate documents: the T-12’s recovery income line, the rent roll’s stated recovery structure per tenant, and the actual recovery clause language in each lease.

Pro formas routinely project recovery income at or near 100% of recoverable operating expenses, even when the actual lease population includes tenants with recovery caps, base-year stops, gross leases with no recovery obligation at all, or negotiated exclusions for specific expense categories like capital repairs or management fees. A portfolio with a mix of lease structures rarely recovers anywhere close to 100% of operating expenses in practice, and a pro forma that assumes otherwise is overstating NOI by exactly the gap between assumed and achievable recovery.

The only reliable way to catch this is bottom-up: pull the recovery provision from every lease, apply it to that tenant’s pro-rata share of actual recoverable expenses, and sum the result, rather than accepting a single aggregate recovery percentage applied uniformly across the rent roll. This exercise routinely surfaces a 5-15% gap between the OM’s assumed recovery income and what the actual lease population supports.

Where OMs Inflate: Below-the-Line Exclusions

The third pattern is expense normalization: moving genuinely recurring costs below the pro forma’s NOI line as “one-time” or “non-recurring” add-backs. A roof repair really is a one-time event in isolation, but a building with an aging roof system generates a stream of these “one-time” repairs year after year, and normalizing each one out individually understates the true run-rate maintenance burden the asset requires.

Expense categoryLegitimate one-time exclusionCommon inflation pattern
Capital repairsA single documented event tied to a specific, non-recurring causeRecurring deferred-maintenance items each excluded individually as “isolated”
Legal/professional feesA specific litigation matter, fully resolvedOngoing tenant dispute or compliance costs recast as one-time
Bad debtA single tenant bankruptcy in an otherwise stable rosterChronic delinquency pattern across multiple tenants excluded as “non-recurring”
Management feeActual third-party market rateBelow-market or waived fee that a new owner’s actual manager won’t replicate
Property taxConfirmed, finalized reassessmentPending appeal assumed successful before any ruling

The property tax row deserves particular attention on any deal in a jurisdiction that reassesses on sale. A T-12 built on the seller’s current (pre-sale) tax basis will systematically understate the buyer’s actual future tax expense, sometimes by a substantial margin, because the sale itself triggers a reassessment closer to the transaction price. This is one of the most common one-sided inflation effects in NOI presentations and one of the easiest to correct with a straightforward review of the jurisdiction’s reassessment rules.

The Document Trail: Rent Roll, T-12, and Lease Reconciliation

The core forensic exercise is a three-way reconciliation among documents that should, in a clean deal, tell an internally consistent story.

Rent roll to T-12: Annualize the rent roll’s current in-place base rent for every tenant and compare the total against the T-12’s base rent revenue line for the corresponding trailing period. A material unexplained gap between these two figures, beyond what recent lease-up, turnover, or a mid-year rent roll date reasonably explains, signals a problem: a stale rent roll, an error in the T-12, undisclosed rent concessions, or revenue recognized in the T-12 that doesn’t correspond to an active lease. This reconciliation is the single highest-yield check in a forensic review because it’s mechanical, fast, and catches a wide range of unrelated underlying problems through one comparison.

Rent roll to lease documents: For every material tenant (typically anyone representing more than 3-5% of total rent), pull the executed lease and every amendment, and confirm the rent roll accurately reflects current rent, remaining term, renewal options, and any special provisions like co-tenancy or exclusive-use clauses. Rent rolls are frequently prepared by property management staff working from memory or outdated summaries rather than the actual lease file, and errors compound when a lease has been amended multiple times.

T-12 to accounts receivable aging: Compare the T-12’s stated collections against the AR aging report to confirm that reported revenue was actually collected rather than merely billed. A property showing strong T-12 revenue alongside a growing AR balance is showing accrued, not collected, income — a distinction that matters enormously for a buyer underwriting future cash flow rather than accounting recognition.

Correspondence review: Side letters, email agreements, and informal rent concessions frequently exist outside the executed lease and rent roll entirely, surfacing only in a correspondence or miscellaneous folder within the data room. A tenant paying a negotiated, below-lease rent based on a side letter the rent roll doesn’t reflect is a common and easy-to-miss source of NOI overstatement. Building this reconciliation into a standing due diligence checklist keeps it from depending on an analyst remembering it deal by deal.

A Red-Flag Catalog

  • Rent roll and T-12 base rent diverge by more than 5% without a documented explanation tied to leasing activity during the period
  • Recovery income assumed at a flat percentage rather than built bottom-up from individual lease recovery provisions
  • Market-rent marks applied to leases with more than three years of remaining term, with no time-value discount for when the mark can actually be captured
  • Capital repair or legal expense line items excluded as “one-time” in more than one of the trailing three years
  • Property tax projected on a pre-sale assessment basis in a reassess-on-sale jurisdiction
  • AR aging shows growing delinquency while T-12 revenue holds steady or grows
  • A “miscellaneous” or “correspondence” data room folder that hasn’t been reviewed line by line
  • Management fee below the market rate a buyer’s actual property manager would charge, inflating NOI by exactly the fee gap

How Forensic Findings Change the Underwriting Model

A forensic review is only useful if its findings actually flow into the numbers an investment committee votes on, not just into a memo appendix nobody reads before the vote. Each category of finding above maps to a specific adjustment in the underwriting model rather than a vague qualitative caution.

A market-rent mark applied to a tenant with meaningful remaining term should be re-modeled as a delayed capture: pushed to the actual lease expiration date, discounted for the leasing commission and tenant improvement cost required to achieve it, and removed entirely from years where the existing tenant remains in place below market. This typically pushes several hundred basis points of assumed NOI growth several years further out than the OM’s pro forma implied, which materially changes both projected cash on cash return in the early hold years and the IRR generated by the full DCF projection.

A recovery income gap identified through the bottom-up lease-by-lease reconciliation should replace the OM’s flat recovery percentage assumption outright, not sit alongside it as a footnote. If the forensic review finds the achievable recovery rate is 78% against an OM assumption of 94%, that 16-point gap should flow directly into a lower NOI figure for every year of the hold, since recovery structure is a fixed lease term that doesn’t improve on its own; it changes only at lease renewal, on the landlord’s negotiating terms at that time.

Reclassified “one-time” expenses should return to the recurring expense base at a normalized run-rate, typically averaged across the trailing three to five years rather than using the most recent single year, which smooths out the lumpiness of infrequent but genuinely recurring capital items like roof sections, parking lot resurfacing, or HVAC unit replacement. A property with three “isolated” capital repair line items across the trailing three years does not have three isolated events; it has a maintenance run rate of one meaningful capital item per year, and the underwriting model should reflect that going forward.

Making Forensic Review Repeatable

None of these checks are individually complicated — the difficulty is doing all of them, consistently, across every material tenant and every expense line, on a deal timeline that rarely allows for it. That time constraint is why forensic reconciliation gets skipped or abbreviated under deadline pressure. Moraine extracts rent roll, T-12, and lease data directly from source documents into a linked model, so the rent-roll-to-T-12 and rent-roll-to-lease reconciliations described above run automatically against the actual source documents rather than requiring a manual line-by-line pull. That turns the most time-intensive part of commercial real estate underwriting into a process that can run on every deal in a pipeline, not just the ones with enough runway for a full manual audit.

No number should enter an investment committee memo without a traceable path back to the primary document that generated it: the rent roll, the T-12, or the executed lease file.

FAQ

Frequently asked questions

What is forensic underwriting in commercial real estate?
Forensic underwriting is the practice of independently re-verifying every material assumption in a seller's or broker's marketing package against primary source documents — leases, T-12 general ledgers, and correspondence — rather than accepting the offering memorandum's pro forma at face value. It treats every quoted number as a claim to be substantiated, not a fact to be trusted.
What are the most common ways OMs inflate NOI?
The most common inflation methods are market-rent marks applied to below-market in-place leases without accounting for the cost and time to achieve them, recovery income assumptions that don't reconcile against the actual CAM and tax recovery language in tenant leases, and expense normalization that reclassifies genuinely recurring costs as one-time add-backs.
How do you reconcile a rent roll against a T-12?
Sum the rent roll's current in-place rent for every tenant, annualize it, and compare that total against the T-12's base rent revenue line for the same period. A material gap — beyond what recent lease-up or turnover explains — signals either a stale rent roll, a T-12 error, or undisclosed rent concessions that need to be traced to their source before the deal is underwritten.
What documents does forensic underwriting cross-reference?
The core reconciliation triangle is the rent roll, the T-12 operating statement, and the underlying lease documents (including all amendments). A forensic review also checks the accounts receivable aging report against the rent roll's stated delinquency, and correspondence files for side letters or informal agreements not reflected in the executed lease.