Collect missing supplier evidence without restarting the questionnaire

The supplier has returned the questionnaire, but several answers point to documents you already have. Another question is marked “see policy”, even though the reviewer needs evidence of what happened during a test.

Sending the full questionnaire again is unlikely to clarify the difference. A more useful follow-up identifies the unanswered question, explains why the existing material falls short and asks for the smallest relevant next piece of evidence.

This is a practical collection method for lean third-party risk teams. It does not reduce the scope of diligence your organisation needs or establish a fixed list of sufficient documents.

Sort what has arrived before asking again

Build a short inventory of received material with its service scope, date and relevant sections. Separate missing documents from documents that are present but do not answer the question.

That distinction changes the request. If a supplier has already supplied a group policy, asking for its policy again wastes effort. If the problem is that the policy does not explain the control used for your service, say so.

APRA's CPG 230 discusses due diligence and oversight of service-provider arrangements. The collection approach here is an editorial suggestion for making those conversations more precise, rather than a regulator-issued questionnaire.

Turn an unclear answer into a bounded question

Use three parts: what you understand, what remains uncertain and what would help resolve it. Keep the tone neutral. A mismatch may reflect an ambiguous request or the wrong contact, rather than unwillingness to cooperate.

Here are three fictional examples.

Recovery testing

A vague request says: “Please provide more evidence of business continuity compliance.”

A focused request says: “The exercise summary covers restoration of the application. We could not identify whether it tested reconciliation of transactions interrupted during the outage. Please point us to that result, or explain how reconciliation is performed and what evidence supports the approach.”

The second request names the missing business activity and allows a useful response even if the supplier has no separate report.

Subcontractor visibility

A vague request says: “Send your full supply chain.”

A focused request says: “For the managed service in this arrangement, which external parties are needed to operate the recovery environment? Please describe their role and any dependency that could prevent that environment being used.”

This keeps the investigation tied to the service and decision. Broader dependency analysis may still be needed, but the supplier can see what this particular request is trying to establish.

Access controls

A vague request says: “Confirm access is secure.”

A focused request says: “The policy describes periodic access reviews. For the environment supporting our service, please describe the most recent review, its coverage, any unresolved exceptions and the evidence available for inspection.”

The request seeks a result and its scope, without asking the supplier to email raw account lists or sensitive security information unnecessarily.

Decide what evidence would be adequate

Before sending a request, have the reviewer state what question the response should resolve. Otherwise, the supplier can provide more material and still leave the assessment stalled.

Sometimes an explanation supported by an existing document is sufficient for the specific question. Sometimes the team needs test results, a walkthrough, independent assurance or specialist review. Decide based on the service, risk and uncertainty, not on which file is easiest to obtain.

ASD's cyber supply-chain guidance is a useful starting point for understanding supplier-related cyber exposure. It does not turn the sample follow-ups above into a universal assurance standard.

If a requested report cannot be distributed, explore an authorised alternative such as a controlled review or a scoped explanation. Record what access was provided and what remains unverified. Do not describe a limitation as resolved merely because the supplier has a confidentiality reason for it.

Consolidate requests without merging judgments

Ask the service owner, security reviewer and continuity lead whether they are requesting the same facts. A single coordinated request may be easier for the supplier to route.

Keep each team's evaluation question attached to the shared response. A restoration report may be relevant to security and continuity, but each reviewer may draw a different limited conclusion. Combining the email should not create an unsupported collective approval.

Assign one internal contact for the request and one owner for each unresolved decision. Those roles can be held by the same person in a small team, provided the responsibilities are clear.

Use a request tracker that exposes the next action

For each open request, record:

• The service and unresolved question.
• Existing evidence checked, including the relevant section.
• The specific request and supplier contact.
• Internal owner and agreed response date.
• Response received and reviewer assessment.
• Remaining limitation, next action and escalation reason.

“Chased three times” describes activity. It does not show what the organisation will do if the evidence remains unavailable. Agree an escalation based on the consequence of the unanswered question and the decision timeline.

A renewal approaching before a key uncertainty is resolved may require a management decision. The collector should not quietly convert an overdue request into an accepted risk.

Close the question after reviewing the answer

When material arrives, check that it covers the intended service and period. Compare it with earlier statements and identify any contradiction. Then record whether it resolves the question, narrows it or creates another issue.

If the missing answer sits behind a report's conclusion, first work through the assurance-report coverage questions so the follow-up targets an actual gap.

Use the evidence checklist to connect the final response to the assessment and decision. A precise request is successful when it produces usable evidence or a clear, escalated limitation, not simply when another attachment reaches the inbox.