Every other guide either gates the templates behind an email address or pushes you towards a 300-question enterprise framework your vendors will immediately ignore. This page gives you complete, ready-to-send questionnaire templates across all four risk categories — with actual questions, response rate tactics, red flag guides, and a free tool to send and track automatically.
Your vendor's insurance certificate tells you their coverage exists. Their ISO 27001 certificate tells you they passed an audit. Neither tells you whether their business would survive the departure of one key person, whether they've had a data breach in the last 12 months, or whether your account represents 40% of their revenue — and they'd struggle to refuse any request you made.
A vendor security questionnaire fills those gaps. It is the structured conversation between you and a supplier that document collection cannot replace. Used properly, it surfaces the operational, financial, and compliance risks that sit between the lines of certificates and contracts.
The term "security questionnaire" undersells the scope. Yes, it covers information security. But a proper supplier risk assessment questionnaire covers four distinct risk categories: information security, financial stability, operational resilience, and compliance and ethics. Focusing on security alone — which is what every enterprise TPRM vendor pushes — misses three-quarters of the actual risk picture for most SMBs.
The insurance certificate is the most common failure point in vendor risk management for small businesses. But the second most common? A supplier who goes insolvent, is acquired, loses a key person, or suffers an undisclosed data breach — and none of those risks appear in any document. They only appear in a questionnaire — if you ask the right questions.
New supplier onboarding: Before a supplier starts handling your data, accessing your systems, or becoming operationally critical. This is the highest-leverage moment — before the relationship creates lock-in.
Annual re-assessment: Supplier risk is dynamic. A business that passed your questionnaire 18 months ago may have changed ownership, lost key certifications, suffered a breach, or become financially distressed. Annual questionnaires catch the drift.
Triggered reassessment: A news alert about a supplier. A contract renewal. A customer asking about your third party risk assessment process. Any of these should trigger an unscheduled questionnaire to the relevant supplier.
Enterprise vendor security questionnaires — SIG, CAIQ, NIST 800-53 — were designed for large organisations with dedicated security teams on both sides. Sending them as an SMB doesn't make you look thorough. It means your vendors ignore them.
The vendor response rate is the single most important metric in a questionnaire programme. A 25-question questionnaire with 75% response rate gives you more risk intelligence than an 800-question framework where 80% of vendors never respond.
Four complete questionnaire templates, each designed for a specific risk category. Every question includes the response format, the risk flag level, and why it matters. Use them as-is or adapt to your context.
Every guide covers what to ask. None cover the most common practical problem: vendors who don't respond. Low response rates mean incomplete risk data, which means a risk programme that looks thorough but has gaps where your most evasive suppliers sit.
Questionnaires sent from "compliance@company.com" or "noreply@vendorauditly.io" are treated as automated bulk mail. A questionnaire sent from "sarah@yourcompany.com" with a personal intro line gets treated as a direct request from a named colleague.
The subject line should include the sender's name, your company name, and a specific deadline: "Security questionnaire from Sarah at [YourCo] — response by 15 May."
+35–40% response rate upliftThe first chase at 7 days should be a gentle nudge: "Just checking this didn't get lost." The second chase at 14 days should escalate: "We need this completed before we can proceed with our upcoming contract renewal."
Manual chasing is the most common failure point in SMB questionnaire programmes — it requires consistent human effort that gets deprioritised. Automated chasing at scheduled intervals removes that dependency entirely.
+20–25% response rate from non-respondentsEvery question beyond 25 costs you completion rate. The research is consistent: questionnaires in the 15–25 question range achieve 60–80% completion. Questionnaires with 50+ questions achieve under 30%. You are not running an academic study — you are gathering risk intelligence. Shorter questionnaires that get answered are infinitely more valuable than comprehensive questionnaires that don't.
2.5× higher completion vs 50+ questionsAny questionnaire tool that requires the vendor to create an account loses 40–50% of potential respondents before they even see the first question. Vendors receive dozens of questionnaire requests. They will always prioritise the ones with the lowest barrier to respond.
VendorAuditly sends questionnaires via a direct, access-controlled link. Vendors click, answer, and submit — no account, no login, no software installation required on their side.
−50% response rate if account required5 days is too short — it signals urgency that creates resistance and creates scheduling conflicts for small businesses. 30 days is too long — it gets deprioritised until it becomes urgent, and by then you've probably chased twice already. 14 days is the right balance: respectful of their time while maintaining momentum.
Optimal completion window by behaviour researchThe most effective sentence in any questionnaire request: "Completion of this questionnaire is a requirement for our contract renewal process." Vendors who understand there is a commercial consequence for non-response respond at dramatically higher rates than vendors who see it as optional goodwill.
This is honest — completing your questionnaire programme is a genuine requirement of your supplier management process. Frame it as such.
+25–30% response rate from low-priority vendorsKnowing what to ask is only half the problem. Knowing what to do with the answers — especially the concerning ones — is what most guides skip entirely. This is the red flag answer guide: specific responses, what they signal, and exactly what action to take.
| Answer received | Severity | What it actually signals | What to do |
|---|---|---|---|
| "Yes, we had a breach 8 months ago" with no follow-up detail | Critical | An admitted breach with no documented remediation suggests either the remediation didn't happen or they don't know what the remediation should have been | Request a written incident report, a list of what data was affected, evidence of ICO/regulator notification, and the specific controls implemented as a result. Do not proceed without this. |
| Question left blank with no explanation | Critical | Blanks are never neutral. Either the vendor can't answer (the control doesn't exist), won't answer (deliberately hiding something), or didn't read the question (poor governance culture) | Treat every blank as a "no" until proven otherwise. Follow up directly requesting an explicit answer. A vendor who leaves blanks repeatedly on a risk questionnaire has a governance culture that should concern you. |
| "Our SOC 2 is in progress" or "ISO 27001 planned for Q3" | High | This is a future intent, not a current control. The vendor does not have the certification today. They may never complete it. | Treat as if no certification exists. Ask what compensating controls are currently in place. Add a contract clause requiring notification when certification is achieved, and schedule a reassessment within 6 months of their stated target date. |
| "We use a few third-party tools but nothing significant" | High | Vague sub-processor disclosure. Under GDPR, "nothing significant" is not a compliant answer. The vendor either doesn't know which tools process your data or is deliberately under-disclosing. | Request an explicit list of every tool that stores, processes, or transmits data you've provided. Confirm country of processing for each. Update your DPA to include all disclosed sub-processors. |
| "Your account represents approximately 35% of our revenue" | Critical | Extreme dependency risk on both sides. Financial distress if you reduce spend. Potential reluctance to refuse unreasonable requests. Risk to their viability if you leave. | Accelerate diversification planning immediately. Increase financial monitoring frequency. Consider whether the service should be brought in-house or dual-sourced. Do not enter a long-term contract without addressing this. |
| "Yes, but they all report to James and James handles it" (to key person question) | Critical | Single point of failure confirmed. Your entire service delivery depends on the availability, health, and continued employment of one named individual. | Request a written introduction to a named backup and a documented knowledge transfer plan. Add a contract clause requiring 90 days' notice if James is to leave. Schedule a follow-up call to assess the backup's actual capability. |
| "We don't have a formal BCP but we're pretty resilient" | High | No documented, tested recovery process. "Pretty resilient" is assurance based on optimism, not evidence. For a critical supplier, this is an operational risk requiring remediation. | Request a written BCP within 60 days as a contract requirement. Include minimum standards: documented RTO, named recovery team, alternative location or working arrangement, testing schedule. |
| "We notify customers within a reasonable timeframe" (breach notification) | High | No defined notification timeline. "Reasonable timeframe" is not GDPR-compliant (72 hours) and means you could discover a breach affecting your customers significantly after the regulatory clock started. | Require a specific written commitment to notify you within 24 hours of discovery. Add this to your DPA as an explicit obligation. This is a non-negotiable requirement for any supplier handling personal data. |
VendorAuditly's AI summarisation automatically flags unusual answers — including vague responses, admitted incidents, and missing information — without requiring manual review of every questionnaire response. Your time goes to resolution, not detection.
Try it free →A questionnaire is only useful if the responses feed into a consistent risk score that drives action. This is the scoring framework that works for an ops manager — not a CISO.
What percentage of questions did the vendor actually answer? Every blank or "not applicable" that isn't justified reduces the completeness score. An 80% completeness score means 20% of your risk intelligence is missing.
How many answers triggered a red or amber flag? Each flag represents a risk that needs investigation or remediation. The flag count — weighted by flag severity — is the most direct indicator of the overall risk level from the questionnaire.
For questions that require evidence upload — certifications, insurance certificates, policies — did the vendor provide credible, current documentation? Stated certifications without uploaded evidence are unverified claims, not confirmed facts.
Are free-text answers specific and credible, or vague and boilerplate? "We take security very seriously and have robust controls in place" is not an answer. "We use a zero-trust architecture with MFA enforced via Okta, reviewed quarterly" is an answer.
VendorAuditly's AI summarisation analyses every response and produces a plain-English summary with automated flag detection — covering completeness, evidence verification, and response quality. No security expertise needed to interpret the results.
See how it works →SMBs sit in the middle of the questionnaire ecosystem. You send questionnaires to your suppliers. Your enterprise customers send questionnaires to you. Most guides address one side or the other. This section addresses both — because the operational burden of receiving questionnaires is one of the most under-discussed problems in SMB compliance.
If you sell to enterprise customers, you probably receive 5–20 security questionnaires per year. Each one asks variations of the same questions — but in different formats, different platforms, and with different deadlines. Sales teams estimate that answering questionnaires costs 10–20 hours per deal in engineering time.
The most common questionnaire questions are predictable: ISO/SOC 2 certification, insurance coverage, data breach history, sub-processor list, encryption standards, access control processes, BCP status. Build a master answer bank for these 20 questions once — and update it when anything changes.
Enterprise buyers in procurement processes consistently report that suppliers who respond to security questionnaires within 24–48 hours with complete, credible answers win deals over slower, less-prepared competitors — even when the underlying security posture is similar.
Enterprise questionnaire frameworks are the gold standard for large organisation TPRM. For SMBs sending questionnaires, most are disproportionate. For SMBs receiving questionnaires from enterprise customers, knowing what each framework covers is essential for responding efficiently.
The most widely used enterprise TPRM questionnaire framework. Covers 18 risk domains including security, privacy, compliance, and resilience. SIG Lite is a condensed version with 128 questions — still substantial but more manageable.
Developed by the Cloud Security Alliance (CSA) for cloud vendor assessments. Maps to the CSA Cloud Controls Matrix. Primarily relevant for SaaS vendors and cloud service providers being assessed by enterprise customers.
A US government framework providing guidelines for managing cybersecurity risk. Increasingly referenced in questionnaires from US government contractors and financial services customers. Structured around Identify, Protect, Detect, Respond, Recover.
A vendor security questionnaire developed by a coalition of technology companies. Covers security policy, data protection, reactive security, compliance, and supply chain management. Shorter and more practical than SIG or CAIQ — closer to what SMBs actually need.
A condensed questionnaire designed specifically for smaller organisations — explicitly avoiding areas where small businesses are typically less mature (like formal security policy frameworks). Focuses on backup processes, email security, and basic access controls.
Purpose-built for SMBs sending questionnaires to their 15–150 suppliers. Covers all four risk categories with questions at the right depth for a business owner or ops manager to answer. Optimised for response rate, not comprehensiveness for its own sake.
Most SMBs run their vendor questionnaire programme through email. It works — until you have 40 suppliers, 4 questionnaire templates, staggered deadlines, multiple chasers, and a spreadsheet tracking who responded to what. Here's what the automated version looks like.
Choose from your four category templates or a custom questionnaire. Assign it to a vendor in your risk register. The system pre-fills the vendor contact details and your company information.
One click sends the questionnaire from your named email address. The vendor receives a direct, access-controlled link. They click, answer, upload evidence, and submit. No account creation, no software download.
If the vendor hasn't responded by day 7, an automated reminder fires. By day 14, a second reminder with escalated language. Both are personalised with the vendor name and your deadline. You receive a notification for any vendor who still hasn't responded after the second chase.
Submitted responses are analysed by AI. Every blank, unusual answer, or flag-triggering response is surfaced in a plain-English summary. You see the risk findings immediately — without reading every answer.
Questionnaire completeness, flag count, and evidence quality automatically update the vendor's risk score. You see the impact immediately in the dashboard. The audit trail records every response, flag, and follow-up action.
Structured to answer the specific questions AI assistants surface for this topic. Each answer is concise, accurate, and under 100 words for maximum featured snippet eligibility.
Each guide covers a specific component of vendor risk management for small businesses.
Select a template, assign it to a vendor, and VendorAuditly handles the sending, chasing, AI summarisation, and risk scoring automatically. Free forever on up to 3 vendors.
Free forever on 3 vendors · No credit card · Vendors don't need an account to respond