Give questionnaires one coordinator, usually in security or sales operations, and let subject owners answer within their area. The coordinator tracks status and consistency. Owners are accountable for accuracy. Legal reviews anything that sounds like a commitment.
The failure patterns
Three setups cause most pain. In the first, sales answers everything and guesses. In the second, the one security engineer answers everything and becomes the bottleneck. In the third, nobody owns it and the file sits in a shared inbox.
A workable model
Coordinator. Receives the request, logs it, triages it, assigns questions and sends the final file. This person does not need to know every answer. They need to know who does.
Subject owners. Infrastructure for hosting and backup, security for policies and testing, people operations for screening and training, legal for contracts and privacy. Each answers or reviews rows tagged to them.
Approver. One senior person signs off on anything sent to a buyer. For small teams that is the founder or head of security.
Sales or account owner. Provides context on the deal and the buyer, and relays the final file. They do not edit the answers.
The handoffs that break
- Sales to coordinator. Make a single intake form with the buyer's deadline, deal stage and file attached.
- Coordinator to owners. Assign rows with a due date, not a vague request.
- Owners to approver. Flag any answer where the true answer is "no" or "partial". These need a decision on wording, not a rewrite into something misleading.
- Approver to buyer. Send from a shared mailbox so replies are not lost.
Keep one source of truth
Edits should land in the answer library, not only in the file you send. Otherwise the next questionnaire repeats the old mistakes. See building an answer library.
Cover absences
Name a backup for each role. Questionnaires arrive at quarter end, when people are travelling.
Measure lightly
Track the number received, median turnaround and how many needed legal review. Three numbers are enough to justify more help, or to show the process works.
Quick check
Should sales be allowed to answer low risk questions directly?
Only from approved library answers. Free text from sales is where inaccurate claims enter.
What if the true answer is no?
Say no, add context on compensating controls or plans if they are real, and let the approver decide. Do not dress a no as a yes.
Last reviewed: 19 October 2026.
