Guide
Questionnaire-prep guide
Most questionnaire time is lost to re-researching the same answers. Prep the sources up front and a reviewer's job gets much faster.
Before the questionnaire arrives
- Keep your core policies (InfoSec, Access Control, Incident Response) current: most questionnaires ask about them directly.
- Keep a running answer library of your best, most recently approved responses instead of starting fresh each time.
- Know your own scope: which frameworks you hold, what a SOC 2/ISO cert covers, and what it doesn't.
When it lands
- Identify the format (a bespoke spreadsheet, or a standard one like SIG or CAIQ), since standard formats map more predictably to your existing answers.
- Extract every question up front, including ones buried in extra tabs or oddly merged cells, before assigning anyone to answer.
- Flag any question that's actually new (not covered by an existing policy, control, or past answer) early, since those need real research time.
Drafting answers
- Ground every answer in something real: a policy, a passing control, or a previously approved answer, not a generic assurance.
- Note the source each draft answer came from, so a reviewer can verify it quickly instead of re-researching it.
- Treat low-confidence or unsupported drafts as a signal to research the question properly, not to soften the wording instead.
Review before sending
- Have a human read and approve every answer: nothing should go out unreviewed, however confident the draft looks.
- Check that answers are internally consistent: the same fact shouldn't be stated two different ways in the same document.
- Confirm the completed file is returned in the format the buyer sent, not a reformatted version that's harder for their team to ingest.
After you send it
- Save every newly approved answer back into your library so the next questionnaire is faster.
- Note any question you had to research from scratch: that's a gap in your library worth closing before it comes up again.
This is exactly what questionnaire automation does: draft answers grounded in your policies and evidence, reviewed by your team before anything is sent.