Questionnaire intake

A vendor review begins with a questionnaire for a named vendor. The Assessment Owner records the version, due date and person responsible for the review. This creates a place for the control responses that arrive later and makes it clear which request a response belongs to. A new version should remain distinguishable from an earlier review so that a decision can be read in its original context.

The owner can begin with a draft, send the request, then mark it responded when answers are collected. Review is a distinct stage. It is where the responsible Reviewer looks at the answers and their evidence before recording an approved or rejected outcome. The decision belongs to the questionnaire rather than to a general vendor label; the same vendor can have a later review with a different version and result.

• Owner and deadline. A named owner and due date keep a sent request from disappearing while the vendor response is pending.
• Responses beneath the request. Control answers attach to their questionnaire, so the Reviewer can read the answer and its evidence in context.
• Decision state. Draft, sent, responded, review and final outcomes describe the current point of the specific request.

Agree who can create a vendor request, who sends it, and who can record the final decision. The Assessment Owner and Reviewer need a consistent handoff: a questionnaire should reach review only when the responses intended for that version are in place. Agree how the vendor will return answers and attachments. That exchange can be organized through the team’s existing channel while the app keeps the review record.

Choose a naming convention for vendor names and versions. If two requests cover the same vendor, a clear version and due date stop answers from being attached to the wrong cycle. Also agree how to handle a late response: the owner can inspect the sent request and its due date, then decide whether to continue that review or prepare a new version.

Take a vendor whose questionnaire is due soon. The Assessment Owner opens the request and confirms its version and owner. The Inspector enters a control answer with its evidence against that request. When the set of responses is ready, the Reviewer opens the questionnaire and looks for any elevated risk ratings. The Reviewer records the outcome on the correct questionnaire after reading the attached material.

Now rehearse the harder case: the vendor returns a revised answer after the questionnaire reaches review. Check that the person deciding can tell which version was reviewed and which evidence informed the result. An approved status should identify the reviewed request, rather than being read as permanent approval of every future vendor response.

• Questionnaires in review — Requests ready for a Reviewer to assess with their linked responses.
• My questionnaires — The Assessment Owner’s requests with version, due date and current state.
• Questionnaires awaiting response — Sent requests that still need follow-up with the vendor.

See questionnaire review for response handling and decision points. Use the data model to plan vendor-name and version migration before the first operating cycle.