Question sets
A vendor risk questionnaire asks a supplier the things you cannot establish from their certifications, their website or a credit check. Most organisations send one questionnaire to every supplier, which produces slow, low-quality answers from the suppliers who matter. This page gives three sized question sets, the rule for choosing between them, and what to do with the answers.
Sending one thorough questionnaire to every supplier is consistent and produces the worst available outcome. A long assessment sent to a low-consequence supplier teaches everyone involved that the process is an obstacle, and the critical supplier's response then receives the same attention as the stationery supplier's.
Qeluntra connects authorized supplier, contract, procurement, finance, logistics, inventory, and operating context. AI-assisted recommendations remain explainable and consequential actions remain subject to human approval.
The default behaviour is to build one thorough questionnaire and send it to everyone. It is defensible, it is consistent, and it reliably produces the worst possible outcome, for a reason that is worth stating plainly:
A 250-question assessment sent to a supplier who genuinely presents little risk teaches that supplier — and your own colleagues — that the questionnaire is an obstacle to be cleared rather than a question to be answered.
What follows is predictable. The supplier assigns it to whoever has capacity, answers are copied from a previous response, "yes" appears against controls nobody verified, and the document returns in six weeks. Your team, who have three hundred of these, skim it. The critical supplier's assessment receives the same five minutes as the stationery supplier's, because the process has flattened them.
Shorter questionnaires, sized to consequence, return better data. Fourteen questions that a supplier answers carefully in two days are worth more than two hundred answered carelessly in six weeks — and the time you save is what buys the attention the tier 1 assessment actually needs.
Size the questionnaire on consequence, not on contract value. The three questions below decide it, and any single "yes" promotes the supplier.
| Question | If yes | |
|---|---|---|
| 1 | Will they process personal data, or hold data we would have to disclose a breach of? | Tier 2 minimum |
| 2 | Will they have access to our systems, networks or credentials — including an API key or an OAuth grant? | Tier 2 minimum |
| 3 | Does a business service we could not sustain for 30 days depend on them, or could we not replace them in that time? | Tier 1 |
Special-category data under UK GDPR Article 9, payment card data, or a regulated function each promote directly to tier 1 regardless of the other answers.
Apply this before the questionnaire, not after. A screening form of these three questions plus company identity takes a requester ninety seconds and routes the supplier correctly. Most organisations discover the supplier was tier 3 only after having sent them the tier 1 assessment.
For suppliers with no data, no access and ready substitutes. The purpose is not assurance — it is to confirm the tiering decision was right and to catch the three things that are cheap to check and expensive to miss.
Questions 4, 5 and 6 are re-tiering triggers and should be wired as such. Subcontracting is the one most often skipped, and it is how a tier 3 supplier turns out to be a front for a tier 1 dependency.
For suppliers processing personal data or holding system access, where interruption is disruptive but survivable. The tier 3 fourteen still apply; these are in addition. Grouped so that a supplier can route sections to the right people rather than assigning the whole thing to one person.
The last question is newer than most questionnaire libraries. If a vendor's product embeds an AI system, EU AI Act deployer obligations under Article 26 may attach to you as the organisation using it — human oversight, use per instructions, log retention. A questionnaire with no field for it cannot surface the obligation, and most questionnaires written before 2024 have none.
For tier 1 the instinct is to extend the questionnaire. Resist it. Beyond roughly sixty questions the marginal question returns no information, because the supplier has stopped reading carefully. The tier 1 difference should be in verification, not volume.
Two industry questionnaires come up constantly, and the honest position is that they solve a problem you may not have.
| SIG | CAIQ | |
|---|---|---|
| Maintained by | Shared Assessments | Cloud Security Alliance |
| Scope | Broad third-party risk across many domains | Cloud service controls, mapped to the CSA Cloud Controls Matrix |
| Size | Very large; published in Core and Lite variants | Large, but narrower in focus |
| Cost | Licensed — membership or purchase | Freely available |
| Best when | Regulated sector, and counterparties already respond in SIG | Assessing a cloud service, especially one with a published STAR entry |
The genuine advantage of a standard set is that mature suppliers keep a completed one on the shelf, so you get an answer in days rather than weeks. The genuine disadvantage is that a pre-completed response was written for someone else's risk question, and reading it does not tell you what your exposure is.
A workable compromise: accept a supplier's existing SIG or CAIQ in place of your tier 2 set, then send a short supplementary of the six to ten questions specific to your use of them. You get the speed of the standard response and the relevance of a targeted one, and the supplier is not asked to retype two hundred answers they have already written down.
If they publish a CSA STAR entry, read it before sending anything at all.
The questionnaire is an input, not an outcome. The step that is most often missing is the one that converts it into something with an owner.
And the discipline that makes the whole thing credible: if the answers never change an outcome — if no supplier is ever rejected, re-tiered or required to remediate — then the questionnaire is a ritual, and everyone involved already knows it.
Read back through the five steps above and notice how they divide. Deciding what disqualifies a supplier is judgement and should stay with people. Issuing the right set, chasing it, recording expiry dates, and turning each gap into a register row with an owner is coordination — and coordination is where questionnaire processes actually fail, not at the scoring.
| Step | What it is |
|---|---|
| Screening three questions and routing to a tier | Coordination — and the step most often skipped, which is why tier 3 suppliers receive tier 1 assessments |
| Issuing the right set and chasing it | Coordination |
| Scoring against pre-agreed criteria | Judgement. Agreed in advance, by people |
| Turning gaps into register rows with owners and dates | Coordination — and the step whose absence means findings were noticed rather than managed |
| Recording evidence expiry | Coordination |
| Feeding unacceptable answers into contract negotiation | Both |
In Qeluntra the assessment is a stage a supplier passes through on the way in, rather than a document that comes back by email — so the findings land on the supplier record instead of being copied to it, and the expiry dates are attached to the evidence rather than to someone's calendar.
The check that tells you whether any of this is worth doing. If no supplier has ever been rejected, re-tiered or required to remediate on the strength of a questionnaire answer, the process is a ritual — and automating a ritual produces a faster ritual. Fix that first, with the shorter question sets above, before changing where the process runs.
A vendor risk questionnaire is a structured set of questions sent to a supplier to gather assurance information that cannot be established from their certifications, public filings or website — covering how they handle data, control access, respond to incidents and recover from failure.
It depends on consequence, not contract value. Around fourteen for suppliers with no data and no system access, roughly forty for suppliers processing personal data or holding access, and no more than about sixty for critical suppliers — where the difference should be verification of answers rather than more questions.
SIG is maintained by Shared Assessments and covers third-party risk broadly across many domains. CAIQ is maintained by the Cloud Security Alliance, is freely available, and covers cloud service controls mapped to the Cloud Controls Matrix. SIG suits regulated sectors with counterparties already using it; CAIQ suits assessing a cloud service.
Usually yes, followed by a short supplementary. A pre-completed SIG or CAIQ answers someone else's risk question, so accepting it saves both sides weeks, and six to ten targeted questions about your specific use of the supplier recover the relevance the standard set lacks.
Score them against disqualifying and acceptable criteria agreed before the responses arrive, turn every gap into a supplier risk register row with an owner and a date, record the expiry of every piece of evidence supplied, feed unacceptable answers into contract negotiation, and retain the responses.
They should. Where a vendor's product incorporates an AI system, EU AI Act Article 26 places deployer obligations on the organisation using it — human oversight, use in line with instructions, log retention. A questionnaire with no field for whether the service embeds AI, and whether your content is used for training, cannot surface that obligation.