# Author and approve supplier questionnaires
URL: https://docs.autociso.io/product/suppliers/questionnaires/
Description: Build your own supplier questionnaire from scratch or clone the built-in one, edit and preview it, then take it from Submit for approval through Review and publish — or send it back for changes.

Every supplier assessment starts from a questionnaire. You can **clone the built-in one and make your own version**, or build one from scratch: reword a question, change how much an answer costs, add a question of your own, all without touching the original.

Because a scoring change can quietly make your supplier risk ratings mean something different than they did last month, a custom questionnaire goes through the same two-step discipline as everything else that changes risk in AutoCISO: one person authors and submits it, a different person reviews and publishes it.

Open **Directory → [Questionnaires](https://docs.autociso.io/console/directory/supplier-questionnaires/)** to get started.

## Before you start

- **Plan:** Sending an assessment on the built-in questionnaire works on every plan. Cloning it or building your own custom questionnaire needs [The Growth plan or higher](https://docs.autociso.io/getting-started/plans-and-features/). See [Supplier Assessments](https://docs.autociso.io/product/suppliers/assessments/) for what the Free plan and The Seed can still do.
- **Roles:** Any Contributor, Manager, or Owner can create, edit, preview and submit a questionnaire. Only a Manager or the Owner can review, publish or send one back. See [Roles and permissions](https://docs.autociso.io/getting-started/roles-and-permissions/) and [Roles at a glance](#roles-at-a-glance) below.

## Create a questionnaire

Start from the built-in questionnaire (clone) or from a clean slate.

### Clone the built-in questionnaire

From **Directory → Questionnaires**, either:

- Click **Clone built-in questionnaire** if you have not customised one yet, or
- Open the row menu on the built-in questionnaire and choose **Clone**

In the **Clone questionnaire** dialog, give it a **Name** (for example "Fintech vendors"), confirm what you're copying from under **Copy from**, and optionally check **Set as the default questionnaire for new assessments**. Click **Create draft**.

AutoCISO copies every question, weight, and answer option as a starting point. Nothing changes for suppliers yet — this is a private draft only you and your team can see.

### Build from scratch

Prefer a clean slate to a clone? Click **New questionnaire** on **Directory → Questionnaires**, enter a **Name** (for example "Vendor security review"), and click **Create questionnaire**. You get a private draft with one empty section, and the editor opens on **Add your first question**. From there the flow is the same as for a clone: edit, **Preview**, **Submit for approval**.

## Edit a questionnaire

Your new draft opens in the [questionnaire editor](https://docs.autociso.io/console/directory/questionnaire-editor/). Use the **Sections** panel on the left to move between questions, or the **Scoring matrix** tab to see every question's **Weight** in one place, sorted by **Share** of the total score.

Common edits:

- Change a question's wording under **Question text** (English is required; Russian and Hebrew fall back to English until translated)
- Change **Weight** (1 = minor, 10 = decisive) — the editor shows the scoring impact live as you type
- Add or edit **Answer options** and their **Risk** points
- Click **Add question** to add one of your own

**Warning — Don't put personal data in a question**

Question text, help text, and answer options aren't private — they reach the supplier on the public assessment page and are embedded in every exported PDF. See [What you write here is not private](https://docs.autociso.io/product/suppliers/assessments/#what-you-write-here-is-not-private) for the full explanation.

Your changes autosave — the status line reads **Saving…**, then **All changes saved**. If someone else on your team edits the same draft while you have it open, AutoCISO tells you and lets you keep your version, take theirs, or open the draft in a new tab to compare.

### Sections

Questions live in sections. In the **Sections** panel on the left:

- **Add section** (bottom of the panel) asks for a **Section title** and adds it at the end.
- **Rename section** is in the section's row menu (or press F2 on the focused row).
- **Delete section** is in the same menu. An empty section is deleted after one confirmation. A section with questions asks you to confirm the deletion of every question and answer option in it.

### Questions and answer options

- **Add question** is in a section's row menu, or inside an empty section. Pick the answer type and the question opens right away so you can type the wording.
- **Delete question** is in the question's row menu or the question panel header (or press Delete on the focused row).
- For choice questions, **Add option** adds an answer in the **Answer options** table and the remove icon deletes one. A new option starts as "Option 1" with 0 risk, so rename it and set its **Risk**.

Deleting is permanent for the draft, but published versions are never affected.

### What is blocked, and why

AutoCISO refuses edits that would break the questionnaire, and tells you what to fix first.

| You tried to | What happens | Why |
|---|---|---|
| Delete a question or section that another question's conditional rule depends on | "Can't delete yet", listing the questions that depend on it | The dependent question would never show, or would break. Remove or change those rules first. |
| Delete an answer option that another question's rule points at | The remove is refused, with the dependent questions listed | Same reason. |
| Delete the service-type question (shown as **Locked: controls which questions apply**) or its section | No delete control is offered | It decides which questions apply to Technological and Non-technological suppliers. |
| Remove an option so a choice question has fewer than 2 | Refused | A choice question needs at least 2 answers. |
| Add options to a question that isn't a choice type | Refused | Change the answer type to a choice type first. |

### Limits

| Limit | Value |
|---|---|
| Sections per questionnaire | 20 |
| Questions per section | 50 |
| Questions per questionnaire | 300 |
| Options per choice question | 2 to 12 |
| Questionnaires per organization | 50 |

The editor shows "N of limit" as you approach a cap, and the message names the limit you hit.

### When you can't edit

Edit controls are hidden, not greyed out, when a questionnaire is read-only: the built-in questionnaire, a questionnaire you only have view access to, one that is **Awaiting approval** (withdraw it to edit), or one that is published. A banner at the top explains which case applies. A burst of rapid edits can pause saving briefly ("Saving paused, retrying in N s"); it resumes on its own.

## Preview

Click **Preview** at any point to see exactly what a supplier will see — the same view, read-only. AutoCISO reminds you this is preview-only and nothing here is submitted. Use it to sanity-check wording and to switch **Supplier profile** (Technological / Non-technological) and **Language**.

## Submit for approval

When you're ready, click **Submit for approval** in the editor header (or **Submit for approval** from the row menu in the list). Add an optional **Note for the approver**, and confirm.

Two things happen:

- Your draft moves to **Awaiting approval**. You can still **Withdraw submission** at any time to keep editing.
- Everyone in your organisation sees that a questionnaire is waiting — but only a Manager or the Owner can act on it.

**Note — You can't approve your own submission**

If you made the last edit to a draft, you can't publish it — someone else with a Manager or Owner role has to. This is by design: a scoring change never ships without a second set of eyes. The Owner is exempt from this rule and can approve their own changes; it's still recorded as self-approval in the [audit trail](https://docs.autociso.io/console/settings/audit-trail/).

### Submit checks

**Submit for approval** checks the whole draft first. If something is missing (a choice question with fewer than 2 options, a question with no English text), submit is refused with a list of what to fix, and the draft stays a draft.

### Separation of duties still applies

The person who made the last edit can't publish. Edits made through an [API token](https://docs.autociso.io/developers/api-tokens/) or an AI client ([MCP](https://docs.autociso.io/developers/mcp/overview/)) count as an edit by the person who created that token, so a token can't be used to get around the second pair of eyes. Cloning a questionnaire makes you its last editor, so you can't publish your own clone unless you are the Owner. Drafts with no recorded editor can only be published by the Owner.

## Review and publish

This is the approver path, and it works differently from most approvals in AutoCISO: **you find out through a badge on the nav item, not a notification.**

**Badge → Queue → Review → Acknowledge → Publish**

### Badge

If you're a Manager or the Owner, a questionnaire waiting for approval shows up as a small numbered badge on the **Questionnaires** item in the left nav — the same place you go to manage questionnaires day to day. It's there whether you noticed the notification or not, and it stays there until the submission is published, sent back, or withdrawn — including across a reload or a new session days later.

A notification is also sent when a submission comes in, but treat it as a heads-up, not the primary way you'll find out. The badge is the one that persists.

### Queue

Click **Questionnaires**. At the top of the list you'll see a banner: *"N questionnaires are waiting for your approval"* with a **Review it** / **Show them** link, and the row itself is tagged **Awaiting approval**, showing who submitted it and when.

### Review

Open the row menu and choose **Review and publish**. This opens a dialog titled **`Review and publish "{name}" v{version}`**, which shows:

- **`What changes from v{version}`** — added, changed, and removed questions, with a filter for scoring-only changes
- **Scoring impact** — how the maximum risk points per mode move as a result of this draft, before you approve anything
- Any warnings worth checking (for example, a weight jump, or a question with no zero-risk answer)

### Acknowledge

Changes are grouped by how much they affect scoring. Every **significant** or **severe** change carries its own **I reviewed this change** checkbox next to a plain-language sentence explaining what changed and what it means for suppliers — you can't publish until every one of them is checked. A live counter reads **"Acknowledge N more changes to publish."**

If a change was made by an API token rather than a person, the sentence says so explicitly (for example: *"This change was made by the API token 'Vendor-sync bot,' not by a person. Nobody in your organisation has reviewed it yet."*) — worth a closer look before you check the box.

### Publish

Once everything required is acknowledged, click **`Publish v{version} and make it live`**. This is the moment the new questionnaire becomes real:

- It becomes the version every **new** assessment uses from that point on.
- Assessments already sent keep the version they were sent with — their scores don't change retroactively.
- **This cannot be undone.** There is no "unpublish."

**Warning — Removed a critical answer? You must say why**

If this draft removes an answer that was marked as a critical finding in the published version (or removes a question that contained one), publishing needs a written risk-reduction acknowledgement, the same as lowering a critical finding. Removing the answer is not a way around that review.

## Send a submission back

If a submission isn't ready — a weight looks like a mistake, wording needs a fix — you don't have to publish it or reject it outright. Click **`Send back to {name}`** (from the row menu, from inside the review dialog, or against a specific change with **Send back about it**).

Fill in **What needs to change** and click **Send it back**. The author sees your reason on the draft the next time they open it, the submission returns to **Draft**, and your organisation is told it was sent back — not rejected. It's the author's draft to fix and resubmit, not a decision that ends the conversation.

You'll see "send back" everywhere in the interface — that's the only label a user reads. Internally, the underlying [API route](https://docs.autociso.io/api/reference/supplier-templates/list/) and audit trail entry are both named `reject`, but nothing changes: the draft isn't refused, it's returned to its author for another pass.

## Roles at a glance

| Action | Member / Auditor | Contributor | Manager | Owner |
|---|:---:|:---:|:---:|:---:|
| View questionnaires | yes | yes | yes | yes |
| Clone, edit, preview, submit | — | yes | yes | yes |
| Review, acknowledge, publish, send back | — | — | yes* | yes |
| Delete a never-published draft | — | — | — | yes |

\* A Manager cannot approve a draft they made the last edit to — see the callout in [Submit for approval](#submit-for-approval).