How to Create a Due Diligence Questionnaire
Creating a Due Diligence Questionnaire (DDQ) is the process of designing a structured questionnaire that gathers the right information to evaluate a vendor's risk profile. This guide walks through the steps to create an effective DDQ that produces actionable risk assessments.
Step 1: Define the DDQ Scope
Start by defining what the DDQ needs to cover based on the vendor's services, data access, and risk tier. A vendor handling personal data needs a DDQ covering data protection and cybersecurity. A vendor providing professional services needs a DDQ covering operational capability and professional qualifications. The scope should match the risk — not too broad (wastes time) and not too narrow (misses risks).
Step 2: Structure the Questionnaire
Organize the DDQ into logical sections: company information, financial stability, operational capability, cybersecurity, data protection, regulatory compliance, business continuity, and ESG. Each section should have a clear purpose and contain relevant questions. A well-structured DDQ is easier for the vendor to complete and easier for you to evaluate.
Step 3: Write Clear Questions
Write questions that are clear, unambiguous, and produce comparable responses. Avoid jargon and acronyms. Use specific rather than general questions ('Do you have an ISO 27001 certification?' rather than 'Are you certified?'). Include guidance for each question so the vendor understands what information is expected. Use a mix of question types: yes/no, multiple choice, rating scales, and free text.
Step 4: Define Scoring and Thresholds
For each question, define how responses will be scored and what thresholds constitute acceptable, concerning, and unacceptable responses. For example: 'Do you have an ISO 27001 certification?' — Yes = 0 points (acceptable), No but has alternative controls = 5 points (concerning), No and no alternative = 10 points (unacceptable). Automated scoring with thresholds makes evaluation consistent and efficient.
Step 5: Configure Red Flags
Identify questions that are critical — where an unacceptable response should immediately flag the assessment for review, regardless of the overall score. These are red flag questions. For example: 'Has the vendor had a data breach in the past 24 months?' — if yes, it should trigger a red flag. Configure red flag detection to highlight critical risks immediately.
Step 6: Test and Refine
Before deploying the DDQ, test it with a sample vendor or internally. Evaluate: are the questions clear? Do they produce useful information? Is the scoring appropriate? Are there gaps? Refine based on the test results. A well-tested DDQ produces better results and fewer follow-up clarifications.
Step 7: Deploy and Iterate
Deploy the DDQ through your assessment workflow. Monitor results: are vendors providing complete responses? Are there questions that consistently produce unclear answers? Are red flags being triggered appropriately? Iterate on the DDQ based on real-world usage — governance questionnaires should evolve with the risk landscape and regulatory expectations.
Key Takeaways
- Define the DDQ scope based on the vendor's services, data access, and risk tier
- Structure into logical sections with clear, specific questions
- Define scoring and thresholds for consistent, automated evaluation
- Configure red flags for critical questions that require immediate review
- Test before deploying and iterate based on real-world usage
Frequently Asked Questions
How many questions should a DDQ contain?
It depends on the risk tier. A high-risk vendor DDQ might have 100-200 questions across all sections. A medium-risk vendor might have 50-100. A low-risk vendor might have 20-50. The key is to gather enough information to assess risk without overwhelming the vendor. MPG provides pre-built templates for each risk tier that you can customize.
Should we use the same DDQ for all vendors?
No — DDQs should be tailored to the vendor's risk tier and services. A one-size-fits-all DDQ either over-assesses low-risk vendors (wasting time) or under-assesses high-risk vendors (missing risks). MPG's configurable templates allow you to create risk-tier-specific DDQs while maintaining consistency in scoring and evaluation.