A 300-question spreadsheet sent to every supplier produces fatigue, not assurance. Design questionnaires by tier, ask for evidence, and review answers consistently.
A cloud provider hosting customer data and a stationery supplier do not need the same questions. Tier vendors first, then select questionnaire modules: information security, cloud, privacy and data protection, business continuity, AI use, ESG and regulatory requirements.
| Tier | Typical scope | Evidence expected |
|---|---|---|
| Tier 1 — critical | Full security, privacy, continuity, sub-contractors, exit | Certifications, independent audit reports, policies, test results |
| Tier 2 — high | Security and privacy core set | Certifications or audit reports, key policies |
| Tier 3 — moderate | Short security and privacy set | Self-attestation with selected evidence |
| Tier 4 — low | Basic information and contract terms | Contract and insurance |
Send questionnaires through a secure portal rather than as attachments. Vendors save progress, upload evidence against each question and submit once; answers then lock. Automatic reminders replace manual chasing, and every access is logged.
Reviewers should accept, reject or request clarification per answer, with a note. AI can pre-screen: flagging contradictions (for example, “no third-party hosting” while the evidence names a cloud provider), missing evidence and expired certificates. Confirmed gaps become issues with severity and due date.
Combine answer scores into a control-strength rating, then combine control strength with the inherent tier to obtain residual risk. Keep the method documented so auditors can reproduce it.
| Topic | Useful evidence |
|---|---|
| Information security | ISO 27001 certificate with scope, SOC 2 report, policies |
| Access control | MFA configuration evidence, access review records |
| Vulnerability management | Recent penetration test summary, patching metrics |
| Business continuity | Continuity plan, latest test results |
| Privacy | Data processing agreement, records of processing, sub-processor list |
| Incident response | Plan, notification timelines, recent exercise |
Large vendors receive hundreds of questionnaires a year and answer the shortest ones first. Accept their standard reports where they cover your questions, ask only for what changed at reassessment, and send a pre-filled questionnaire based on last year’s answers. Shorter, sharper questionnaires come back faster and with better evidence.
NAZZTEC AI TPRM automates this end to end — with AI assistance, segregation of duties, analytics and signed reports — and is available as SaaS, in your private cloud or on-premises. Our consultants design and run the process alongside it through our Governance, Risk & Compliance services.
Next step: request a demo of NAZZTEC AI TPRM or read more on the product page.
NAZZTEC Editorial TeamWritten and reviewed by NAZZTEC practitioners. This briefing is general guidance, not legal advice.
Spreadsheets and e-mailed questionnaires cannot keep up with hundreds of vendors. Here is what AI-driven TPRM software must deliver — and where human judgement must stay in charge.
Tiering decides how much due diligence each vendor gets. Get it wrong and you either over-assess the stationery supplier or under-assess the cloud provider.
Your inventory spreadsheet holds years of knowledge. Migrate it carefully and you keep every column — while gaining history, approvals and analytics.
Tell us what you are working on. A senior NAZZTEC consultant will come back within one business day with a practical view.
We respond to every enquiry within one business day.