Supplier compliance
Supplier questionnaires: checking answers against evidence
A supplier questionnaire records what a supplier says about itself. How to write questions that can be evidenced, map each answer to proof, spot the unsupported ones and follow up without restarting the review.
DataStruct AI Team · Compliance · · 6 min read
In short
- A self-assessment questionnaire records what a supplier says about itself. The review is deciding which of those answers are backed by evidence.
- Map each question to the evidence that would support the answer, ask for it at the same time as the answer, and mark every answer as supported, partly supported or unsupported.
- Follow up on the unsupported answers that matter most, with a specific request and a date, rather than sending the whole questionnaire back.
Supplier questionnaires are everywhere: onboarding, quality, information security, sustainability, modern slavery. They are also easy to over-trust. A completed questionnaire is a set of claims made by the party being assessed: useful, but not proof.
This guide covers how to get questionnaires back in a form that can be checked, and how to check them.
Why answers need evidence
Questionnaires are long, suppliers receive many of them, and the same person often answers all of them. The predictable results are answers copied from the last questionnaire, optimistic yeses and attachments that do not quite match the question. None of that is necessarily dishonest. It does mean that an answer, on its own, should not close a requirement.
Write questions that can be evidenced
The best time to make a questionnaire checkable is when you write it.
- Ask for the evidence in the question. “Attach your current ISO 14001 certificate” can be checked. “Do you have an environmental management system?” invites a yes.
- Ask one thing at a time. “Do you have, and regularly test, a business continuity plan?” hides two answers in one.
- Set a timeframe. “In the last 12 months, have you had a product recall?” is clearer than “Have you had recalls?”
- Ask for numbers where they exist. The number of corrective actions open for more than 90 days says more than “we manage corrective actions effectively”.
- Ask fewer questions. Tier the questionnaire by risk, so that low-risk suppliers answer a short version and high-risk suppliers answer the full one.
Map each answer to evidence
For each question that matters, decide what would support the answer, and check whether it has been provided.
| Question | Answer | Evidence requested | What to check |
|---|---|---|---|
| Do you hold ISO 9001 certification? | Yes | Certificate | Entity, sites, scope, dates and register status |
| Do you have a supplier code of conduct? | Yes | The code, with its date and approver | It is current and applies to the supplier’s own suppliers |
| Are all corrective actions from your last audit closed? | Yes | Corrective action log | Closure evidence for each action, not only a closed status |
| Do you hold product liability insurance at our minimum or above? | Yes | Certificate of insurance | Limit, dates and named insured |
| Do you use labour agencies? | No | None requested | The answer is consistent with other answers and with audit reports |
The last row matters. A “no” can need checking too, when other documents in the file suggest otherwise.
For certificates, the checks go further than reading the PDF: how to verify a supplier’s ISO certificate covers the registers and the details to match.
Three outcomes for every answer
- Supported. The evidence provided answers the question. Record where it says so.
- Partly supported. The evidence covers part of the answer: one site of three, say, or a policy without the approval the question asked about.
- Unsupported. Nothing provided supports the answer, or what was provided is only related to it.
Keeping these apart is what makes the follow-up specific. “Please send the closure evidence for findings 3 and 5 from your March audit” gets a better response than “please provide supporting documentation”.
Red flags in a questionnaire return
- Every answer is yes.
- Answers repeat the wording of the question.
- Attachments name a different entity, or are out of date.
- “Available on request” in place of an attachment.
- Links to the supplier’s marketing pages in place of controlled documents.
- Policies that are plainly templates, with placeholder text still in them.
- Answers that contradict each other, or contradict the supplier’s own documents.
Follow up by risk
You will rarely get every answer supported. Prioritise the unsupported answers on requirements that matter, such as required certifications, safety, legal compliance and anything contractual, and accept that low-risk gaps may stay open for longer. For each follow-up, record the request, the date it was sent, the response and the decision.
Keep questionnaires current
A questionnaire is accurate on the day it is answered. Re-issue it on a schedule set by risk, and on triggers: a change of ownership, a new site, a serious incident, a change to your own requirements. When a new return arrives, compare it with the previous one. A changed answer is often the most informative thing in it.
Where DataStruct fits
A returned questionnaire is one more document in the supplier file. DataStruct runs your requirements against the questionnaire and its attachments, links each finding to the page or section that supports it, and says so where nothing does. A reviewer decides each finding, and the gaps are specific enough to send to the supplier.
It does not send questionnaires or chase suppliers, and it does not flag answers that contradict each other: the reviewer still reads the file. The wider process is in how to review supplier compliance evidence.
Questions
What is a supplier self-assessment questionnaire?
A set of questions a supplier answers about its own practices, such as quality, information security, environmental or labour practices, usually at onboarding and again at re-approval. It records the supplier’s claims; evidence is needed to support them.
How many questions should a supplier questionnaire have?
As few as the risk requires. Many teams use tiers: a short questionnaire for low-risk suppliers and a fuller one for high-risk categories.
Should we accept a yes without evidence?
For requirements that matter, no. Ask for the evidence with the question, and treat the answer as unsupported until it arrives.
How often should suppliers complete a questionnaire?
On a schedule set by risk, often annually for important suppliers, and again when something changes, such as ownership, sites or a serious incident.
Can AI review supplier questionnaires?
It can find the passages in the attachments that support each answer and show where none was found. A person should still decide each answer. See eight questions to ask before trusting AI with compliance documents.