If an answer you gave a customer is no longer true, tell them. Find the affected questionnaires, write a short factual correction with the date of the change, and send it through the channel you used originally. Silence turns a small change into a credibility problem if they discover it later.
How answers go stale
Answers drift for ordinary reasons: a tool was replaced, a policy changed, a service was added, a vendor changed. Most are not bad news. The risk is that the customer still holds the old wording and is relying on it.
Decide whether it matters
Ask three questions.
- Did the change reduce the control or only change how it is done?
- Could the customer have relied on the old answer for a decision about their data?
- Does the contract mention the topic?
If the change weakens a control, or the answer is material to the customer, send a correction. If the change is neutral or an improvement, include it in the next scheduled update. When unsure, ask your approver for external security claims, and involve counsel if a contract term is affected. This is process guidance, not legal advice.
Steps
- Identify the changed fact and the date it changed.
- Search your answer library and sent questionnaires for every answer that mentions it.
- List the customers who received those answers.
- Draft a correction with the old statement, the new fact and the effective date.
- Add any compensating control you now have.
- Have the approver sign off, then send it to each customer contact.
- Update the library so future answers use the new wording.
- Record the correction in the commitments register and note when you sent it.
Template
"In our response dated [date] we stated [old statement]. As of [date], [new fact]. [Compensating control or plan, if any]. Please contact us with questions."
Keep it to four sentences. Do not apologise at length or add reassurance you cannot back.
How to prevent drift
- Put a review date on every answer in the library, and an owner.
- Link each answer to the evidence it depends on, so when evidence changes, the answer is flagged.
- Review the library when you change a tool, a policy or a vendor.
- Run the library check as part of your quarterly security review.
Tone
Matter of fact works best. A customer who receives a clean correction learns that you keep your answers under review. That tends to increase trust, not reduce it.
What not to do
Do not quietly edit your trust page and say nothing to customers who received older wording. Do not backdate documents to make the old answer look true. Never alter past records; add a dated note beside them instead.
Where Safeguard fits
Safeguard's compliance and evidence automation links controls to dated evidence, which helps you see when the facts behind an answer have changed. A free scan is available at https://gold.safeguard.sh/scan.
Quick check
Do we correct every small change?
Correct changes that weaken a control or that a customer could rely on. Neutral or improving changes can go in the next scheduled update.
Can we edit the old questionnaire file?
No. Keep the original as sent and add a dated correction beside it.
Last reviewed: 19 October 2026.
