Audit & assurance
Customer due diligence: prepare the controls and evidence behind the security questionnaire
A practical operating framework for SaaS and technology teams responding to customer security, risk and assurance questions without turning every questionnaire into a one-off project.
Read the request as a decision, not a spreadsheet
A security questionnaire often supports a customer's trust or procurement decision. First clarify the deadline, requested users, contractual commitments and the product or service in scope before gathering answers.
Avoid treating the request as a reason to claim an assurance outcome that has not been achieved. The objective is to respond accurately to the service and controls in scope, with the right internal reviewers involved.
Create one current source of truth
Organise current policies, system diagrams, access and change-management information, incident records, vendor-management materials and business-continuity or recovery evidence in a controlled location. Record the owner and last-reviewed date for each item.
A central index reduces repeated searching and helps prevent sensitive documents from being copied into uncontrolled email threads. It should make gaps visible rather than masking them with outdated files.
Distinguish policy from operating evidence
A policy states an intended way of working; operating evidence shows what happened in a particular period. For each response area, identify the control owner, trigger, record, reviewer and period that the evidence is meant to support.
Screenshots and exports can be useful snapshots, but they need context. A clear explanation of the process and evidence source is more reliable than presenting one isolated artifact as a broad conclusion.
Route exceptions and commitments with care
Questionnaire answers can become commercial or security commitments. Route exceptions, proposed remediation dates and product statements through the appropriate security, technical, legal and commercial reviewers before submission.
Maintain an exception log for open questions and follow-up commitments. This is general information, not an assurance, legal or security conclusion; scope and representations should be agreed for the specific request.
Continue reading
More practical perspectives.
Audit & assurance
SOC 2 readiness: build an evidence plan before you need it
A practical, non-technical way to organise ownership, controls and evidence before a SOC 2 examination begins.
Read articleAudit & assurance
SOC 2 Type 1 or Type 2: start with the decision your customer needs to make
A practical way to frame the report conversation around intended users, system boundaries, evidence and timing—before selecting labels or dates.
Read articleAudit & assurance
Financial statement audit readiness: a management-owned plan before the request list arrives
A practical framework for management teams preparing records, responsibilities, schedules and explanations before a financial statement audit begins.
Read articleImportant note
This article is general information and may not reflect the latest standards, law or your specific circumstances. It is not audit, tax, legal, investment or other professional advice. Obtain advice before acting.