Your vendor questionnaire is not a control
Most third-party risk programs collect evidence that a vendor can answer questions, not evidence that the vendor is safe. Here is what to measure instead.
A vendor security questionnaire measures one thing reliably: whether the vendor employs someone who is good at filling in questionnaires. That correlates with company size and sales maturity. It does not correlate with whether your data is safe.
The failure mode
Consider what actually happens when a 200-question assessment goes out. The vendor’s sales engineer answers it from a library of previous answers. Nobody on your side has the time to verify more than a sample. The completed document enters your GRC tool, where it satisfies a control objective that reads something like “third parties are assessed prior to onboarding.”
The control objective is met. Nothing has been learned.
What to do instead
Three substitutions, in order of leverage:
-
Ask for artifacts, not assertions. “Do you encrypt data at rest?” invites a yes. “Attach your most recent penetration test report, including the remediation status of each finding” invites either evidence or an informative refusal.
-
Tier by blast radius, not by spend. The dominant variable is what the vendor can reach, not what you pay them. A $400/year tool with production database credentials outranks a $200,000 contract for office furniture.
-
Put teeth in the contract instead of the questionnaire. Notification windows measured in hours, audit rights you will actually exercise, and defined consequences do more work than any pre-onboarding document review.
The counter-argument
The strongest case for questionnaires is that they are evidence of diligence for a regulator or a plaintiff. You asked, they answered, you relied in good faith. That is not nothing, and I would not tell a client to stop sending them entirely.
But diligence theater and diligence are different products, and it’s worth being honest with yourself about which one you’re buying. If the questionnaire exists to satisfy an examiner rather than to inform a decision, shorten it, stop pretending it’s a control, and put the reclaimed hours into the three items above.
Written by Joy Floresca Knox. This is general information, not legal advice. Regulatory requirements depend on your specific facts and jurisdiction. If something here is wrong or out of date, tell us and we'll correct it.