Why a supplier questionnaire must produce evidence
A defensible supplier qualification file connects each requirement to: the control that implements it, the control owner, dated evidence that verifies execution, an audit trail, any non-conformity, and the remediation steps. Without dated, contextualised evidence, a vendor’s “yes” is only a declaration—not proof the control was applied or maintained.
Distinguish policies from proof of execution. For example, a backup policy does not demonstrate that recovery was tested; for that you need a dated test report specifying scope, results and corrective actions. Similarly, an authorized exception with justification and expiry is not the same as an open non‑conformity or an unrepaired incident. Treating these states as identical makes the file ambiguous.
Supply‑chain involvement matters. Recent supervisory reviews and incident analyses show a large share of major ICT incidents implicate suppliers; qualification must therefore consider services, dependencies, and sub‑processors—not only the signed contract.
Operational rule: a questionnaire response without relevant evidence remains open until the evidence is provided and verified.
How to scale the questionnaire to supplier criticality
One size does not fit all. Depth should be proportional to the service’s impact: the data it processes, the access it grants, and its operational dependencies—not simply the supplier’s size. A proportionate approach helps smaller suppliers while ensuring critical services receive thorough scrutiny.
Suggested tiers (organizational guidance):
- Non‑critical, no personal data: minimal set (3–5 questions); requalify at onboarding and every 24 months; require signed declaration and contract.
- Personal data processing: essential set plus privacy and incident questions; annual review; require current attestations, breach procedure and data location details.
- Privileged access or sensitive data: full security and sub‑supplier set; annual review and after major incidents; require penetration test reports, DR test minutes and sub‑supplier list.
- Critical function (NIS2, DORA, systemic services): full set plus audit rights and exit plan; semi‑annual review or event‑driven review; require dated evidence, recovery minutes, exit plan and contractual audit rights.
These frequencies are suggested organizational thresholds and must be adjusted to residual risk. Any major change—new sub‑processor, data relocation, or service modification—should trigger an extraordinary review.
Sample questions and the minimum evidence you should request
Ask for facts, dates or documents—not opinions. Replace “Are your data protected?” with specific, verifiable questions such as the samples below.
Security
-
Question: What privileged‑access controls protect systems that process our data, and when was the last review?
Evidence: Approved policy excerpt and report of the latest privileged‑access review (dated). -
Question: How often do you perform penetration testing, who conducts it and what was the scope?
Evidence: Last penetration test report with date, scope and remediation status.
Privacy
-
Question: Where are primary data and backups hosted and which sub‑processors have access?
Evidence: Updated inventory of data locations, data centers and sub‑processors including country of processing. -
Question: What is your data‑breach handling process and how quickly will you notify us?
Evidence: Breach response procedure with contractual notification timelines and an incident register.
Continuity
-
Question: What RTO and RPO do you guarantee and when was the DR test last executed?
Evidence: DR test minutes with date, scope, results and corrective actions. -
Question: Do you have a documented exit plan if the service is terminated?
Evidence: Exit plan with the date of last review.
Incidents
- Question: How do you classify incidents and what are your customer communication templates and timelines?
Evidence: Incident response procedure with notification thresholds and sample communications.
Compliance
-
Question: Which attestations or certifications cover the service, what is their scope and when do they expire?
Evidence: Certificate or audit report showing scope, included services and validity period. -
Question: Do you accept customer audits or provide independent assurance reports, and under what limits?
Evidence: Contract clause on audit rights and the most recent independent report. -
Question: Does the service use AI components and which automated functions are subject to human oversight?
Evidence: Inventory of AI systems with purpose, limits and references to applicable AI regulation obligations.
If a required attachment is missing, record the response as unverified and assign an owner and deadline for submission. Silence is not implicit acceptance.
Validate responses, separate duties and record the decision
Collecting responses is not the same as verifying them. Best practice is to separate roles:
- Requester: the internal service owner who initiates qualification and describes the need.
- Verifier: compliance, risk or security staff who check evidence relevance, date and completeness.
- Approver: the owner of the function or risk who signs off the decision and accepts any residual risk.
Segregation of duties reduces the chance that a collector also approves insufficient evidence. Automation can assign tasks and reminders but not assume ownership of risk.
Outcomes and blocking rules
Decisions should be recorded as one of:
- Approved: required evidence is adequate and gaps are not material for the service’s criticality.
- Approved with conditions: approver accepts a documented, time‑bound risk with owner and remediation activities.
- Suspended / Not qualified: essential elements are missing or a necessary contractual condition was not accepted.
Assess service impact, data sensitivity, privileged access, sub‑processor dependencies, and recovery capability separately. A single critical gap (e.g., undisclosed critical sub‑processor, expired certification, or missing independent testing for a critical service) requires explicit action rather than averaging into a pass.
How to manage evidence and the supplier register
Treat each piece of evidence as part of a readable lifecycle: request → upload → verify → approve → archive. For each request define the linked controls, the recipient (supplier or internal), the submission method (upload, acknowledgment or both), status and deadline. An auditor must be able to distinguish “not received” from “received but not verified.” Without that distinction, files become a heap rather than a process.
When suppliers submit updated documents, retain prior versions with their dates; do not overwrite originals. For supplier‑furnished uploads prefer secure, expiring links to avoid creating external accounts. Versioning, audit trails and operation logs are essential; AuditReady supports evidence modules, vendor records, and secure uploads with full traceability.
The supplier register turns questionnaire answers into managed risk. Besides name and renewal date, associate each record with service scope, linked controls, decisions affecting residual risk and follow‑up actions. A dynamic register ties responses to events, deadlines and dependencies instead of treating qualification as a one‑time form.
Minimum fields for the register
- Identification: record ID and supplier name.
- Scope: service, connected system and referenced control.
- Accountability: internal owner and verifier.
- Assessment: criticality, residual risk and compensating controls.
- Dates: review date, condition deadlines and current status.
- Closure: closure evidence, date, verifier and approved outcome.
Common mistakes that weaken qualification
- Yes/no answers without proof: do not demonstrate control execution. Rephrase to require a dated evidence item.
- Retroactive qualification: service was active before risk acceptance—record the actual start date and any temporary exception without backdating approvals.
- Out‑of‑scope or expired attestations: ensure certificates cover the exact service and are current.
- Dispersed documents across email and chat: archive proof within the control file and link it to the requirement.
- Closure notes without evidence: a “completed” flag is insufficient—require closure evidence and verifier confirmation.
- Screenshots without context: a screenshot lacking date and scope is weak; prefer identifiable, contextualised reports.
- Repeated exceptions without review: a derogation must have justification, owner, expiry and compensating controls.
An authorized, time‑bound exception is not an incident. If a supplier misses an agreed remediation deadline, the record should be re‑evaluated per the exception decision. Incidents must be handled and communicated as incidents, not buried as exceptions. Maintain an audit trail showing who approved what and when.
Checklist: verify the file before the periodic review
Use these practical checks when preparing for a review. Look for the document in the file, not just a manager’s verbal confirmation.
- Does every answer have dated, verifiable evidence? Check attachment, date, scope and link to the control.
- Is the supplier criticality justified in writing? The classification should explain service, data and dependency impact.
- Is an internal owner named with role? Avoid generic ownership such as “IT team.”
- Do attestations cover the actual service and remain valid? Verify scope, included services and expiry.
- Do exceptions include approval, expiry and compensating controls? Look for motivation and a re‑assessment date.
- Can you reconstruct who requested, verified and approved the file from records alone? Seek signatures, logged actions or audit entries.
For critical controls, one missing essential datum renders the response unverified even if other files exist. Schedule the next review and assign an owner and required evidence in advance.
Frequently asked questions
What if a supplier refuses to complete the questionnaire?
Log the refusal with date and reason and assess the risk based on public attestations, incident history and contract terms. Escalate to the relationship owner. If the service must continue, formalise a time‑bound exception with owner, compensating controls and a re‑review date. Treat silence as missing evidence, not tacit agreement.
How often should non‑critical suppliers be reviewed?
A 24‑month review cadence is a practical starting point for non‑critical suppliers that do not process personal data. Anticipate earlier reviews if the service changes, an incident occurs, a sub‑processor appears, or a new dependency emerges.
Does a certification replace the questionnaire?
No. Certifications and attestations are evidence, not substitutes. Verify that the certificate’s scope, locations, processes and validity match the service. Complement certificates with operational evidence (incidents, continuity tests, sub‑processor oversight) that certificates typically do not cover.
How to qualify a small supplier with limited internal controls?
Apply the essential 3–5 question set and request evidence progressively: first a document proving the control exists, then evidence showing it was executed. Proportionality matters—avoid imposing the same documentation depth on all suppliers while still recording owner and review date.
What if an undisclosed sub‑processor is discovered?
Start an extraordinary review and apply blocking rules to the affected service until the dependency is assessed. Update the register with the discovered sub‑processor, discovery date, responsible owner, decision and requested evidence. Late discovery usually points to governance gaps that should be addressed upstream.
Conclusion
A robust supplier qualification process ties answers to dated, contextual evidence and assigns responsibility for verification and decision. Treat qualification as a living, risk‑driven activity: automate reminders and traceability, but keep human judgement for risk acceptance.
AuditReady centralises audits and controls, versions and stores evidence, maintains an audit trail and supports remediation workflows, including governance flows such as ethics and whistleblowing processes. To see how these features can help you collect, verify and track supplier evidence, visit AuditReady: https://audit-ready.eu/?lang=en