Original question
Are privileged access rights reviewed every quarter?
Home / Method and evidence
Method and evidence
Sample questionnaire matrix
From the client's wording to the response position and the evidence expected.
Question addressed
Make every inference between a client question and the authorised answer visible.
The security questionnaire is the most underrated document in the supplier relationship: filled in quickly, often by a single person, it creates dozens of contractual commitments. The matrix below shows how each question is treated for what it is: a commitment in the making.
The decisive column is not the answer — it is the qualification. “Yes”, “yes, except for contractors”, “no, remediation in Q4” and “out of scope” are four honest possible answers to the same question; the matrix forces an informed choice.
One questionnaire line, end to end
The original wording remains visible up to the response position.
Proposed response
Yes, a quarterly review is held.
Gap observed
External providers are absent from the export.
Position
Partially supported, correction required before an unqualified response.
Decision enabledEvery "yes" sent is a commitment you chose — never again a reflex under pressure.
Reading a conclusion
Preserve the reasoning between the question and the answer
The matrix does not replace the original questionnaire. It makes visible the implicit commitment, the scope adopted, the approvals obtained, the evidence actually examined, and the caveat that must accompany the final wording.
The line shown illustrates the reasoning structure; the owners and evidence of an actual file remain specific to the company under review.
Starting questionMake every inference between a client question and the authorised answer visible.
- 01Original question retained
- 02Implicit commitment made explicit
- 03Qualified response
Implementation
Retain every inference drawn from the question.
- Original question retained
- Implicit commitment made explicit
- Qualified response
- Exception and evidence visible
01
Question kept unchanged
The client's wording is never paraphrased: it is what will stand as evidence in an audit. The matrix cites the question, its reference and its version.
02
Commitment made explicit
What a "yes" would precisely commit to is set out in black and white: populations, systems, frequencies, timeframes. This is where the surprises appear.
03
Qualified position
Supported, partially supported with written reservation, not supported with a plan, or justified out of scope. The position is validated by the relevant manager, not by sales alone.
04
Evidence and attached reservation
Each position cites the evidence that supports it and the reservation that protects it. Reservations join the register — they will be replayed at the next questionnaire.
Terms of use
The trade-offs that must be made visible on every sensitive line.
They distinguish the desired response, the observed capability, the available evidence and the authority able to accept the final wording.
How long does it take to process a 200-question questionnaire?
The turnaround time depends on the quality of existing answers and the evidence available. Subsequent requests are faster when positions and qualified evidence are maintained in the assurance register.
Who validates the positions?
Each position has a business or technical owner. Cross-validation between sales, security and operations is part of the process — it is what prevents contradictory versions.
Can you say "no" to a major client?
A well-defended "no, with a plan and a deadline" is worth more than a "yes" that will fall apart at audit. Mature buyers know this — and the questionnaire also serves to spot the clients who won't accept it.
Continue reading
Move from the example to the reading of a real questionnaire.
A questionnaire may be presented with or without an attachment; the first read focuses on its deadline and its most demanding questions.