Security questionnaire or shared supplier profile: which fits onboarding?

Procurement sends out its questionnaire, often as a spreadsheet or through its own portal. The supplier answers it, digs out evidence and sends it by email. Follow-up questions, requests for missing documents and reminders follow until the file is complete.

For the supplier this repeats with every customer – with different wording for the same questions. For procurement, answers from different suppliers are hard to compare because each one reads the questions a little differently and the evidence arrives in different forms.

With a shared profile there is one catalog for everyone. The supplier answers each criterion once and uploads the matching evidence right next to it. Buyers see the same criteria in the same order, filter by their minimum requirements and put suppliers side by side.

When something changes – a certificate is renewed, a sub-processor is added – the supplier updates it in one place. All authorised buyers then see the same status.

Effort: the questionnaire costs the supplier time again with every customer; the profile costs it once and afterwards only when something changes.

Comparability: questionnaires differ from customer to customer; a shared catalog delivers answers to identical questions.

Currency: a completed questionnaire is a snapshot; a maintained profile shows the current status, and evidence with an expiry date can be tracked.

Evidence: in the questionnaire process it is scattered across mailboxes; in the profile it is attached to the criterion it refers to.

Individual requirements: this is where the questionnaire is strong – it asks exactly what one customer wants to know. A profile needs an addition for this.

For particularly critical suppliers, a self-assessment against a standard catalog is usually not enough. Industry-specific assessments, special contractual requirements or an on-site audit then remain necessary. The legal assessment – for example whether a processor provides sufficient guarantees under Art. 28(1) GDPR – is always made by the customer itself.

A division of labour makes sense: the shared profile provides the baseline review for all suppliers, while your own questions and targeted reviews cover the specifics. On Vendo4u, buyers on a paid plan ask their own questions separately from the trust score; the answers appear in the respective supplier profile.