Most questionnaires fail before the supplier opens them. They are too long, they ask for things you already have, and they arrive in the same week as three others.
Here are five changes that make the difference between a request that comes back and one that doesn't.
Every question should map to a decision you will make. If nobody acts on the answer, cut it. A 20-question request with a clear purpose beats an 80-question one that covers every framework you have heard of.
If a supplier has already shared an ISO 27001 certificate or a SOC 2 report, don't ask for it again. Pre-fill what you can and ask them to confirm.
Give a deadline and one sentence on why you need it. "We're renewing your contract on 1 December and need this to sign off" works better than a generic reminder.
Tip: two reminders is the useful maximum. After that, pick up the phone.
When the answers are in, tell the supplier what happens next. It costs nothing and it is the reason they answer quickly next time.
Want help setting this up in GRC Watch?