Compliance · Vendor risk
Answer libraries make the second security questionnaire cost a fraction of the first. They also quietly keep asserting controls that stopped working — and a questionnaire answer is not marketing copy, it is a representation your customer will hold you to.
Every company past its first enterprise deal knows the ritual. A customer’s procurement team sends a spreadsheet — 120 rows, sometimes 400 — and the deal stops moving until somebody fills it in. It is a CAIQ, or a SIG Lite, or a VSA, or a questionnaire the customer’s legal team wrote themselves in 2019 and has extended every year since. The questions are 80% the same as the last one. The phrasing is entirely different.
So you build an answer library. You answer "do you encrypt customer data at rest?" once, store it, and the next time a version of that question arrives it fills itself in. This is genuinely good engineering and it saves real weeks. Every compliance platform on the market ships it, and if you do not have one you should.
The problem is not the library. The problem is what happens to it in month fourteen.
Consider four ordinary answers, all of them true on the day they were written:
Not one of those sentences is a lie anybody told. Each one is a sentence that stopped being true while sitting in a database, and there was no moment at which anyone was asked to reconsider it. That is the failure mode, and it is structural: the answer is text, and text does not expire.
The current generation of questionnaire automation does three things well and one thing not at all.
A new question is compared against what you have answered before, so a reworded version of a question you have already handled fills itself in. Fast, effective, and the source of most of the time saved.
For questions the library has never seen, a language model writes something plausible from whatever context it was given. Useful when the context is your real control state; actively dangerous when it is not.
How many rows are done, how many remain, who is blocking. Ordinary project mechanics, and welcome.
This is the gap. Nothing in a standard answer library knows that the evidence behind an answer has lapsed, because the answer was never connected to any evidence in the first place.
The result is a system that gets faster every quarter and less accurate at the same rate. The library grows, the match rate climbs, the completion time drops — and the proportion of answers that no longer reflect reality rises silently, because nothing in the design is capable of noticing.
The fix is not a review reminder. Calendar reminders to "review the answer library" are ignored for the same reason annual policy reviews are ignored: they arrive undifferentiated, covering hundreds of entries of which a handful have actually changed, so the rational response is to skim and approve everything.
The fix is structural. When an answer is approved, record what makes it true — the control it rests on, and the specific dated artefact that evidences that control. The access review answer points at the access review. The penetration testing answer points at the report. The encryption answer points at the key policy export. Then let the artefact’s own expiry date govern the answer.
Any compliance programme worth the name records when an artefact was collected and when it stops counting. That expiry is exactly the signal an answer library needs, and in most organisations it already exists — it is just not connected to anything.
A stale answer should stay visible and stay in the history. What it loses is the right to speak for you unattended: it stops auto-filling new questionnaires and comes back to a human with the reason attached.
Once answers expire with their evidence, "which answers went stale this quarter" is the same list as "which controls stopped being evidenced". That is a genuinely useful compliance artefact that nobody had to compile.
If the export names the clause and the dated artefact behind each answer, the recipient can verify rather than trust. That changes the character of the document — and it is a competitive advantage in a procurement process, not just an internal hygiene measure.
Drafting is automation; approving is a representation. Keep a person and a name between the two, and record which one it was. If a bulk-approve button exists, restrict it to answers a human already approved once against cited evidence — never to fresh model output that nobody has read.
A model told only the question will write the answer the question is fishing for. A model told which of your controls are verified, which are merely implemented and which are absent will write "partial" and "no" where those are the truth — which is what you need, because an overstated answer is the expensive kind.
A single "92% automated" figure invites trust it has not earned. Break it apart: how many answers came from your own approved library, how many were drafted by a model, how many were held back because their evidence expired, how many nobody can answer honestly. The last two numbers are the ones worth reading.
The pressure in a questionnaire is always toward a "yes". A system that cannot return "no" or "not applicable, and here is why" is not a compliance tool; it is a plausibility generator with a deal attached.
Here is a question worth asking your current process, whatever tooling sits behind it: pick the last questionnaire you sent back, choose any three answers, and produce the artefact that made each one true on the day you sent it.
If that takes more than a few minutes, the answers were assertions rather than evidence — and the gap between those two words is where the risk in this whole exercise actually lives. Most organisations find at least one answer they can no longer support. That is not a scandal. It is simply what happens when claims and proof are kept in different systems, and it is fixable the moment they are kept in the same one.
Next step
A 30-minute call, then a scope document with what is in, what is out and what it costs. No obligation, and no charge for the conversation.
