Learn how GRC analysts conduct supplier due diligence, draft risk-based security questionnaires, request appropriate assurance evidence, assess supplier responses and document findings. Includes a practical questionnaire design method and worked supplier assessment.
Imagine you are a GRC analyst at a financial technology company.
The organisation wants to onboard a cloud service provider to host its customer-facing application.
You have completed the initial supplier classification and inherent risk assessment.
The supplier has been classified as High impact, and you have identified several important risk scenarios involving unauthorised access, service disruption, sensitive information and subcontractor dependencies.
Your manager asks you to send the supplier a security questionnaire.
Where do you begin?
Should you download a generic questionnaire containing 200 questions? Should every supplier receive the same questions? How do you decide what evidence is sufficient? And what should you do when a supplier gives an incomplete answer?
These are common challenges in Third-Party Risk Management.
In this guide, you will learn how to plan supplier due diligence, draft effective security questionnaires, evaluate responses and prepare documented recommendations.
The objective is not simply to collect completed forms.
It is to obtain enough relevant, reliable information to support a defensible decision about the proposed supplier relationship.
Supplier due diligence is the process of collecting and evaluating information about a proposed or existing supplier to understand relevant risks and determine whether the relationship meets the organisation's requirements.
It may involve reviewing:
The scope should reflect the supplier relationship and the organisation's risk management requirements.
For example, a supplier with privileged access to production systems may warrant detailed questions about access management, security monitoring and incident response.
A supplier with no system access and no meaningful information exposure may only require basic screening.
These terms are not interchangeable.
Due diligence is the broader assessment process.
A security questionnaire is one method for gathering information during that process.
Other sources may include independent assurance reports, relevant technical evidence, contractual documentation, meetings with supplier specialists and publicly available information.
A completed questionnaire is an input to due diligence, not proof that the supplier is secure.
One of the most common mistakes in supplier assessment is selecting a generic questionnaire before understanding the proposed relationship.
The questionnaire should be designed around the supplier's service, the organisation's requirements and the risk scenarios identified during earlier assessment stages.
Consider a fictional supplier, CloudCore Infrastructure, which will host Meridian Financial Services' production payment application.
The inherent risk assessment identified four material scenarios.
| Risk scenario | Main due diligence focus |
|---|---|
| Unauthorised production access | Identity management and privileged access controls |
| Exposure of customer information | Data protection and information security |
| Prolonged service disruption | Resilience, backup and recovery arrangements |
| Compromise involving subcontractors | Fourth-party oversight and supply-chain dependencies |
These scenarios provide a logical starting point for drafting the questionnaire.
Instead of asking every possible security question, the analyst should ask the questions necessary to assess controls relevant to these exposures.
Gather enough information to understand the service, data, access and business dependency before drafting detailed questions.
Where possible, complete the initial risk assessment first.
A questionnaire should not be used as a substitute for defining the relationship.
A practical questionnaire development process contains eight steps:
Each step affects the quality of the information received.
Before drafting questions, document why the questionnaire is needed.
For CloudCore Infrastructure, the purpose might be:
To evaluate the information security and resilience controls relevant to the proposed hosting of Meridian Financial Services' production payment application.
The assessment scope might include:
CloudCore may operate several products and environments.
A supplier could have excellent controls in one environment while the service Meridian intends to purchase has different arrangements.
Questions should therefore refer to the specific service, environment, information and responsibilities within the proposed relationship.
Avoid relying on organisation-wide claims when the relevant control population is different.
The next step is to identify which safeguards matter for each scenario.
For example:
| Identified risk | Security requirement | Questionnaire focus |
|---|---|---|
| Unauthorised access | Privileged access must be appropriately restricted and protected | MFA, approvals, account reviews and revocation |
| Information disclosure | Sensitive information must be protected throughout its lifecycle | Encryption, access controls and deletion |
| Prolonged outage | Recovery arrangements must meet agreed business needs | Backups, restoration testing and recovery objectives |
| Undetected compromise | Material security events must be monitored and investigated | Logging, alerting and incident response |
| Fourth-party failure | Material subcontractors must be understood and managed | Subcontractor inventory, oversight and dependencies |
This mapping prevents the questionnaire from becoming a collection of unrelated questions.
It also helps the analyst explain why each request is necessary.
Frameworks such as ISO/IEC 27001, NIST CSF and the NCSC supply-chain security principles can inform requirements.
However, simply copying every control from a framework into a questionnaire is not necessarily useful.
Different frameworks have different purposes, and individual questions should be relevant to the actual supplier relationship.
The questionnaire should reflect the organisation's approved requirements, supported by appropriate framework references.
A domain is a group of questions addressing a related control area.
A technology supplier questionnaire may contain the following domains.
| Domain | Example subject |
|---|---|
| Security governance | Policies, responsibilities and security risk management |
| Identity and access management | Privileged access, authentication and access reviews |
| Data protection | Information handling, encryption, retention and deletion |
| Vulnerability management | Scanning, patching and remediation |
| Secure development | Secure coding, application testing and change management |
| Monitoring and incident response | Security logging, investigation and notification |
| Business continuity | Backups, recovery and resilience testing |
| Supplier management | Subcontractor due diligence and oversight |
| Independent assurance | Certifications, audit reports and security assessments |
Not every domain applies to every supplier.
For example, detailed secure software development questions may be unnecessary for a supplier that does not develop or maintain software relevant to the service.
The assessment scope should determine the applicable domains.
This is one of the most important skills in supplier assurance.
Weak questions produce vague answers.
A useful question should make it clear:
Weak question:
Do you have good access controls?
This question is subjective.
A supplier could answer Yes without describing its controls.
Improved question:
For the service being assessed, describe how privileged access is requested, approved, authenticated, periodically reviewed and revoked. Confirm whether MFA is enforced for all relevant privileged accounts and identify any exceptions.
Supporting evidence:
A relevant privileged-access procedure, appropriately redacted configuration evidence or a recent access-review record.
Weak question:
Do you patch systems regularly?
The word regularly is ambiguous.
Improved question:
Describe how vulnerabilities affecting the service are identified, prioritised and remediated. Provide the applicable remediation criteria and explain how overdue critical findings and approved exceptions are managed.
Supporting evidence:
Vulnerability management policy, recent remediation summaries or independently reviewed assessment evidence.
Weak question:
Do you have an incident response plan?
A Yes response says little about operational readiness.
Improved question:
Describe the process for detecting, escalating and investigating security incidents affecting the service. Explain how customers are notified of relevant incidents and provide evidence of a recent incident response exercise or review.
Supporting evidence:
Relevant incident response procedure, notification provisions and a sanitised exercise summary.
Weak question:
Are your backups secure?
Improved question:
Describe the backup and restoration arrangements for the service, including backup protection, retention, restoration testing, recovery responsibilities and any agreed recovery objectives.
Supporting evidence:
Backup standard, restoration test summary and relevant recovery documentation.
Weak question:
Do you manage your subcontractors?
Improved question:
Identify material subcontractors supporting the service and describe how their security, operational and contractual risks are assessed and monitored.
Supporting evidence:
Relevant subcontractor list, oversight policy or supplier assurance summary.
Use precise language.
Avoid combining several unrelated requirements into a single Yes/No question where separate responses would improve clarity.
Ask about the assessed service rather than the entire organisation unless the wider organisation is relevant.
Avoid asking suppliers to share sensitive security information unnecessarily.
Define terms that might be interpreted differently, such as critical vulnerability, privileged access or material incident.
Finally, make sure the question can actually be evaluated.
A good question should lead to a defensible assessment, not merely a completed box.
A questionnaire should explain how suppliers are expected to respond.
A practical structure might use:
Each response should permit a written explanation.
A response of Yes should not automatically be treated as verified compliance.
| Field | Purpose |
|---|---|
| Question ID | Unique reference |
| Control domain | Related security area |
| Requirement or risk link | Why the question is being asked |
| Question | Information requested |
| Applicability | Which service or supplier conditions trigger the question |
| Supplier response | Yes, Partially, No or Not applicable |
| Supplier explanation | Control description, qualification or exception |
| Evidence requested | Appropriate supporting information |
| Evidence reference | Document or assurance report identifier |
| Analyst assessment | Assessment of relevance, sufficiency and findings |
| Follow-up action | Clarification or remediation required |
| Review status | Pending, reviewed, further evidence required or closed |
In a spreadsheet, supplier-provided responses and internal analyst findings should be clearly separated.
Suppliers should not be able to modify your internal risk ratings, governance decisions or approval status without appropriate controls.
A Not applicable answer should require justification.
For example, a supplier may state that application security testing is not applicable because it provides a managed hardware service and does not develop software.
The analyst should confirm whether the explanation is consistent with the actual service scope.
If the supplier develops supporting software or exposes an administrative web application, some application security questions may still be relevant.
The previous TPRM lessons introduced High, Medium and Low supplier impact tiers.
These can guide the depth of due diligence.
Focus on necessary baseline checks and relevant obligations.
A short screening questionnaire may be sufficient.
Use a standard set of applicable security questions, requesting additional evidence for material risks.
Use enhanced reviews covering relevant security, resilience and subcontractor dependencies, with greater attention to independent evidence and specialist involvement.
| Trigger | Additional questions |
|---|---|
| Processes personal information | Data protection, retention, processor arrangements and subcontractors |
| Has privileged system access | Privileged access controls, monitoring and administrative account lifecycle |
| Hosts critical workloads | Recovery, service availability, disaster recovery testing and infrastructure dependencies |
| Develops software | Secure development, dependency management and security testing |
| Uses important subcontractors | Fourth-party risk assessment and oversight |
| Integrates through APIs | Authentication, authorisation, credential handling and interface monitoring |
A low-impact supplier may still trigger additional questions when a particular risk or obligation applies.
Risk tiering should guide proportionality, not override relevant requirements.
Before issuing a questionnaire, review it internally.
Confirms the actual service scope and operational dependencies.
Reviews technical requirements and the appropriateness of evidence requests.
Reviews applicable privacy, data processing and contractual requirements.
Confirms that the questionnaire is suitable for the supplier engagement process and does not introduce unnecessary duplication.
Checks consistency with risk assessment methodology, evidence standards and governance requirements.
A useful final review question is:
If the supplier provides a complete response to this question, will we have enough information to make a meaningful judgement?
If the answer is no, revise the question or specify a suitable follow-up.
Before using a questionnaire across the supplier population, test it.
A pilot should establish whether:
Questionnaires should be version-controlled and periodically reviewed.
Maintain a record of the version supplied to each supplier, response date and supporting evidence.
A change to the question bank should not silently alter the historical basis of completed assessments.
Meridian Financial Services is assessing CloudCore Infrastructure.
The service hosts its customer-facing payment platform and requires privileged infrastructure administration.
Meridian identifies material risks involving access, data protection, resilience and supplier dependencies.
| ID | Domain | Question | Evidence |
|---|---|---|---|
| IAM-01 | Access management | How is privileged access approved, protected and reviewed for the production hosting service? | Access policy and relevant coverage evidence |
| IAM-02 | Access management | Is MFA enforced for all in-scope privileged access? Explain exclusions or compensating measures. | Redacted configuration or independent assurance |
| VM-01 | Vulnerability management | How are critical vulnerabilities prioritised and tracked to remediation or authorised exception? | Policy and recent remediation summary |
| IR-01 | Incident response | What is the process for notifying customers of incidents materially affecting their services or information? | Incident procedure and relevant notification terms |
| BC-01 | Resilience | How are recovery arrangements tested for the hosting service? | Recent restoration or recovery test summary |
| DP-01 | Information protection | How is customer information protected at rest, in transit and during authorised access? | Relevant control descriptions and evidence |
| SC-01 | Subcontractors | Which material subcontractors support the service, and how are their risks managed? | Relevant subcontractor and oversight information |
This is an illustrative extract, not a complete due diligence questionnaire.
The full questionnaire would also include scope, instructions, conditional questions, response fields and evidence reference columns.
After receiving the questionnaire, the analyst must evaluate the answers and supporting evidence.
For each material question, consider:
Relevance: Does the answer apply to the service being purchased?
Completeness: Has the supplier addressed the actual requirement?
Evidence: Is the response supported by appropriate documentation or assurance?
Currency: Is the evidence sufficiently current for the assessment purpose?
Scope: Does it cover the relevant systems, environment and controls?
Limitations: Are there exclusions, exceptions, untested controls or restrictions that affect reliance?
CloudCore responds:
Yes. MFA is enabled for privileged accounts.
It supplies a screenshot showing MFA configuration in a test environment.
The question concerns privileged access to the production hosting service.
The screenshot alone does not establish that the relevant production accounts are covered.
The analyst should record that the response requires further evidence.
A suitable follow-up might be:
Please provide appropriately redacted evidence confirming MFA enforcement for privileged accounts supporting the production service, including the treatment of exceptions and non-interactive administrative access.
Do not record the control as operating effectively without sufficient evidence.
Equally, do not conclude that MFA is absent merely because the initial evidence was insufficient.
Insufficient evidence and a confirmed control failure are different findings.
An analyst can classify questionnaire responses using a documented internal review status.
| Status | Meaning |
|---|---|
| Supported | Relevant evidence adequately supports the assessed requirement |
| Partially supported | Evidence supports some, but not all, relevant requirements |
| Evidence insufficient | The supplier's claim cannot yet be adequately verified |
| Control gap identified | Available evidence indicates a relevant weakness |
| Not applicable — justified | The requirement does not apply, with documented rationale |
| Pending review | Assessment is incomplete |
These are illustrative assessment statuses, not universal audit conclusions.
Independent assurance can be useful, but no single evidence format is automatically best in every situation.
Consider the assurance source, scope, control population, testing period and relevance.
For example:
The analyst should avoid treating all evidence as equally persuasive.
Suppliers may decline to share highly sensitive information.
This can be legitimate.
For example, unrestricted access to internal network diagrams, vulnerability details or privileged system configurations may create security concerns.
Possible alternatives include:
The objective is to obtain proportionate assurance without unnecessarily increasing risk for either organisation.
If material uncertainty remains, document it and escalate according to the approved assessment process.
A supplier's refusal to provide evidence is not automatically proof that a control does not exist.
However, the organisation may still decide that insufficient assurance prevents approval under its risk appetite or contractual requirements.
When a review identifies an issue, the analyst should document it clearly.
Finding ID: DD-014
Requirement: Privileged access to the production hosting service must be protected by approved authentication controls.
Supplier response: MFA claimed to be enforced.
Evidence reviewed: Screenshot from a non-production environment.
Assessment: Evidence insufficient to confirm production coverage.
Potential risk: Unverified privileged-access safeguards could leave relevant exposure inadequately assessed.
Required follow-up: Obtain service-specific evidence or suitable alternative assurance.
Owner: Supplier security contact, coordinated by the internal supplier relationship owner.
Status: Open — awaiting evidence.
This is an evidence gap, not yet a confirmed MFA control failure.
If later evidence demonstrates that required production accounts lack MFA, the finding can be revised to reflect a confirmed control weakness.
The GRC analyst provides the analysis and recommendation.
The accountable business owner and designated risk authority determine whether the supplier can proceed, whether conditions are needed or whether the relationship must be reconsidered.
A questionnaire score should not automatically override these governance responsibilities.
Senior stakeholders generally need a concise decision-oriented summary rather than every questionnaire response.
For CloudCore, an initial summary might read:
CloudCore Infrastructure has been classified as a High-impact supplier because it will host critical production payment services. Due diligence has identified outstanding evidence relating to privileged-access controls and disaster recovery testing. These gaps prevent confirmation of the relevant control effectiveness at this stage. The supplier relationship owner should obtain additional evidence and arrange security review before an unconditional approval recommendation. Material unresolved exposures should be escalated to the designated risk authority.
A useful summary identifies the dependency, material findings, uncertainty, business implication and action required.
You are a GRC analyst at Meridian Financial Services, a fictional UK fintech.
Meridian wants to onboard SupportBridge, a SaaS customer support platform.
The supplier will process customer contact information and complaints, integrate with Meridian's customer relationship management system and rely on an external cloud hosting provider.
The preliminary inherent risk assessment identifies:
Develop a short supplier due diligence questionnaire containing 12–15 questions.
Your submission should:
| Column | Example |
|---|---|
| Question ID | IAM-01 |
| Domain | Identity and access management |
| Risk reference | TPR-003 |
| Requirement | Restrict and protect integration access |
| Question | How are API credentials issued, protected, rotated and revoked for the purchased service? |
| Response | Supplier completion |
| Explanation | Supplier completion |
| Evidence requested | Relevant API credential management procedure |
| Evidence reference | Supplier completion |
| Analyst assessment | Internal use only |
| Follow-up | Internal use only |
A strong submission demonstrates:
There is no single correct set of questions.
A good questionnaire is one that provides useful assurance about the actual relationship while avoiding unnecessary questions and evidence requests.
This increases review burden without necessarily improving assurance.
Vague questions often produce vague, unsupported responses.
A supplier's assertion does not automatically establish that the relevant control is effective.
This wastes time and may create unnecessary information-handling risks.
Uncertainty should be distinguished from identified weaknesses.
Always consider certification scope and relevance.
Partially implemented controls and scope exclusions can materially change an assessment.
Scores can support prioritisation, but final decisions require governance and contextual analysis.
Without ownership, deadlines and evidence requirements, important findings may remain unresolved.
Before issuing a questionnaire, ask:
Before completing the due diligence review, confirm:
Supplier due diligence is a risk-based assessment process, not simply a questionnaire exercise.
A good questionnaire starts with the supplier relationship, the risks it introduces and the controls the organisation needs to evaluate.
Questions should be clear, relevant and supported by proportionate evidence requests.
Supplier responses must be assessed for completeness, scope, reliability and limitations.
Missing evidence should be distinguished from confirmed control weaknesses.
The GRC analyst's responsibility is to gather, challenge and document information so that the organisation can make informed and properly authorised supplier decisions.
The quality of a supplier questionnaire is measured by the decisions it supports, not the number of questions it contains.
Next lesson: How to Review ISO 27001 Certificates and SOC 2 Reports
You have learned how to draft a risk-based supplier questionnaire, specify evidence requirements and assess responses.
The next lesson will examine how to interpret independent assurance documents, identify scope limitations and determine what these reports can and cannot demonstrate about a supplier's controls.