What is a questionnaire response?

A questionnaire response is assembled one question at a time, with each answer coming from the person who knows it or from approved wording. In supplier work, the supplier sends it back to a buyer during a sale, at onboarding or renewal, or at the pre-qualification stage of a public tender. In survey research, the same words mean one participant's answers to a study's questions.

What a questionnaire response contains

Every questionnaire sets the kind of answer each question takes. A questionnaire response therefore mixes fixed-choice answers, Yes or No answers that need an explanation, free-text answers and attached evidence. The subject changes with the questionnaire type. A security questionnaire asks how the supplier protects data, an ESG questionnaire asks about its environmental, social and governance record, and a compliance questionnaire asks how it meets the rules the buyer works under.

A fixed-choice answer is picked from options the buyer lists, such as a drop-down cell in a spreadsheet. A Yes or No answer looks just as simple, but the honest answer can be partial. A control may cover one product and not another, or a policy may exist but be under review. The comment field beside the box is where the supplier states that limit, so the single word doesn't claim more than is true.

Free-text answers describe how something is done, such as how the supplier handles a security incident. Evidence is the document behind an answer, such as a policy, a certificate or an audit report.

The ILPA DDQ 2.0 shows the mix in one form. It is the standard due diligence questionnaire (DDQ) that the Institutional Limited Partners Association (ILPA), the industry body for investors in private equity funds, publishes for assessing fund managers. It links short yes-or-no questions to long-form ones. An appendix then lists the documents and data points that should come with the answers.

How a questionnaire response differs from related terms

The buyer, or the body that publishes a standard questionnaire, sets every question and the format of every answer. The supplier proposes no solution or price and answers what is asked, in the order it is asked.

RFP response

An RFP (request for proposal) asks a supplier how it would meet a need and at what price. The RFP response is the supplier's proposal, so it allows room for the supplier's approach and commercial terms. A questionnaire response has none of that room.

The Consensus Assessment Initiative Questionnaire (CAIQ), a cloud security questionnaire from the Cloud Security Alliance, shows how tight it can be. It is a set of yes-or-no questions about security controls. An RFP response is also written for one opportunity, while questionnaire questions return from buyer after buyer.

The questionnaire itself

The questionnaire is the buyer's document, meaning the questions and the form they arrive in. The response is what the supplier sends back. One questionnaire, such as the CAIQ, can reach many suppliers, while each response belongs to one buyer at one point in time. A response from last year may no longer describe the supplier, even when the questionnaire hasn't changed.

How a questionnaire response comes together

Take a small software supplier, invented for illustration, that receives a CAIQ spreadsheet from a prospective buyer mid-sale. Its response comes together in six steps, from reading the file to answering the buyer's follow-up questions.

The coordinator first reads what the file asks for and when it's due. That includes the return date, the required format and every document the buyer wants included.

Next, each question goes to the person who knows the answer. Hosting questions go to the engineer who runs the infrastructure, and policy questions go to whoever owns the security policy. These colleagues are subject matter experts (SMEs), the people whose knowledge the answers depend on.

Drafting starts from answers the business has already approved for earlier questionnaires, adjusted to this buyer's wording. Where an answer rests on a document, the document goes with it. A supplier holding an ISO 27001 certificate, the international certification for managing information security, or a SOC 2 report, an independent auditor's report on its controls, attaches it. The Cloud Security Alliance's STAR programme pairs exactly this kind of evidence with a CAIQ submission at its Level 2.

Before anything goes back, a named person with the authority to commit the business reads and approves the whole response. In a bid team, that is the bid manager. In a small business without one, it is someone such as the owner.

The completed file then returns in the buyer's format, with the spreadsheet's structure untouched, by email or through the buyer's portal. The buyer may send follow-up questions about an answer or a piece of evidence, and the SME behind that answer supplies the reply. Running these steps across many deals is set out in the questionnaire response process.

What the buyer does with the answers

The buyer reads the answers against its own requirements and checks the evidence against what the answers claim. A certificate counts only for what it covers, so the buyer compares its scope with the service it will actually use.

At a tender's selection stage, the buyer decides which suppliers qualify before reviewing their offers. The PQQ response, the answers to a pre-qualification questionnaire (PQQ), is the tender-stage kind of questionnaire response, where the answers decide selection.

Why suppliers keep a library of approved answers

Suppliers keep a library of approved answers because the same questions come back from many buyers, who use the same standard questionnaires. ILPA says its DDQ is meant to standardise the main areas investors ask about when they assess fund managers. A manager answering that form for a second investor meets questions it has answered before.

This library lets the business answer each recurring question once, validate it, and reuse it. Each answer has an owner, the person responsible for keeping it accurate. It also has a review date, after which it is checked again before reuse.

An answer goes out of date when what it describes changes, such as a renewed certificate, a rewritten policy or a new hosting arrangement. Without a library, each questionnaire starts from a blank file, and answers to the same question can drift apart from one buyer to the next. In practice, answering questionnaires starts with such a library.