What are Questionnaires

A questionnaire is the fixed instrument itself: a defined list of questions, presented in a set order and format, that every respondent answers under the same conditions so their answers can be compared or scored. The questions are there to obtain specific information, statistical or personal, from each person answering, and the instrument itself is a document, on paper or on screen, with a defined space for every answer. That basic shape (fixed questions, structured answer fields, a defined respondent population) is what allows a questionnaire to function as an evaluation tool rather than a piece of open correspondence.

What a Questionnaire Is

Structure and purpose

A questionnaire exists to make many answers comparable, not merely to collect information. Its purpose is evaluation or decision-making: someone will read the completed instrument, score it, or use it to make a judgement about the respondent.

The mechanism is standardisation. Every respondent sees identical wording, identical question order, and usually identical answer formats (multiple choice, scaled, free text, or document upload). This removes the variation that would otherwise creep in if each respondent were simply asked to describe themselves in their own words.

The consequence is that a questionnaire's design constrains what can be learned from it. A poorly worded question produces poor data no matter how rigorously the responses are scored afterwards, which is why questionnaire design in procurement and compliance is treated as a governance exercise, not an administrative one.

Questionnaire versus survey

A questionnaire is the instrument; a survey is the process of administering it, collecting responses, and analysing results. The two terms are frequently used interchangeably in casual speech, but the distinction matters in commercial and research contexts because it separates the design artefact from the exercise that uses it.

A single questionnaire can be reused across many surveys, and the same survey can sometimes combine several questionnaires (for example, a security questionnaire and a financial-standing questionnaire administered together as part of one vendor onboarding exercise). The instrument is fixed; the administration is variable.

For a responding organisation, this distinction is practical rather than academic. The questionnaire dictates exactly what must be answered and how; the surrounding survey process dictates deadlines, scoring weightings, and who on the buying side reviews the answers. Confusing the two leads teams to negotiate the wrong thing at the wrong stage.

Common formats

Questionnaires appear as printed forms, online portals, spreadsheets, and, increasingly, structured fields inside procurement or vendor risk management platforms. The format affects how answers can be reused and audited.

A questionnaire's questions can be open-ended, closed-ended (yes/no, multiple choice, Likert scale), or a mix of both, administered over the phone, online, or in person. Closed formats support scoring and comparison; open formats support nuance but complicate consistent evaluation across many respondents.

In commercial procurement and compliance settings, spreadsheet and portal formats allow answers to be exported, versioned, and mapped against evidence documents. A questionnaire delivered as an unstructured document, such as a letter of questions embedded in prose, is harder to score consistently.

Questionnaires in Procurement

Pre-qualification questionnaires (PQQ)

A pre-qualification questionnaire is a list of questions that contractors or suppliers must answer before being allowed to bid, used by buying organisations to shortlist candidates efficiently. The London Chamber of Commerce and Industry describes pre-qualification questionnaires as giving buying organisations an efficient way to shortlist suppliers by scoring their responses.

The mechanism is a gate placed before the main tender. Rather than evaluating full proposals from every interested supplier, the buyer filters candidates on baseline capability, financial standing, and compliance history using a shorter, standardised instrument. Only those who clear the bar proceed to the substantive bid.

For suppliers, this means a PQQ failure ends participation before technical or commercial merit is even assessed. Answers to a PQQ are typically factual and evidentiary (turnover, insurance levels, past performance) rather than persuasive, so accuracy and completeness matter more than framing.

Procurement specific questionnaires (PSQ)

A procurement specific questionnaire is a standardised pre-qualification document that lets suppliers demonstrate compliance and capability when bidding for above-threshold government contracts. It replaced earlier standard selection and pre-qualification questionnaires used in UK public procurement, consolidating similar requirements into a single recognised format.

The mechanism is standardisation across buying authorities. Rather than each public body designing its own bespoke pre-qualification form, a PSQ applies a common structure so suppliers answer broadly comparable questions regardless of which authority is running the tender. This reduces duplicated effort for suppliers who bid into multiple public-sector processes.

A practical limit remains: standardisation covers the general capability and compliance questions, but authorities can still add sector-specific or contract-specific supplementary questions. Suppliers should not assume a PSQ response prepared for one tender transfers unmodified to another without review.

Business questionnaires in public tenders

A business questionnaire in public procurement is a formal document gathering key information about a supplier's capability, experience, financial standing, and regulatory compliance before the supplier progresses to the main tender stage. It functions as the evidentiary backbone of the qualification stage.

The mechanism is disclosure structured for comparison across bidders: turnover over recent financial years, relevant contract references, insurance certificates, and statutory compliance declarations are requested in a fixed format so evaluators can score them against defined thresholds. In the United States, the Federal Transit Administration notes that bidder's qualification questionnaires are required components of bids for many public works and service contracts above specified monetary thresholds and must be submitted as part of the bid documentation.

The consequence for suppliers is that business questionnaire answers are frequently reused across many bids, since the underlying facts (turnover, certifications, references) change infrequently. Maintaining an accurate, current source of these answers reduces the risk of submitting stale or contradictory figures across simultaneous bids.

Security and Compliance Questionnaires

Security questionnaires

A security questionnaire is a structured set of questions used to assess a vendor's security posture, typically before onboarding, after onboarding, or periodically when services or data handling practices change. It is a compiled list, often technical and detailed, aimed at determining a company's security and compliance standing.

The mechanism is self-attestation supported by evidence. Vendors answer questions on access controls, encryption, incident response, and governance, often supplying supporting documents such as penetration test summaries or certification letters alongside narrative answers. The buyer's security or procurement team then scores the response against internal risk thresholds.

Security questionnaires remain a foundational tool in third-party risk management precisely because they provide structured, self-attested data about vendors' controls, governance, certifications, and incident response capability in a form that is comparable across many vendors. Their limit is that they rely on self-reporting; a questionnaire alone does not verify a control exists, which is why buyers frequently pair questionnaire responses with audit reports or independent certifications.

Security compliance questionnaires

A security compliance questionnaire is a document organisations use to determine whether their vendors are complying with specified security standards. Where a general security questionnaire probes posture broadly, a compliance questionnaire ties questions directly to a named standard or regulatory obligation.

The mechanism is mapping: each question corresponds to a specific clause, control, or regulatory requirement, so the completed questionnaire doubles as a compliance record. This structure makes it straightforward for a buyer to demonstrate, in its own audit trail, that it checked a vendor against a defined standard rather than an informal set of concerns.

A consequence for the responding vendor is precision of language. Answering "yes, we encrypt data" is not equivalent to answering against a specific clause requiring encryption at rest and in transit using a named algorithm standard; compliance questionnaires generally demand the latter level of specificity, and vague answers are frequently returned for clarification.

ISO 27001-aligned questionnaires

An ISO 27001 questionnaire is a set of questions evaluating how an organisation manages information security in conformity with the ISO/IEC 27001 standard, acting as a control checklist across domains such as security policies, access management, and data protection. It is one of the most common frameworks used to structure security questionnaires because the standard's control domains map naturally onto question sections.

The mechanism is alignment rather than certification transfer: a vendor holding ISO/IEC 27001 certification can often answer such a questionnaire quickly by referencing its Statement of Applicability and audit certificate, since the certification body has already independently verified the underlying controls. Vendors without certification must answer each control question from first principles.

The practical limit is scope. ISO/IEC 27001 certification covers a defined information security management system boundary, which may not extend to every system or business unit a buyer cares about. A vendor citing certification in response to an ISO-aligned questionnaire should confirm the certified scope matches what the buyer is asking about.

Standardized Information Gathering (SIG) questionnaire

The Standardized Information Gathering questionnaire is a holistic set of questions covering multiple risk domains, designed to collect consistent third-party risk information and evaluate vendors' security posture within a broader third-party risk management programme. It exists to reduce the proliferation of bespoke security questionnaires across the industry.

The mechanism is a shared question bank. Rather than each buyer designing its own vendor security questionnaire from scratch, buyers adopt a common set of questions covering domains such as access control, business continuity, and data privacy, and vendors can prepare a single master response set that answers most or all of it.

The benefit to vendors that answer many security questionnaires is reuse: a well-maintained SIG response can be adapted to buyer-specific supplementary questions rather than rebuilt from zero each time. The limit is that buyers still commonly layer their own additional questions on top of the standardised set, so a SIG response reduces effort without eliminating bespoke work entirely.

Vendor Risk and Due Diligence

Vendor risk assessment questionnaires

A vendor risk assessment questionnaire evaluates a vendor's risk profile across areas including cybersecurity practices, compliance with data protection regulations, financial stability, and operational reliability. It is broader in scope than a pure security questionnaire, since it also probes business continuity and financial risk rather than technical controls alone.

The mechanism is multi-domain scoring: a vendor risk assessment questionnaire typically produces a composite risk score or rating across several categories, which a buyer's risk or procurement function uses to decide whether to onboard, monitor more closely, or decline a vendor. Answers in one domain (say, financial instability) can offset strong answers in another (say, security maturity) when the composite score is calculated.

A standardised set of questions used specifically to evaluate how third-party vendors handle security, protect data, and manage cyber risk is sometimes issued as a narrower subset of this broader questionnaire, focused only on the cybersecurity dimension. Vendors should confirm which scope they are being asked to complete before drafting answers, since a narrow security response will not satisfy a full risk assessment request.

Due diligence questionnaires

A due diligence questionnaire is a comprehensive instrument used to assess a potential investment opportunity, business partnership, or merger and acquisition, gathering information about a company's operations, financial performance, legal compliance, and other key areas. It differs from procurement and vendor risk questionnaires in stakes and depth: the answers can materially affect a transaction's valuation or completion.

The mechanism is disclosure structured to surface liabilities before capital changes hands or a partnership is formalised. Questions typically span corporate structure, litigation history, material contracts, intellectual property ownership, and regulatory standing, each requiring supporting documentation rather than narrative alone.

Because due diligence questionnaire answers often feed directly into transaction documents or warranties, inaccuracies carry legal consequence beyond a lost sale. Organisations answering them typically route responses through legal review before submission, unlike routine procurement questionnaires, which are more commonly cleared by bid or sales teams alone.

NIST supply chain risk questionnaires

A supply chain risk management assessment scoping questionnaire outlines the key information required to define a system's boundaries, operations, and supporting architecture before detailed risk analysis begins. The National Institute of Standards and Technology includes such a questionnaire within its supply chain risk management guidance as a preparatory step ahead of deeper assessment.

The mechanism is scoping before scoring: rather than jumping straight to control-by-control evaluation, the questionnaire first establishes what system, vendor relationship, or supply chain segment is under review, and what its boundaries are. This prevents a subsequent detailed assessment from being misapplied to the wrong scope.

The practical consequence is sequencing. Organisations following this approach should expect a scoping questionnaire to precede, not replace, a fuller technical risk assessment, and should treat early scoping answers as the foundation that later, more detailed questionnaire responses will need to remain consistent with.

The Responding Organisation's Perspective

Workload and coordination

Answering questionnaires, particularly security and compliance ones, is a cross-functional workload spanning security, legal, compliance, and sales or bid teams, not a task any single function can complete alone. A single vendor risk assessment questionnaire can touch technical controls, contractual terms, financial disclosures, and certifications in the same document.

The mechanism that makes this workable at volume is coordination: a bid or proposal function typically owns the questionnaire end to end, routing individual sections to the subject-matter expert best placed to answer accurately, then consolidating and reviewing the assembled response before submission.

Without that coordination, questionnaires are frequently answered inconsistently by whoever happens to receive the request, which increases both turnaround time and the risk of factual error. Organisations that field many questionnaires each year typically formalise ownership rather than leaving it ad hoc.

Risk of inconsistent or inaccurate answers

Inaccurate or inconsistent questionnaire answers create legal, commercial, and reputational exposure for the answering organisation, not merely an administrative inconvenience. A misstated control in a security questionnaire, if relied upon by the buyer, can constitute a misrepresentation with contractual consequences.

The mechanism behind this risk is reliance: buyers use questionnaire answers as the basis for onboarding decisions, risk ratings, or contract terms, so an answer given carelessly is treated with the same weight as one given carefully. There is no formal distinction in most processes between a rushed answer and a verified one.

Inconsistency across simultaneous questionnaires compounds the risk. If two buyers separately verify a vendor's answers and find contradictory figures on the same underlying fact (for example, headcount or certification status), the discrepancy itself becomes a red flag independent of whether either individual answer was accurate.

Response libraries and reuse

A response library is a maintained repository of previously approved questionnaire answers that an organisation draws on to answer new questionnaires more quickly and consistently. It addresses the volume problem created by fielding many overlapping security, compliance, and procurement questionnaires each year.

The mechanism is reuse with review: rather than drafting each answer from scratch, a bid or compliance team retrieves the closest matching prior answer, checks it against current facts and evidence, and adapts it to the specific question's wording before resubmission. This is faster than fresh drafting but only as reliable as the currency of the library itself.

A library that is not actively maintained becomes a liability rather than an asset, since a stale answer reused without review can reintroduce exactly the inconsistency and inaccuracy risk described above. Organisations that rely heavily on response libraries generally assign explicit ownership for keeping entries current against certifications, policies, and control changes.

Questionnaires in the Wider Bid and Compliance Ecosystem

Relationship to RFPs and tenders

Questionnaires are frequently embedded within, or run alongside, requests for proposals and tenders rather than existing as fully separate processes. A pre-qualification questionnaire commonly precedes the main RFP stage, while security and compliance questionnaires are often appended as schedules to the RFP itself.

The mechanism is sequencing within a single procurement lifecycle: qualification questionnaires filter candidates, the RFP evaluates the shortlisted proposals on merit and price, and supplementary questionnaires (security, compliance, financial) sit alongside the proposal to provide the evidentiary detail a narrative response cannot efficiently carry.

Treating these as one connected exercise rather than isolated documents matters because inconsistency between a proposal's narrative claims and a questionnaire's factual answers is a common source of evaluator concern. A supplier claiming strong security maturity in prose while giving thin or generic answers in the accompanying security questionnaire undermines both.

Relationship to contracts and audits

Questionnaire answers frequently become reference points in the resulting contract and in subsequent audits, rather than disappearing once a decision is made. A due diligence questionnaire's disclosures can be incorporated into transaction warranties; a vendor security questionnaire's answers can be referenced in service agreements or reviewed again during periodic vendor audits.

The mechanism is traceability: buyers keep completed questionnaires on file specifically so that, if a control fails or a dispute arises later, they can check what was originally represented against what was actually in place. This gives the questionnaire a life well beyond the procurement decision it originally informed.

For the responding organisation, this means questionnaire answers should be treated with the same care as a contractual statement, since that is effectively what they may become. An answer given loosely during a fast-moving sales cycle can resurface, unchanged, during an audit conducted years later.