One Questionnaire for Every Vendor Is a Decision Not to Decide

Six of the 21 teams we spoke with this fall asked versions of one question: can the questions adapt to the vendor? Can the vendor's type decide which questions apply? Can high inherent risk trigger the deeper set and low risk a short form? Can one answer open follow-up questions only when they're relevant?

Behind that question is a pattern most TPRM teams will recognize: one master questionnaire, 200 or 300 questions, sent to every vendor regardless of what they do.

Why the single questionnaire survives

It is easy to see why it persists. One questionnaire is simple to maintain, easy to defend ("we ask everyone the same thing"), and it avoids the hardest part of the job, which is deciding in advance what matters for each vendor. It feels consistent. It feels thorough.

In practice it produces the opposite of thoroughness. The catering vendor answers questions about encryption key rotation. The payroll processor that holds every employee's bank details gets the same form, and the questions that should matter for them are buried at number 147 between things that don't apply. Reviewers skim, because they have to. Vendors guess, because they can tell nobody reads it.

Proportionality is the actual standard

Regulators have been consistent on this for years. US banking guidance, DORA in the EU, and most frameworks in between ask for oversight proportionate to the risk and complexity of the relationship. Sending everyone the same questionnaire is not proportionate. It is uniform, which is a different thing.

Proportionate means the inherent risk of the relationship decides the depth of the review. One team described their security set in three tiers of roughly 30, 50, and 300 questions, chosen by the supplier's risk. Another wanted a high rating in a single domain, like security or business continuity, to push the vendor's overall rating to critical, because one serious exposure is enough.

What adaptive scoping looks like

The teams that had thought about this the most described the same structure:

• The business owner answers a short intake about the relationship: what data, what access, how critical, what happens if it stops.
• Those answers set inherent risk, by domain where possible: security, privacy, resilience, financial.
• Inherent risk and vendor type select the question set, not someone's memory.
• A subject matter expert reviews the proposed questions and can add or remove before anything goes out.
• Conditional follow-ups appear only when an answer calls for them, like asking for a SOC report only when the vendor says it holds sensitive data.

The expert review step matters. Nobody we spoke with wanted a fully automatic scoper. They wanted the system to propose and the expert to decide, with the reasoning recorded so the scope can be explained to an auditor two years later.

Deciding is the job

The single questionnaire's real cost is not the vendor's time or the reviewer's. It is that it lets the program avoid deciding what matters. Every adaptive approach forces that decision up front, at intake, where it is cheapest to make and easiest to defend.

A good test for any program: pick two vendors with very different risk, say an office supply vendor and your core processing provider, and compare what you asked each of them. If the answer is "the same thing," the program hasn't decided yet.