Question bank
Build and maintain reusable questions
The question bank holds questions independently of any questionnaire. Write a question once, use it in as many questionnaires as you like, and keep the findings it raises consistent everywhere.
Anatomy of a question
Type and options
Questions are single-select or multi-select. Each option carries a numeric
value, which is what makes answers scoreable, and optionally a finding raised
when that option is chosen.
An "Other" option can be allowed where a free-text answer is more honest than a forced choice.
Section and weight
Every question belongs to a section, and optionally a sub-section — this is what produces per-section scores on a report. Weight decides how much the question moves the total; rating marks how significant it is relative to the rest.
Conditional display
Questions can depend on earlier answers, combined with and or or logic. A
vendor who says they do not process personal data should not be asked eleven
GDPR questions.
Evidence requirements
Set evidence to none, optional or required, with instructions describing
what you expect. A required attachment means the vendor cannot submit the
questionnaire on assertion alone.
Elaborations
Guidance shown alongside the question. Worth writing for anything a vendor's security lead and a vendor's account manager would read differently.
Findings
Findings are the point of the exercise: they turn an answer into something you can act on. Two patterns:
- Option-based — each option carries its own finding, so "no MFA anywhere" and "MFA on admin accounts only" raise different things.
- Shared — one finding for the question, raised whenever the answer falls short.
Languages
Question text, sections, options and elaborations are localized. A questionnaire declares its languages, and an assessment is sent in one of them — the same question, answered in the vendor's language, scores identically.
Drafting with AI
Questions can be drafted with AI from a short description of what you want to ask. The draft comes back as an ordinary question — type, options, values and suggested findings — which you then edit. Nothing is published to the bank until you save it.
Maintaining the bank
- Keep one canonical question per topic; near-duplicates make scores hard to compare across vendors.
- Revisit values and weights after a few assessment cycles; the first pass is usually approximate.
- Retire questions rather than rewriting them beyond recognition, so historical reports still mean what they said.