docs

Supplier Questionnaire Authoring

2026.09-supplier-questionnaires2026-09-11

Supplier Questionnaire Authoring

Plans: The Growth and above for authoring. Running an assessment stays available on every plan. Where: Suppliers → Questionnaires

Until now, every supplier assessment used the same built-in questionnaire, and there was no way to change a question’s wording, weight, or scoring. You can now clone it and build your own.

What’s new

Clone and customise your own questionnaire

Clone the built-in Technological or Non-technological questionnaire into a draft, then edit question text, help text, weights, answer options, and add or remove questions. A live scoring preview shows the impact of every weight change as you make it. See Author and approve supplier questionnaires for the full walkthrough.

A submit / review / publish workflow, not a direct edit

A scoring change now goes through the same separation-of-duties discipline as everything else that moves risk numbers in AutoCISO: the person who authors a draft submits it for approval, and a different Manager or Owner reviews the scoring impact, acknowledges each significant change, and publishes it. You’ll find pending submissions through a badge on the Questionnaires nav item — that badge is the primary way approvers are told something is waiting, not the notification.

A submission that isn’t ready can be sent back to its author with a reason, rather than published or refused outright.

Published versions are immutable, and assessment snapshots are frozen

Every published version of a questionnaire is kept permanently and never changes after the fact. When an assessment is created, it freezes its own copy of the questionnaire it was sent with — so if you later edit and republish the questionnaire, every assessment already sent keeps scoring against the version it was actually given. Historical supplier scores stay reproducible, which is the property this workflow exists to protect for ISO 27001 evidence.

Known, accepted limitations

We’re calling these out now because they’re deliberate trade-offs in this release, not bugs — and because we expect to hear about them from customers.

Authoring needs The Growth; sending an assessment is not

Running a supplier assessment — sending the built-in questionnaire and reviewing the result — remains available on every plan, unchanged. Customising your own questionnaire requires The Growth plan or higher. If you’re on Free or The Seed, you’ll still see the built-in questionnaire and everything it does today; the console shows exactly what upgrading unlocks rather than a bare error.

Scores across different questionnaire versions or templates are not directly comparable

If you customise your questionnaire — or even just publish a new version of it — a supplier scored against v3 and a supplier scored against v4 were not asked identical questions, so their scores are not a like-for-like comparison, and neither are scores between the built-in questionnaire and a custom one. AutoCISO surfaces the template and version alongside every score rather than silently averaging across them. We consider this an accepted limitation of v1, not something dashboards should paper over — if you build your own reporting on top of supplier scores, treat a template or version change the same way you’d treat a change in survey methodology.

A submission can sit waiting for approval indefinitely

There is currently no automatic expiry and no automatic escalation for a questionnaire stuck in Awaiting approval. If the only Manager or Owner who can approve it is out, or nobody notices the badge, the submission simply waits — nothing nudges anyone and nothing times it out. (The Owner can always approve in a pinch, including their own submissions, which is recorded as self-approval in the audit trail.) We plan to revisit reminders for this state; for now, if a submission seems to have “vanished” into the queue, check Suppliers → Questionnaires directly rather than waiting for a follow-up notification.

Next steps

Last reviewed: 2026-10-08

Was this page helpful?

Esc