Can you trust a tool with your questionnaires?

A questionnaire still arrives as the buyer's workbook, and answering it by hand means copying past answers into it row by row, chasing experts for gaps, and putting the layout back before it goes out. Questionnaire automation drafts each answer from content your team has already approved and returns the buyer's file with the answers in place. Drafting alone tells you little about whether you can trust a tool. Trust depends on the work around the draft: reading the file down to its dropdown choices and tabs, declining to answer where no approved source exists, putting a named approver on every question and sending the file back intact. A run on a questionnaire you've already submitted tests exactly that.

SEQUESTO reads the buyer's file, drafts each question from the Knowledge Hub, and exports the file in its own structure. For the wider practice around the tool, see our article on questionnaire response.

How questionnaire automation works, one file from upload to export

Questionnaire automation takes the buyer's file in, turns it into a question list, drafts each answer from approved content, sends what it can't source to an expert, records a named approval and exports the original file. The example below is an illustration, not a customer case. A bank is assessing you as a third party and sends a due diligence workbook. It has several tabs, a yes-or-no dropdown beside many questions with a comment cell next to it, and a request to attach your SOC 2 report.

James, the agent your team works with in SEQUESTO, orchestrates the run. He decides what to do next and when to call Agent Force, the specialist agents that handle extraction and drafting.

Reading the buyer's file

The specialist agents read every tab into one question list. Each question keeps its section, category, weighting and whether it's required. In an Excel file, the agents also read the dropdown options behind each field, so answers to the bank's yes-or-no fields stay within the choices the workbook allows. Word and character limits come out with the questions, so your team can check them before submission. A Word questionnaire, a structured PDF form or a scan is handled the same way, and scans are read with OCR.

Drafting from approved answers

For each question, retrieval searches the Knowledge Hub by meaning and returns matches with a confidence score and the source snippet. The draft is built from that approved content, the project's own context and any connected systems. It shows the sources it drew on and the reasoning behind it. For the bank, the team can limit the search to one service line, so the workbook draws only on relevant material. An answer on access control cites the policy document and clause it comes from, and the SOC 2 report is attached to the answer that asks for it.

Routing the questions with no source

A question the Knowledge Hub can't answer gets a low confidence score and goes to a named person, such as a question from the bank about an arrangement your library has never covered. It is flagged for an expert's input rather than drafted on a guess. Where the question asks for evidence, and nothing in the library fits, the search names the kind of document that would close the gap. The expert therefore gets a specific request rather than a blank cell.

Review and approval per question

Each question carries its own owner, status, deadline, reviewer and approver. The bank's security questions go to your security lead, the contractual ones to legal and the technical ones to the expert who owns them. Each reviewer sees what the system did and can accept, adjust or reject the draft. Approval is a person's decision, made question by question, and compliance, legal and technical reviews each follow their own route.

Returning the file

Once the answers are approved, the export fills the bank's own workbook. It keeps the workbook's structure, sections, and order, including every tab. A Word questionnaire or a buyer's PDF form works the same way: the answers go back into the buyer's own document and format.

What it does not do, and what stays with your team

The tool drafts and routes, but it doesn't submit, approve or answer a question it has no source for. The approval itself, and the judgement behind it, stay with your team.

Limits of the tool

The tool doesn't submit anything. A person on your team takes the export and submits it in the buyer's portal. It doesn't approve either: final wording and sign-off stay human, and James asks before taking any action outside the project's agreed scope. As described above, it routes a question without a source to an expert rather than answering it.

The tool also can't make a grounded draft certain. The Stanford HAI AI Index 2026 reports results from the hallucination leaderboard Vectara runs. The leaderboard measures how often models add false information when summarising documents they are given, and the top 15 models score 1.8% to 5.4%. That test uses news articles, not questionnaires, but the lesson carries over. Working from a supplied source doesn't eliminate errors, so each answer still needs a reader to check it against its source.

What your team keeps

Your team decides how deeply to review, and organisations differ widely. In McKinsey's survey on the state of AI, 27% of respondents whose organisations use gen AI said employees review all its content before using it. A similar share said 20% or less is checked. A bank or insurer will rely on your questionnaire answers, so set review depth per question type before the work starts. Decide which questions get a full check against their source and which get a lighter read, then build that into the review chain.

The library also stays your team's work. People approve content before the Knowledge Hub counts it as approved, and approved answers flow back into it after each response. Each item keeps an owner, a review cycle and an expiry date, and expired items are flagged before they reach a draft. The platform keeps the dates, but someone on your team still has to own each answer and act when its review comes due. We cover that in more depth in how to build an auditable library.

Where it fits in SEQUESTO aOS

In SEQUESTO aOS, questionnaire automation is not a single feature. It is four of the eight layers working together, with the bid manager signing off at the end.

Where it sits in the layers

• Context & Knowledge holds the Knowledge Hub, reads the buyer's file in and retrieves approved content with its confidence score.
• Agent Force carries out the work. James orchestrates, deciding what comes next and which agent to call, and the specialist agents extract the questions and draft the answers.
• Bid Capabilities holds the configurable workflow: the per-question owners, reviewers and approvers, and the export.
• Security & Governance logs every action with its actor, timestamp and item. The log runs from ingestion and retrieval through agent invocations, edits, permission changes, approvals, and export.

The log is searchable and exportable for a compliance review or a customer's due diligence questionnaire. It shows who approved each answer and when, while the draft shows where the answer came from. Access is set by user and role down to file and folder level, and content doesn't cross project boundaries.

The pillars it carries

In our view, questionnaire automation carries all three of SEQUESTO's value pillars, in this order. Governance comes first: the run follows your own workflow, with the review chains and approval logic you set. Human-in-control follows. James orchestrates, and Agent Force executes, while the bid manager owns strategy, tone, and the final word, and carries legal accountability for every answer. Auditability completes it: each answer is cited to its source and traceable.

The buyer's side gives this extra weight. Gartner predicts that by 2028, 70% of organisations and vendors will use generative AI to complete and analyse third-party cyber-risk management questionnaires. Gartner advises CISOs to have human analysts validate that work for critical third parties. If you're a critical supplier, a model may read your answers, and then an analyst may check them. When the analyst comes back with a question, an answer with a cited source and a named approver is the one you can defend. What makes a security answer hold up under that scrutiny is covered in defensible security questionnaire answers. McKinsey's authors make a similar point from the user's side: companies that report capturing value from gen AI build human-in-the-loop mechanisms into their processes to validate its outputs.

Test it on a questionnaire you have already submitted

Test any questionnaire tool on a questionnaire you've already submitted. Your own team runs it against your current method, with the submitted file as the answer key. A demo on a vendor's material is chosen to go well, while your own closed file includes your tabs, your gaps, and your approvers.

Setting up the run

Pick a closed questionnaire with the parts that break most easily: several tabs, dropdown fields, attachments the buyer asked for and word limits. Freeze the library as it stood on the submission date, and remove the submitted answers themselves so that no option can copy them back. Then seed known gaps. Before the run, take out the approved source for several questions, and record which ones without telling whoever operates the tool.

Run your current method on the same file, with the same frozen library and the same people. That method might be a general-purpose assistant such as ChatGPT, Microsoft Copilot, Claude or Gemini, which writes a decent first draft fast for whoever is typing. It might also be a library with AI added, an in-house build or a purpose-built response platform. If your team works in Copilot today, this comparison sets out keeping it against switching.

Pass and fail criteria

Set each criterion before the run, and judge every option the same way.

• The file comes back intact. Judged once per file: every tab, row and column is in its original order, and the file is ready to submit without reformatting.
• Dropdown fields hold allowed choices. Judged per instance, with a limit of zero.
• Seeded gaps are flagged, never answered. Judged on every seeded gap, and a single answered gap fails the option. Seed enough gaps that a lucky pass is unlikely.
• Every draft shows a source the reviewer can open. Judged per instance, with a limit of zero.
• Limits and instructions are kept. Judged on every answer: a single breach of a word or character limit, or of the questionnaire's own instructions, fails the option.
• Every answer records a named approver and a time. Judged once per file.
• Drafts hold up against the answer key. Judged against a preset threshold. The share of drafts a reviewer accepts without changing a fact, figure, or commitment must at least match your current method's share on the same file.

Counting the cost and deciding

Log every contributor's hours, by person and by question. That means the bid manager, writers, experts, legal and security. Put each hour in one column only: answering a gap or reviewing a draft. The split matters because weak drafts move work onto whoever receives them. Research by BetterUp Labs and Stanford, published in Harvard Business Review, found that in the US, 41% of workers surveyed received low-quality AI-generated output, costing nearly two hours of rework each time. That study wasn't about bid teams, but on a questionnaire the people receiving the drafts are your experts and reviewers.

Then add the costs that repeat for each option: set-up, clearance by InfoSec and information governance, and training for everyone who contributes. Record them for your current option too, including what its existing clearance took. Keeping what you have still means your team must assemble and maintain the process around the tool. An in-house build also needs permissions per contributor, review and sign-off per question, an approved answer library, and evaluation of answer quality as models change. It also needs someone to run it when its builder moves on. A build suits a team with ongoing engineering capacity and one simple, stable process.

The decision rule follows from the criteria. Any option that fails a pass or fail criterion is out. Among the remaining options, the one with the fewest total hours to a submittable file, plus its repeating costs, wins. Quality has already been counted in the threshold, so don't add it a second time. If the difference from your current method is smaller than a margin you set before the run, keep what you have, because switching also means moving your library.

Pick the questionnaire and freeze the library before anyone books a demo.