Author and approve supplier questionnaires

Every supplier assessment starts from a questionnaire. You can clone the built-in one and make your own version, or build one from scratch: reword a question, change how much an answer costs, add a question of your own, all without touching the original.

Because a scoring change can quietly make your supplier risk ratings mean something different than they did last month, a custom questionnaire goes through the same two-step discipline as everything else that changes risk in AutoCISO: one person authors and submits it, a different person reviews and publishes it.

Open Directory → Questionnaires to get started.

Before you start

• Plan: Sending an assessment on the built-in questionnaire works on every plan. Cloning it or building your own custom questionnaire needs The Growth plan or higher. See Supplier Assessments for what the Free plan and The Seed can still do.
• Roles: Any Contributor, Manager, or Owner can create, edit, preview and submit a questionnaire. Only a Manager or the Owner can review, publish or send one back. See Roles and permissions and Roles at a glance below.

Create a questionnaire

Start from the built-in questionnaire (clone) or from a clean slate.

Clone the built-in questionnaire

From Directory → Questionnaires, either:

• Click Clone built-in questionnaire if you have not customised one yet, or
• Open the row menu on the built-in questionnaire and choose Clone

In the Clone questionnaire dialog, give it a Name (for example “Fintech vendors”), confirm what you’re copying from under Copy from, and optionally check Set as the default questionnaire for new assessments. Click Create draft.

AutoCISO copies every question, weight, and answer option as a starting point. Nothing changes for suppliers yet — this is a private draft only you and your team can see.

Build from scratch

Prefer a clean slate to a clone? Click New questionnaire on Directory → Questionnaires, enter a Name (for example “Vendor security review”), and click Create questionnaire. You get a private draft with one empty section, and the editor opens on Add your first question. From there the flow is the same as for a clone: edit, Preview, Submit for approval.

Edit a questionnaire

Your new draft opens in the questionnaire editor. Use the Sections panel on the left to move between questions, or the Scoring matrix tab to see every question’s Weight in one place, sorted by Share of the total score.

Common edits:

• Change a question’s wording under Question text (English is required; Russian and Hebrew fall back to English until translated)
• Change Weight (1 = minor, 10 = decisive) — the editor shows the scoring impact live as you type
• Add or edit Answer options and their Risk points
• Click Add question to add one of your own

Your changes autosave — the status line reads Saving…, then All changes saved. If someone else on your team edits the same draft while you have it open, AutoCISO tells you and lets you keep your version, take theirs, or open the draft in a new tab to compare.

Sections

Questions live in sections. In the Sections panel on the left:

• Add section (bottom of the panel) asks for a Section title and adds it at the end.
• Rename section is in the section’s row menu (or press F2 on the focused row).
• Delete section is in the same menu. An empty section is deleted after one confirmation. A section with questions asks you to confirm the deletion of every question and answer option in it.

Questions and answer options

• Add question is in a section’s row menu, or inside an empty section. Pick the answer type and the question opens right away so you can type the wording.
• Delete question is in the question’s row menu or the question panel header (or press Delete on the focused row).
• For choice questions, Add option adds an answer in the Answer options table and the remove icon deletes one. A new option starts as “Option 1” with 0 risk, so rename it and set its Risk.

Deleting is permanent for the draft, but published versions are never affected.

What is blocked, and why

AutoCISO refuses edits that would break the questionnaire, and tells you what to fix first.

Limits

The editor shows “N of limit” as you approach a cap, and the message names the limit you hit.

When you can’t edit

Edit controls are hidden, not greyed out, when a questionnaire is read-only: the built-in questionnaire, a questionnaire you only have view access to, one that is Awaiting approval (withdraw it to edit), or one that is published. A banner at the top explains which case applies. A burst of rapid edits can pause saving briefly (“Saving paused, retrying in N s”); it resumes on its own.

Preview

Click Preview at any point to see exactly what a supplier will see — the same view, read-only. AutoCISO reminds you this is preview-only and nothing here is submitted. Use it to sanity-check wording and to switch Supplier profile (Technological / Non-technological) and Language.

Submit for approval

When you’re ready, click Submit for approval in the editor header (or Submit for approval from the row menu in the list). Add an optional Note for the approver, and confirm.

Two things happen:

• Your draft moves to Awaiting approval. You can still Withdraw submission at any time to keep editing.
• Everyone in your organisation sees that a questionnaire is waiting — but only a Manager or the Owner can act on it.

Submit checks

Submit for approval checks the whole draft first. If something is missing (a choice question with fewer than 2 options, a question with no English text), submit is refused with a list of what to fix, and the draft stays a draft.

Separation of duties still applies

The person who made the last edit can’t publish. Edits made through an API token or an AI client (MCP) count as an edit by the person who created that token, so a token can’t be used to get around the second pair of eyes. Cloning a questionnaire makes you its last editor, so you can’t publish your own clone unless you are the Owner. Drafts with no recorded editor can only be published by the Owner.

Review and publish

This is the approver path, and it works differently from most approvals in AutoCISO: you find out through a badge on the nav item, not a notification.

Badge → Queue → Review → Acknowledge → Publish

Badge

If you’re a Manager or the Owner, a questionnaire waiting for approval shows up as a small numbered badge on the Questionnaires item in the left nav — the same place you go to manage questionnaires day to day. It’s there whether you noticed the notification or not, and it stays there until the submission is published, sent back, or withdrawn — including across a reload or a new session days later.

A notification is also sent when a submission comes in, but treat it as a heads-up, not the primary way you’ll find out. The badge is the one that persists.

Queue

Click Questionnaires. At the top of the list you’ll see a banner: “N questionnaires are waiting for your approval” with a Review it / Show them link, and the row itself is tagged Awaiting approval, showing who submitted it and when.

Review

Open the row menu and choose Review and publish. This opens a dialog titled Review and publish "{name}" v{version}, which shows:

• What changes from v{version} — added, changed, and removed questions, with a filter for scoring-only changes
• Scoring impact — how the maximum risk points per mode move as a result of this draft, before you approve anything
• Any warnings worth checking (for example, a weight jump, or a question with no zero-risk answer)

Acknowledge

Changes are grouped by how much they affect scoring. Every significant or severe change carries its own I reviewed this change checkbox next to a plain-language sentence explaining what changed and what it means for suppliers — you can’t publish until every one of them is checked. A live counter reads “Acknowledge N more changes to publish.”

If a change was made by an API token rather than a person, the sentence says so explicitly (for example: “This change was made by the API token ‘Vendor-sync bot,’ not by a person. Nobody in your organisation has reviewed it yet.”) — worth a closer look before you check the box.

Publish

Once everything required is acknowledged, click Publish v{version} and make it live. This is the moment the new questionnaire becomes real:

• It becomes the version every new assessment uses from that point on.
• Assessments already sent keep the version they were sent with — their scores don’t change retroactively.
• This cannot be undone. There is no “unpublish.”

Send a submission back

If a submission isn’t ready — a weight looks like a mistake, wording needs a fix — you don’t have to publish it or reject it outright. Click Send back to {name} (from the row menu, from inside the review dialog, or against a specific change with Send back about it).

Fill in What needs to change and click Send it back. The author sees your reason on the draft the next time they open it, the submission returns to Draft, and your organisation is told it was sent back — not rejected. It’s the author’s draft to fix and resubmit, not a decision that ends the conversation.

You’ll see “send back” everywhere in the interface — that’s the only label a user reads. Internally, the underlying API route and audit trail entry are both named reject, but nothing changes: the draft isn’t refused, it’s returned to its author for another pass.

Roles at a glance

* A Manager cannot approve a draft they made the last edit to — see the callout in Submit for approval.