Due diligence questionnaire (DDQ): what it is and how to answer one

A due diligence questionnaire, or DDQ, is a written list of questions a buyer, investor or partner sends before they commit to working with you. They use your answers to decide whether you are who you say you are, whether you are stable, and whether you can be trusted with their money, data or customers.

There is no single DDQ. The same three letters cover a 30-question vendor form and a 200-question fund manager questionnaire. This guide explains the three kinds you are most likely to meet, how they differ from a security questionnaire, and how to answer without guessing.

The three kinds of DDQ

• Investor DDQ. An investor, such as a limited partner in a fund, asks a fund manager about the firm, team, strategy, operations, risk controls and reporting. The Institutional Limited Partners Association publishes a standard version for private equity, the [ILPA Due Diligence Questionnaire 2.0](https://ilpa.org/industry-guidance/templates-standards-model-documents/due-diligence-questionnaire-and-diversity-metrics-template). ILPA says it created it because so many investors and managers were writing long, customized questionnaires of their own.
• Vendor or third-party DDQ. A company assessing a supplier asks about financial health, insurance, ownership, subcontractors, compliance, business continuity and information security. This is the kind most software, IT and services companies receive.
• Transaction DDQ. In an acquisition or a financing round, the other side sends questions about contracts, customers, employees, intellectual property, litigation and finances. It is usually answered alongside a data room.

Your first job is to work out which kind you have. The same question, such as 'Describe your risk management process', needs a very different answer in each.

How a DDQ differs from a security questionnaire

A security questionnaire goes deep on technical controls: access, encryption, logging, incident response. A vendor DDQ usually contains a security section, but also asks about things a security team would never touch, such as your corporate structure, insurance and conflicts of interest. In practice it is common to receive both: a DDQ for procurement and a security questionnaire for the buyer's security team.

Large buyers also use third-party risk guidance when they design these forms. NIST's [SP 800-161 Rev. 1](https://csrc.nist.gov/pubs/sp/800/161/r1/final), published in May 2022, describes how organizations manage cybersecurity risk across their supply chains, and it is a good place to see why buyers ask about your own suppliers.

What a vendor DDQ usually asks

Formats vary, but most vendor DDQs cover the same ground:

• Company basics: legal name, year founded, ownership, headquarters, number of employees
• Financial standing: how long you have operated, whether you can supply financial statements, any pending litigation
• Insurance: the types and limits you carry
• Operations: key subcontractors and where they are based, business continuity, support hours
• Compliance: privacy and data protection, regulatory obligations, anti-bribery and conflict-of-interest policies
• Information security: usually a short list, or a pointer to a separate security questionnaire
• References and customer concentration

Notice how much of this is business information, not technical. Whoever owns finance or legal at your company may need to supply half of it.

Example answers (fictional company)

These examples are for a made-up company called Harbour Analytics. Replace the details with your own, and only write what you can back up.

Question: Describe your ownership structure. Answer: Harbour Analytics Inc. is a privately held Ontario corporation. It is owned by its two founders and one outside investor. No single investor holds a controlling interest other than the founders. [Attach cap table summary only if the buyer asks for it.]

Question: Do you use subcontractors to deliver the service? Answer: We use three subprocessors to host and deliver the service. They are listed, with their locations, at [your subprocessor page]. We do not subcontract customer support or development outside the company.

Question: Do you carry cyber liability insurance? Answer: Yes. We carry cyber liability coverage with a limit of [amount] through [insurer], renewed each [month]. A certificate of insurance is available on request.

Question: Are you currently party to any litigation? Answer: No. We are not a party to any pending or threatened litigation that we expect to affect our ability to deliver the service. [If the true answer is yes, say so briefly and offer a call.]

Question: Do you hold an independent security certification? Answer: Not currently. We have [written policies / a completed security questionnaire for similar customers] and can share them under NDA. See our guide to the SOC 2 question for how to word this honestly.

The traps

• Answering for the wrong kind of DDQ. An investor wants strategy and controls; a procurement team wants insurance and subcontractors.
• Rounding up. 'We follow industry best practices' is not an answer, and DDQ answers are often attached to the contract. A wrong statement can become a warranty.
• Saying yes to things you have not checked. If you are not sure whether a policy is written down, find out before you reply.
• Leaving out the 'no'. A short honest 'not currently, here is what we do instead' reads better than a vague paragraph.
• Inconsistency with other documents. Your DDQ, your website, your security answers and your contract should not disagree.

A workable process

1. Identify the kind of DDQ, the due date, and who at the buyer will read it.
2. Split the questions by owner: finance and legal, operations, security, product.
3. Collect existing material first: policies, past DDQs, insurance certificates, your public security and privacy pages.
4. Draft answers from those documents, not from memory, and note the source beside each.
5. Have one person who did not write the answers read them for contradictions.
6. Send the file back in the format you received it, and keep a copy of what you sent.

Step 3 is where most of the time goes, and where a reusable library of approved answers pays off. Our guide to building a security answer library works for DDQ answers too.

Word and PDF files

Many DDQs arrive as Word documents or PDFs, not spreadsheets. In Word, type under each question or in the answer table, and turn on tracked changes if the buyer wants to see edits. A PDF usually cannot be filled in cleanly; answer in a separate document that follows the buyer's question numbers exactly, or ask whether they will accept a Word or Excel copy.

Where Rendro helps

At upload, Rendro lets you choose 'due-diligence questionnaire' as the form type. It drafts each answer only from your own documents, shows the source for every answer, and marks anything your documents do not support as Needs review instead of guessing. A Word questionnaire comes back as the same Word file with the answers in place; a PDF comes back as an Excel answer sheet in the same order. Approved answers go into an answer library for the next DDQ. You review every answer before it goes out. It does not work inside web portals. See due diligence questionnaires at Rendro.

A short checklist

• Decide if it is an investor, vendor or transaction DDQ
• Split questions by owner and set an internal deadline
• Gather policies, insurance certificates and past answers first
• Answer from documents, with a source for each answer
• Write honest 'not currently' answers where needed
• Check the answers against your website and contracts
• Return the file in the format received

Got a DDQ on your desk? Send us the blank questionnaire and we will fill in the first 25 questions free within 48 hours, so you can judge the quality before you pay. Get the free 25-answer sample, or email team@rendro.net with the subject 'Free draft'. Send only the blank file, never confidential documents.