A due diligence questionnaire (DDQ) is a structured assessment used to evaluate a third party before a business relationship starts. Buyers, investors, and procurement teams use DDQs to review financial stability, governance, legal compliance, operations, and security. DDQs are standard in vendor procurement, investment management, and M&A transactions.
A due diligence questionnaire (DDQ) is a structured assessment sent by buyers, investors, or procurement teams to evaluate a third party before a contract, investment, or acquisition. Most DDQs contain 100 to 500 questions across financial stability, governance, legal compliance, information security, privacy, operational resilience, and ESG.
VeriRFP handles the repeatable parts of the DDQ workflow. It drafts evidence-backed answers, routes reviews by domain, and packages approved responses for delivery.
DDQs vary significantly depending on context. The four most common types serve different audiences and cover different risk domains.
Buyers use different assessment instruments at different stages of procurement. Here is how they compare.
| Type | Scope | Sent by | Length | When |
|---|---|---|---|---|
| DDQ (Due Diligence Questionnaire) | Broad: financials, governance, legal, security, operations, ESG | Procurement, legal, compliance, investors | 100–500 questions | Before contracts, investments, or acquisitions |
| Security Questionnaire (SIG, CAIQ, VSAQ) | Narrow: information security controls, data protection, incident response | Security and IT risk teams | 50–300 questions | Before granting data access or system integration |
| RFI (Request for Information) | Capabilities overview: features, pricing, references, company background | Procurement, project managers | 20–80 questions | Early vendor selection, before shortlisting |
| RFP (Request for Proposal) | Detailed solution proposal: architecture, implementation, pricing, SLAs | Procurement, technical leads | 50–200 questions + proposal narrative | After shortlisting, before contract negotiation |
Financial services firms must comply with OCC, FDIC, and SEC vendor oversight rules. Healthcare organizations follow HIPAA Business Associate requirements. Government agencies follow FAR and DFARS. All three require formal questionnaires before contract approval.
Enterprise contracts above $100K per year trigger enhanced due diligence regardless of industry. Vendors with access to sensitive data or critical workflows face deeper scrutiny.
Limited partners send DDQs to fund managers before committing capital. Acquirers use them to evaluate target companies during M&A. The ILPA DDQ template is the most common standard for LP-GP due diligence.
Every DDQ is different, but most cover these eight risk domains. Each domain includes a sample question to show the level of detail buyers expect.
This domain covers ownership, board structure, and executive leadership. Buyers use it to confirm stable oversight and clear accountability.
This domain covers revenue, profitability, debt, insurance, and audits. Buyers use it to confirm the vendor can support the contract term.
This domain covers litigation, sanctions, anti-bribery controls, and export rules. It matters most for vendors that operate across jurisdictions.
This domain covers SOC 2, ISO 27001, encryption, access controls, and incident response. It often overlaps with a separate security questionnaire.
This domain covers business continuity, disaster recovery, staffing dependencies, and supply chain concentration. Buyers use it to gauge resilience during disruption.
This domain covers GDPR, DPAs, subprocessors, DSAR handling, and cross-border transfers. Buyers use it to confirm lawful and defensible data practices.
This domain covers carbon reporting, labor practices, diversity metrics, and supplier sustainability. Institutional investors and public-sector buyers ask for it more often each year.
This domain covers architecture, hosting, SLAs, change management, and dependencies. Buyers use it to assess technical risk and lock-in.
These are representative questions from real vendor and investment DDQs. Use them as a reference when building your own DDQ response library.
Most vendor DDQs allow 2–4 weeks for response. Investment DDQs from institutional LPs allow 4–6 weeks because the financial and operational disclosure runs deeper. Here is a realistic timeline for a 200-question vendor DDQ:
DDQ stands for due diligence questionnaire. Buyers, investors, and procurement teams use DDQs before contracts, acquisitions, or capital commitments. Most DDQs contain 100 to 500 questions across 6 to 10 risk domains.
A DDQ is broader than a security questionnaire. Security questionnaires focus on controls like encryption, access management, incident response, SOC 2, and ISO 27001. DDQs also cover financial stability, governance, legal exposure, privacy, and business continuity.
Buyers, investors, and compliance teams send DDQs. Banking, healthcare, and government teams often require them before contract approval. Investment firms also send DDQs to fund managers and portfolio companies.
Most DDQs take one to three weeks manually. That timeline usually covers 100 to 300 questions and several internal reviewers. Drafting from a curated evidence library typically shortens that turnaround from weeks to days, since recurring questions can be answered by citing previously approved evidence rather than rewriting from scratch — actual savings vary by team and questionnaire complexity.
A refusal usually stops the deal. Buyers treat an incomplete DDQ as a transparency and control issue. In regulated industries, teams often cannot sign without documented due diligence.
Yes, but every DDQ still needs review. Core facts like certifications, policies, and company data come from a shared library. Buyer-specific wording, dates, and evidence still need approval before submission.
Most DDQs include 100 to 300 questions. Investment DDQs often exceed 500 questions. The ILPA DDQ is a well-known benchmark with about 300 questions.
The ILPA DDQ is a standard investment due diligence template. The Institutional Limited Partners Association created it for limited partners and fund managers. It covers strategy, operations, risk, legal, compliance, and ESG topics.