DDQ Completion: Due Diligence Questionnaire Help

What a DDQ is

A due diligence questionnaire has no single format.

A due diligence questionnaire (DDQ) is a set of questions a customer sends to a supplier to assess risk before, or while, doing business. Unlike standardised formats such as the SIG or the CAIQ, a DDQ is usually written by the customer’s own procurement, security, privacy or vendor-risk team, so its structure and wording vary from one customer to the next.

It typically arrives as an Excel or Word file, or as a form in a vendor-management portal. The questions commonly cover information security, data protection, incident response, business continuity and use of subprocessors. Some DDQs also include corporate questions about finances, insurance or legal matters.

We complete the security and information-governance sections from your documentation. Corporate, financial, insurance and legal questions can’t be supported from security documents, so we mark them for you to answer rather than draft them.

When you receive one

Usually when a deal is close to closing.

During procurement or a security review for a new enterprise customer
At contract renewal or an annual supplier review
Inside an RFP or tender that includes a security section
From customers in regulated sectors that run a third-party risk programme
When a customer’s security team follows up on an earlier, shorter questionnaire

Why it becomes painful

The work is repetitive, and the risk is in the details.

Most DDQs ask about the same dozen topics, but every customer words them differently, so answers can’t simply be copied across. The information also sits in different places: policies, architecture documents, previous questionnaires and the heads of a few colleagues.

Each question has to be matched to the right paragraph in the right document.
Similar questions across different DDQs have to be answered consistently.
Technical details need checking with the engineers who know them.
It is easy to over-claim: to say “yes” to a control your documents only describe as intended.
The deadline is set by the customer, not by your team’s workload.

Documentation

What is normally needed to complete a DDQ.

You don’t need all of this. Tell us what you have, and we’ll say what is likely to come back flagged.

Information security policies

Your core security policy set, including access control, acceptable use and data classification.

Data protection and retention

Privacy and data-handling documents, retention rules, and your list of subprocessors where you keep one.

Incident response and continuity

Incident response plan, backup and recovery arrangements, business continuity and disaster recovery documents.

Technical documentation

Architecture and hosting overviews, encryption approach, logging, vulnerability management and secure development practices.

Certifications and reports

Audit reports or certifications issued to you, and independent test summaries, if you hold any.

Previous questionnaire responses

Answers you have already approved for other customers, which we check against your current documents.

How we handle it

Evidence-backed completion, step by step.

Send the DDQ and your documentation
Start with the enquiry form: the format, approximate size and deadline. We agree how confidential material will be shared before you send it.
We separate the security questions from the rest
Security and information-governance questions are drafted. Corporate, financial, insurance and legal questions are marked for you.
We draft each answer from your material
Every answer is tied to the document that supports it, in the customer’s own wording and file.
We flag what can’t be supported
Gaps, ambiguity and conflicts between documents come back to you marked, with a note on what is unclear.
You review and approve
You confirm, correct or add evidence. Only answers you have approved go back to your customer.

Unsupported answers

What happens when the evidence isn’t there.

A DDQ answer is a representation your company makes. If your documents don’t support it, we say so instead of writing something that sounds right.

Review required

Question: Do you test your disaster recovery plan annually?
Finding: The supplied continuity plan describes a recovery process but doesn’t state that it is tested, or how often.
Required: Customer confirmation

Missing evidence

Question: Is an independent penetration test performed annually?
Finding: No test report or policy reference was supplied, so this can’t be substantiated.
Required: Evidence or your answer

Examples are illustrative and are not drawn from client work.

Review and approval

You approve every final answer.

You receive the completed DDQ as a draft, with each answer’s status and source. Anything flagged is yours to resolve: supply the missing evidence, confirm the position, or answer it in your own words.

We don’t make legal attestations on your behalf, and we don’t claim certifications you don’t hold. Once you have approved the answers, you send the DDQ to your customer. The approved answers stay with their evidence, so the next DDQ starts from a stronger position. For the full service, see security questionnaire completion.

Request a questionnaire review

Received a DDQ you need completed?

Tell us what you’ve received, its format and your deadline. We’ll review the scope and let you know what we need to complete it.

Get your questionnaire reviewed

DDQ completion for B2B SaaS companies