The Questionnaire Was Always a Proxy for the Evidence

In conversations with 21 third-party risk teams this fall, eight asked some version of the same question: can AI read the vendor's SOC report and documents instead of sending them a questionnaire? It was the second most common question we heard, and the way people asked it was revealing. Nobody asked whether AI could make questionnaires faster. They asked whether they could skip them.

That instinct is right, and it is worth understanding why.

What a questionnaire actually is

A security questionnaire asks a vendor to describe its controls in its own words. Do you encrypt data at rest? Do you have an incident response plan? Do you review access quarterly? The vendor's answer is a claim. The questionnaire's job is to collect claims so that someone can decide whether to believe them.

For many vendors, especially larger ones, a much better source already exists. A SOC 2 Type 2 report is an independent auditor's test of whether controls operated over a period of time. It includes the scope, the controls, the testing, and the exceptions the auditor found. An ISO certificate, a penetration test summary, an insurance certificate: each is evidence produced by someone other than the vendor's sales team.

Seen that way, the questionnaire was always a proxy. We sent it because reading the evidence was slow, not because claims were better than evidence. A 120-page SOC report takes an experienced analyst hours to read properly. A questionnaire takes the vendor weeks to answer, but those are someone else's weeks.

What changes when reading is cheap

What AI changes here is narrow but important: it makes reading evidence cheap. A model can go through a SOC report, map its controls to your requirements, and pull out the parts that matter: the opinion, the scope, the exceptions, and the complementary user entity controls you are supposed to have in place yourself.

Once reading is cheap, the order of operations flips. Instead of sending 200 questions and reading the answers, you read what the vendor has already produced, answer what the evidence can answer, and send the vendor only what's left. Several teams described exactly this workflow without being prompted: review the SOC report against our question set, show the gaps, and let a person decide which few questions actually need to go to the supplier.

That is not a small efficiency gain. For a well-documented vendor, the questions that truly need a vendor response can drop from a couple of hundred to a handful. The vendor stops filling out yet another questionnaire about things their auditor already tested. The risk team spends its conversation with the vendor on the real gaps instead of the obvious ones.

The objections are the right ones

The teams that asked this question also pushed back on it, and their objections were good.

The first was examiners. One practitioner put it directly: will an AI-generated SOC review hold up when a regulator asks how we reached the conclusion? That is the correct test. A review that can't show which page of which document supports each answer is not evidence. It is a summary. Any approach to this has to keep the citation, so a person can check every answer against its source in seconds.

The second was scope. A SOC report covers what it covers. A clean opinion on the wrong system, or one that carves out the subservice organization that actually hosts your data, is not assurance about the service you are buying. Reading the evidence includes reading what it does not say.

The third was opinion type. A qualified opinion is not a clean one, and a bridge letter is not a report. These details are easy for a tired reviewer to miss on the fortieth review of the quarter. They should be the first thing an automated read checks, not the last.

Where questionnaires still belong

None of this makes questionnaires obsolete. Small vendors often have no SOC report. Some risks, like how a vendor will handle your specific data or which subcontractors touch it, can only be answered by the vendor. And some questions are not about the vendor at all: the likelihood and impact questions your own business owner has to answer about how the vendor will be used.

What changes is the default. The questionnaire stops being the first step and becomes the last one: a short, targeted set of questions for what the evidence could not answer, sent to the vendors where it matters.

The question underneath the question

When eight teams independently ask whether they can skip the questionnaire, they are not really asking about AI. They are saying the questionnaire has become the thing the program optimizes for, response rates and completion percentages and days outstanding, while the evidence sits unread in a folder.

The goal was always a defensible decision about the vendor with the least friction for everyone involved. Questionnaires were one way to get there when reading was expensive. Reading is no longer expensive. The programs that adjust will spend their time on judgment instead of collection, and their vendors will notice.