Due diligence questionnaire, the wider set of questions, not just the security ones

A DDQ is a pre-contract instrument, and its job is to establish whether the relationship should exist at all. That makes it broader than the security review that follows it: financial stability and beneficial ownership, sanctions and adverse media, insurance, data protection and international transfers, business continuity, sub-contracting, and — in the UK — modern slavery and anti-bribery positions.

Security occupies one section of that, and where the relationship is material it is normally expanded into a full security questionnaire such as SIG or CAIQ. The distinction matters commercially, because DDQs are issued by procurement to shortlisted suppliers while security questionnaires are issued by risk teams to selected ones, and running them as a single 400-question document at the shortlist stage is how vendors are lost before the negotiation starts.

The DDQ should be scaled to inherent risk, which means tiering has to happen before it is issued rather than after it is scored. A supplier with no data access and no operational dependency does not need an ownership structure and a resilience test summary; a supplier processing customer records needs both, and more.

The second lever is not asking for what already exists. A current SOC 2 Type II, an ISO 27001 certificate with its statement of applicability, a penetration test summary and a filed set of accounts answer a substantial share of a standard DDQ between them. Collecting documents first and questioning only the gaps is faster for both sides and produces better evidence than an assertion in a spreadsheet cell.