Every large organisation sends security questionnaires to its suppliers. Fifty questions, sometimes two hundred, a spreadsheet that comes back filled in and a file that gets archived. The following year it repeats. When someone asks what coverage third party risk has, the answer is usually the number of questionnaires sent.
That number says almost nothing. A completed questionnaire is one party's statement about itself, unverified and without consequence. In the language of the trade it is a representation, not evidence. It opens a conversation and records that the question was asked. It does not support a conclusion that the control exists.
It is worth saying without cynicism. The questionnaire is a reasonable tool and across several hundred suppliers it is the only one that fits. The problem is not sending it, it is treating the answer as evidence.
A questionnaire proves you asked. It proves nothing about what came back.
What the rule asks for
NIS2 lists supply chain security among the minimum risk management measures and defines it as the security related aspects of the relationship between the entity and its direct suppliers. In that same list, and this gets quoted far less, sit the policies and procedures to assess the effectiveness of risk management measures.
Assessing effectiveness and collecting a statement are not the same activity. That difference is exactly what separates a file from a control.
Six changes
- Segment before you send. Not every supplier deserves the same questionnaire. Rank them by what they hold up, the data they handle and how long the organisation lasts without them. Three tiers are enough.
- Ask for the artefact, not the answer. Replace "Do you take backups?" with "State the date of the last tested restore and who signed it off". One question answered with a document beats ten answered with a yes.
- Use the third party report where one exists. If there is a certification or an audit report in force, read it, check the scope and the exceptions, and drop from the questionnaire whatever that report already evidences. It saves work on both sides and concentrates yours where there is nothing.
- Verify a sample. If a hundred percent of questionnaires are filed without checking, the control is nominal. Pick a few critical suppliers a year and test what they declared against the source. A small verified sample says more than two hundred unopened sheets.
- Write the consequence before you send. What happens if the supplier does not answer, if they answer no, and if they answer yes and the check fails. With no written consequence, the questionnaire is a survey.
- Keep the file the way you keep a working paper. Who sent it, when it came back, who reviewed it, what they concluded and what was done with what came out. What is not recorded does not exist in a review.
What the auditor tests
The review is not about counting questionnaires. It is about taking three critical suppliers and following the whole trail. That they are in the inventory, that their tier matches what they hold up, that the cycle's questionnaire exists, that somebody reviewed it, that exceptions have an owner and a date, and that the written consequence was applied when it should have been.
If any stretch of that trail has no trace, there is the finding, and it nearly always turns up in the same place, between the answer that came back and the person who was meant to read it. The obligation arrives anyway, by contract before it arrives by statute, as described in NIS2 and the supply chain.
