Author: GRC Practice Director, Alex Hollis.
In this Third Party Risk Management blog series, Alex Hollis will guide you through developing effective information gathering for third parties using five key steps to formulate a third-party questionnaire. The webinar is available on-demand via BrightTALK here, or take a look at our full Third-Party Risk Management services.
There are five key steps to the formulation of a third-party questionnaire:
In this seventh instalment, Alex will explore the do’s and don’ts of writing answerable questions. This will include the importance of allowing respondents to communicate their uncertainty and uses real-life questionnaire examples.
Has there been an information security breach? | Yes/No |
Here the timeframe has been left open to interpretation. The designer intends to ask if there has ever been a security breach; however, a respondent could interpret it as a breach within the last year or as far as they can remember.
When posing questions, don’t force a regular schedule on something which may be conducted sporadically.
How frequently have DR/BC tests been performed? | less than annually, 1-2 annually, 3+ annually. |
A company that doesn’t do regular annual testing but instead does three full tests in a single year every 2-3 years might take an average, selecting ‘1-2 annually,’ or they might answer ‘less than annually’.
Removing this interpretation step by asking prevents any accidental or deliberate misinterpretation. Instead, ask: How many tests have been performed in the last three years? Or: When was the last test conducted?
There is often an assumption that the customer can ask any question, and the third-party will have all the answers. The more specific the question, the more effort there will be to obtain the requested data.
What is the average page loading time customers have experienced in the past 7 days? |
This will likely result in the third-party not answering the question itself but instead redirecting to another area they do have data for or making a less accurate estimation of the answer. Neither of which are particularly useful.
Do you follow a secure software development lifecycle? |
This question assumes that the third-party you are questioning provides you with a developed software product. You may be using some third parties for services only, or for services that are backed by products they do not themselves develop. Forcing an answer to this question is not appropriate.
Following on from the above questions being appropriate, in some circumstances, you might be asking questions of respondents that you cannot determine in advance whether they will be appropriate. If you cannot avoid asking the questions, allow the respondent to express that they do not understand or that the question is inappropriate.
When you come across instances like this, evaluate whether others would benefit from an update to the structure of the question or if it would better target different groups of third-parties.
Alex will be exploring Krosnick’s research on respondent’s experience to answering questions to provide a guide on how to increase your respondents’ level of engagement.
View the previous blogs in our Third-Party Risk Management series, or head over to our Vendor Risk Management capability to see how SureCloud could help you bolster the security of your partnerships.