Due Diligence Questionnaire (DDQ)
A Due Diligence Questionnaire (DDQ) is a structured set of questions sent to a third party (vendor, supplier, or service provider) to evaluate their risk profile before establishing or continuing a business relationship. DDQs cover financial stability, operational capability, cybersecurity, regulatory compliance, data protection, and ESG practices.
DDQs are the primary tool in third-party risk management for gathering standardized information about a vendor's risk posture. Responses are scored against predefined thresholds, evaluated for red flags, and used to make risk-based onboarding or continuation decisions. The depth of a DDQ should match the vendor's risk tier — high-risk vendors receive comprehensive questionnaires, while low-risk vendors receive lighter-touch versions.
Examples
- •A financial services firm sends a DDQ to a cloud hosting provider covering SOC 2 certification, data residency, incident response, and business continuity before onboarding.
- •An asset manager sends an operational due diligence questionnaire to an investment manager covering trade execution, custody arrangements, and compliance track record.
- •A bank sends an annual DDQ to its critical third-party service providers to verify continued compliance with regulatory expectations.