Ask a vendor’s security team what they spend their time on and many will say questionnaires. Ask a customer’s vendor-risk team and many will say the same thing from the other side: sending them, chasing them, and reading answers to questions the vendor’s SOC 2 report already answered, in more detail and with an auditor’s signature. Both sides do the work twice, and the business waits for both.
This post is about the questions you should not have to ask. It explains how InsightVendors picks the assessment from the tier, pre-fills answers already proven by documents on file, marks each answer’s source, and sends the vendor only the rest. It uses the demo organisation, Northwind Labs, and its fictional AI vendor, Quill AI — including the honest detail that, for Quill AI, nothing could be pre-filled at all.
In short
- The questionnaire is a means, not the goal. The goal is evidence that a control exists. Much of that evidence is already in documents you hold.
- Pick by tier, pre-fill by document, send the rest. The Assessment agent chooses the template from the tier, answers what a SOC 2, ISO certificate, pen test, insurance certificate or DPA proves, marks the source of each answer, and prepares the invitation.
- The vendor checks rather than retypes. The portal shows pre-filled answers as already answered; the vendor confirms or corrects them.
- Pre-filling only works when documents exist. Quill AI’s 43-question assessment went out with 0 pre-filled, because Northwind held only its Terms of Service. Ask for the SOC report first.
- A person releases every invitation. At the default L2, the invitation waits in the outbox.
The cost of asking what you already know
A standard security questionnaire — whether built on the Shared Assessments SIG (Standardized Information Gathering) questionnaire, the CAIQ or a home-grown list — asks whether the vendor has an information security programme, whether policies are reviewed annually, whether access is reviewed, whether data is encrypted, whether there is an incident response plan. A SOC 2 Type II report describes those controls and tells you whether an independent auditor found them operating over a period, usually six to twelve months. An ISO 27001 certificate tells you an accredited body has audited the management system and what it covers.
When a reviewer sends the full questionnaire anyway, three costs follow. The vendor spends days on answers it has written many times before. The review waits for those days. And the reviewer then reads self-attested answers that carry less weight than the report already on file. The business feels only the middle one — the wait — and that is the one that teaches people to buy on a credit card instead.
Full questionnaire to every vendor in the tier. Vendor retypes what its SOC 2 says. Reviewer compares self-attestation with the report by hand, if at all.
Template chosen by tier. Answers proven by documents filled in with their source and page. The vendor confirms those and answers the rest. The reviewer looks at gaps and contradictions.
Step one: pick the right questionnaire
The questionnaire library in 1.0 has five templates: InsightVendors Core (aligned to SIG-Lite), Privacy
/ GDPR & DPA, AI vendor (built around ISO/IEC 42001 and the NIST AI Risk Management Framework),
Business continuity, and Financial health. The Assessment agent chooses from the tier and from what the
request says the vendor will do. Routing rules can add templates: in the demo, the rule
ai_questionnaire requires the AI vendor template whenever a request involves generative
AI.
That is how Northwind’s request VR-0001 — “We want Quill AI (quillai.com) to draft customer support replies from our ticket history” — ended up with “Core security assessment + Privacy & DPA + AI vendor assessment”, 43 questions in total. Quill AI is Tier 2 High: it will process customer data from tickets (privacy), integrate with the support desk (IT), and it is a generative AI service (AI). A Tier 4 design agency would get none of this.
| Tier | Typical assessment (illustrative defaults) | Reassessment (demo) |
|---|---|---|
| Tier 1 · Critical | Core, plus Privacy, Business continuity and Financial health where relevant | 12 months |
| Tier 2 · High | Core, plus Privacy if personal data, plus AI vendor if AI | 12 months |
| Tier 3 · Moderate | Core, often satisfied mostly from documents | 24 months |
| Tier 4 · Low | Fast track: a short confirmation or none | 36 months |
Step two: answer what the documents prove
Before anything goes to the vendor, the Assessment agent reads what the Document agent has already extracted from documents on file and maps it to questions. Each pre-filled answer records where it came from: which document, which page, which quoted text. The rule is narrow on purpose. An answer is pre-filled only when a document actually proves it, not when it merely makes it likely.
| Question (Core / Governance) | Document that can prove it | What the agent records |
|---|---|---|
| GOV-02: Do you hold a current SOC 2 Type II report or ISO 27001 certificate covering the service we will use? | SOC 2 report or ISO certificate | Type, period, auditor, opinion; or body, scope, expiry |
| Is there an annual independent penetration test? | Penetration test report | Date, tester, open critical and high findings, retest |
| Do you carry cyber insurance? | Certificate of insurance | Cyber, E&O and general liability limits against the tier’s minimums; expiry |
| Which subprocessors handle our data, and where? | DPA | Subprocessor list, data location, transfer mechanism (SCCs) |
| What is your breach-notification commitment? | DPA or MSA | The window in hours or days, with the clause |
Imagine the same assessment for Stackforge, the demo’s Tier 1 hosting provider. Northwind holds its SOC 2 Type II, ISO 27001 certificate, a 2026 penetration test and a certificate of insurance. The governance, access control, change management, logging, encryption, testing and insurance questions could largely be answered from those four documents, each with a page reference, leaving the vendor to confirm and to answer what no document covers. That is the illustration; the exact share depends on the template and the documents.
Step three: send only the rest, and say so
The vendor receives a signed link to a portal. No account, no password. The portal tells the vendor what is going on in plain words: “Questions already answered from documents you shared are marked — you only need to check them.” Each question has Yes, No and N/A and a comment box. A pre-filled answer is shown with its source so the vendor can confirm or correct it; if the vendor changes it, the reviewer sees the disagreement.
From tier to invitation. At L2 nothing reaches the vendor until a person releases it.
Quill AI: the case where nothing could be pre-filled
The demo shows the limit clearly, and it is the most useful lesson in this post. The Quill AI assessment screen reads “0/43 · 0 pre-filled”. Northwind held only one Quill AI document: its Terms of Service. The agents found plenty in it — “Customer data used to train AI models” as a critical finding, no data deletion or return obligation on termination, a 72-hour breach-notification window that may be insufficient — but a terms-of-service document does not prove security controls. With no SOC 2, ISO certificate or pen test on file, every question had to go to the vendor.
The operating lesson is to ask for documents before questions. A short first request — send us your current SOC 2 report, ISO certificate, latest pen test summary, insurance certificate and DPA — costs the vendor minutes, because those documents already exist. Once they are read, the questionnaire shrinks to what they do not cover. For a young AI vendor without a SOC 2, the full questionnaire is the right answer, and the fact that nothing could be pre-filled is itself a piece of information for the security lane.
What pre-filling does and does not do
Pre-filling depends entirely on what documents you hold and on the Document agent having read them. It does not search the internet for the vendor’s controls or accept a trust-page claim as proof. A SOC 2 covers the systems in its scope and the period it names; a pre-filled answer is only as current as the report. In the demo, the Quill AI assessment had nothing to pre-fill. And the vendor network — where a vendor answers once and shares with every customer who asks — is planned for 1.3, not available today.
Reading the answers that come back
Fewer questions does not mean less scrutiny. It moves scrutiny to where it pays. When answers come back, the Assessment agent flags answers that are weak (a “Yes” with no detail on a control that matters), evasive (“we follow industry best practice”), or contradictory — the classic being a vendor that answers “SOC 2 Type II” and uploads a Type I. The demo has a real example of the document version of that problem: NimbusDesk’s SOC 2 is a Type I with a future-dated audit period, which the Document agent raised as a critical finding.
Flags become findings with a source of “answer”, an owner and a due date. Findings feed the residual risk score. The reviewer reads the flagged answers and the gaps, not 43 rows of “Yes”.
For the CISO
Self-attestation is replaced by audited evidence wherever it exists, with page citations.
Contradictions between what a vendor says and what it uploaded are caught by default.
For the vendor-risk lead
Fewer questions sent, fewer chased, and review time spent on gaps.
Every pre-filled answer has a source a reviewer or auditor can open.
For the board
Faster approvals for the business without lowering the bar.
Vendors spend less time on Northwind’s paperwork, which matters when Northwind is the small customer.
SOC 2 or SOC 1, ISO certificates, latest pen test, insurance certificate, DPA. Upload them to the vendor.
Fields and findings extracted with page citations.
Template from tier and routing rules; pre-filled answers with sources; invitation drafted.
Check the recipient and the message in the outbox; release, edit or cancel.
Weak, evasive or contradictory answers become findings with owners.
Approve, approve with conditions, reject or send back.
Why this is a management decision, not a feature
Whether to accept a SOC 2 report in place of questions is a policy choice. Some organisations will always want certain questions answered directly, for instance on AI training or data residency, because no audit report covers them. InsightVendors lets you make that choice per template. What it removes is the default of sending everything because nobody had time to check what was already known.
Regulators ask for due diligence proportionate to risk, not for a particular questionnaire. The US interagency guidance on third-party relationships (June 2023) and the EBA outsourcing guidelines both describe due diligence in terms of evidence and risk; SOC 2 CC9.2 asks for vendor risk to be assessed. A process that uses audited evidence first, with the source recorded, is easy to defend. Confirm the specifics with your compliance team.
Do not ask a vendor what its auditor has already told you.
Ask for documents first, answer from them with the page, and send the vendor only what is left. When nothing can be pre-filled, that tells you something too.