What is a compliance questionnaire?

A compliance questionnaire works as a written check: the supplier answers each question in the buyer's format, and a senior person signs off on the response. In supplier risk and bid work, it is how a buyer checks a supplier it relies on; within a company's own compliance function, the same term refers to an annual questionnaire in which employees or directors confirm they follow its rules. It usually arrives before a contract is signed or when one is due for renewal.

What a compliance questionnaire asks

Compliance questionnaires cover the laws, standards and policies a buyer has to answer for and passes down to the suppliers it relies on. Typical sections ask about data protection, information security, anti-bribery and corruption, sanctions and export controls, modern slavery and business continuity. Many also ask whether the supplier accepts the buyer's supplier code of conduct, the set of rules the buyer expects every supplier to follow.

The OECD Responsible Business Outlook 2026 shows how widely large companies make public commitments on some of these topics. It finds that 69% of the largest listed companies disclose a commitment covering at least one of human rights, child labour, forced labour, freedom of association, greenhouse gas emissions, biodiversity or corruption. A buyer that has made such a commitment has reason to ask its suppliers about the same topics.

It comes in one of two forms. Many buyers send their own spreadsheet, or ask suppliers to answer in an online portal, a website where the supplier types its answers and uploads files. Others use a standard form, such as the Standardized Information Gathering (SIG) questionnaire from Shared Assessments, built to standardise a buyer's first assessment of its vendors and other third parties.

Many questions ask for both a document and an answer. A business continuity question may ask for the plan itself, and an information security question for a certificate such as ISO 27001. The answer and the document must agree, because the buyer compares one against the other. A supplier that receives many of these can reuse approved answers across buyers, which is the work described in questionnaire response.

Why buyers send compliance questionnaires

A buyer sends a compliance questionnaire because it has to show that it checks the suppliers it relies on. Large companies make public commitments about how they do business, and those commitments reach into their supply chains. The same OECD report finds that around 40% of the largest 10,000 listed companies have disclosed commitments on responsible business conduct in their supply chains.

Making a commitment is one thing, and acting on it is another. The report also finds that only a minority of companies report measures that meaningfully identify and address adverse impacts, meaning the harm their business can do to people or the environment. The gap is widest on human rights and in the supply chain. A supplier's promise adds little to that picture, so a supplier compliance questionnaire asks what the supplier does and can show, not only what it intends.

The same logic applies when a bank, insurer or investor that relies on a supplier sends one. A supplier that breaks the rules exposes the organisation that chose it. At renewal, the questionnaire checks that what held when the contract was signed still holds.

How a supplier answers a compliance questionnaire

Answering a compliance questionnaire means routing each section to the person who knows the facts, gathering the evidence and having one accountable person approve the whole response. Suppose a small software supplier receives one from a buyer as their contract approaches renewal. A coordinator, the person who keeps the response moving, splits the buyer's spreadsheet by section.

Data protection and information security go to whoever runs IT. Anti-bribery, sanctions and the supplier code of conduct go to finance or legal. Business continuity goes to operations. Each person answers their section and supplies the document behind it.

Then comes sign-off, the final approval before anything is sent. In a supplier with a bid team, the bid manager, who owns the response, gives it. In a small business without one, it is often the owner. The person signing reads each answer against its evidence, because every answer is a statement of fact about how the supplier works now, and the buyer may rely on it when deciding whether to renew.

An answer the evidence does not support is a misstatement, regardless of intent. Where a section has no good answer, the honest one includes an explanation. In an EU public tender, each answer is checked against its source before it is sent, because under EU public procurement rules, a serious misstatement can get the supplier excluded.

How it differs from similar questionnaires

A security questionnaire is narrower, a DDQ is wider, an ESG questionnaire follows a reporting framework, and a PQQ belongs to one stage of a tender. One buyer request can contain parts of several.

Security questionnaire

A security questionnaire asks only about information security controls. Its questions cover how the supplier manages access, protects data, handles incidents and recovers its systems. A compliance questionnaire usually includes a security section but goes further, into bribery, sanctions, labour practices and the buyer's code of conduct.

Due diligence questionnaire (DDQ)

A due diligence questionnaire (DDQ) is wider still. Banks, investors and corporate buyers use it to assess a supplier as a whole, so alongside compliance it asks about ownership, finances, governance and operations. A compliance questionnaire focuses on the rules the supplier follows.

ESG questionnaire

An ESG questionnaire, on environmental, social and governance performance, usually follows a published reporting framework and asks for data, such as emissions figures, as well as policies. A request through CDP is one example: the supplier answers CDP's main questionnaire and, on top of it, supply chain questions specific to the buyer that asked. A compliance questionnaire touches some of the same topics, such as labour practices, but asks whether the supplier keeps the rules rather than for performance data.

Pre-qualification questionnaire (PQQ)

A pre-qualification questionnaire (PQQ) belongs to one stage of one tender. That stage is selection, where the buyer decides which suppliers may submit a full bid. A PQQ asks about financial standing, experience and capability alongside compliance, and some questions are pass/fail, meaning a wrong or missing answer removes the supplier before its bid is read. A compliance questionnaire is not tied to a tender stage and can arrive at any point in a buying relationship.