{
  "reviewed": "2026-09-25",
  "source": "https://vendorriskquestionnaire.com/",
  "license": "CC-BY-4.0",
  "licenseUrl": "https://creativecommons.org/licenses/by/4.0/",
  "attribution": "Supplier risk question bank from vendorriskquestionnaire.com by Qeluntra",
  "supplierTypes": [
    {
      "id": "materials",
      "name": "Raw materials"
    },
    {
      "id": "components",
      "name": "Components and parts"
    },
    {
      "id": "logistics",
      "name": "Logistics and freight"
    },
    {
      "id": "it",
      "name": "IT and software"
    },
    {
      "id": "services",
      "name": "Professional services"
    },
    {
      "id": "facilities",
      "name": "Facilities and maintenance"
    },
    {
      "id": "construction",
      "name": "Construction and contracting"
    }
  ],
  "riskAreas": [
    {
      "id": "company",
      "name": "Company and ownership"
    },
    {
      "id": "financial",
      "name": "Financial stability"
    },
    {
      "id": "continuity",
      "name": "Business continuity"
    },
    {
      "id": "quality",
      "name": "Quality"
    },
    {
      "id": "cyber",
      "name": "Cyber security and data protection"
    },
    {
      "id": "ai",
      "name": "AI use on your data"
    },
    {
      "id": "esg",
      "name": "ESG and responsible sourcing"
    },
    {
      "id": "compliance",
      "name": "Compliance and ethics"
    },
    {
      "id": "insurance",
      "name": "Insurance"
    },
    {
      "id": "subsuppliers",
      "name": "Sub-suppliers"
    },
    {
      "id": "hse",
      "name": "Health and safety"
    }
  ],
  "answerTypes": {
    "yesno": "Yes / No",
    "text": "Text",
    "number": "Number",
    "date": "Date",
    "document": "Document requested"
  },
  "questions": [
    {
      "id": "company-1",
      "area": "company",
      "types": "all",
      "text": "What is your company's full legal name and registration number?",
      "answer": "text",
      "why": "Confirms you're contracting with the right legal entity."
    },
    {
      "id": "company-2",
      "area": "company",
      "types": "all",
      "text": "Who are your ultimate beneficial owners (holding 25% or more)?",
      "answer": "text",
      "why": "Ownership affects conflicts of interest and sanctions checks."
    },
    {
      "id": "company-3",
      "area": "company",
      "types": "all",
      "text": "In which countries do you have operations that would serve us?",
      "answer": "text",
      "why": "Shows where work is done and which rules apply."
    },
    {
      "id": "company-4",
      "area": "company",
      "types": "all",
      "text": "How many years has the company been trading?",
      "answer": "number",
      "why": "Track record is a simple indicator of stability."
    },
    {
      "id": "company-5",
      "area": "company",
      "types": "all",
      "text": "How many employees do you have?",
      "answer": "number",
      "why": "Indicates capacity and dependence on key people."
    },
    {
      "id": "company-6",
      "area": "company",
      "types": "all",
      "text": "Please provide a current certificate of registration or trade licence.",
      "answer": "document",
      "why": "Evidence that the company is registered and active."
    },
    {
      "id": "company-7",
      "area": "company",
      "types": "all",
      "text": "Has the company changed ownership in the last 3 years?",
      "answer": "yesno",
      "why": "Recent ownership changes can change priorities and risk."
    },
    {
      "id": "company-8",
      "area": "company",
      "types": "all",
      "text": "Who will be our main contact, and who is their backup?",
      "answer": "text",
      "why": "Avoids depending on one person."
    },
    {
      "id": "financial-1",
      "area": "financial",
      "types": "all",
      "text": "Please share your last two years of financial statements.",
      "answer": "document",
      "why": "The basic evidence of financial health."
    },
    {
      "id": "financial-2",
      "area": "financial",
      "types": "all",
      "text": "What was your annual revenue in the last financial year?",
      "answer": "number",
      "why": "Lets us see how large our spend is relative to your business."
    },
    {
      "id": "financial-3",
      "area": "financial",
      "types": "all",
      "text": "What share of your revenue would our business represent?",
      "answer": "number",
      "why": "Very high dependence on one customer is a risk for both sides."
    },
    {
      "id": "financial-4",
      "area": "financial",
      "types": "all",
      "text": "Are you subject to any insolvency, restructuring or major debt proceedings?",
      "answer": "yesno",
      "why": "Direct signal of financial distress."
    },
    {
      "id": "financial-5",
      "area": "financial",
      "types": "all",
      "text": "Have your audited accounts ever been qualified by the auditor?",
      "answer": "yesno",
      "why": "A qualified opinion can signal accounting problems."
    },
    {
      "id": "financial-6",
      "area": "financial",
      "types": "all",
      "text": "Are there any outstanding legal claims above 5% of your annual revenue?",
      "answer": "yesno",
      "why": "Large claims can affect your ability to deliver."
    },
    {
      "id": "financial-7",
      "area": "financial",
      "types": "all",
      "text": "Which bank(s) do you use for operations?",
      "answer": "text",
      "why": "Supports payment set-up and verification."
    },
    {
      "id": "financial-8",
      "area": "financial",
      "types": [
        "materials",
        "components"
      ],
      "text": "Do you require advance payment for raw materials or tooling?",
      "answer": "yesno",
      "why": "Advance payments increase our exposure if you fail."
    },
    {
      "id": "continuity-1",
      "area": "continuity",
      "types": "all",
      "text": "Do you have a written business continuity plan?",
      "answer": "document",
      "why": "Shows you have prepared for disruption."
    },
    {
      "id": "continuity-2",
      "area": "continuity",
      "types": "all",
      "text": "When did you last test the plan, and what was the result?",
      "answer": "date",
      "why": "An untested plan often fails when needed."
    },
    {
      "id": "continuity-3",
      "area": "continuity",
      "types": [
        "materials",
        "components",
        "logistics",
        "facilities",
        "construction"
      ],
      "text": "Do you produce or store our items at more than one site?",
      "answer": "yesno",
      "why": "A single site is a single point of failure."
    },
    {
      "id": "continuity-4",
      "area": "continuity",
      "types": [
        "materials",
        "components",
        "logistics",
        "facilities",
        "construction"
      ],
      "text": "What is your recovery time if your main site is unavailable?",
      "answer": "text",
      "why": "Tells us how long supply could stop."
    },
    {
      "id": "continuity-5",
      "area": "continuity",
      "types": "all",
      "text": "Which of your own suppliers could stop your service to us if they failed?",
      "answer": "text",
      "why": "Reveals hidden dependencies further up the chain."
    },
    {
      "id": "continuity-6",
      "area": "continuity",
      "types": [
        "materials",
        "components"
      ],
      "text": "How many weeks of finished stock or safety stock do you hold for our items?",
      "answer": "number",
      "why": "Buffer stock protects us during short disruptions."
    },
    {
      "id": "continuity-7",
      "area": "continuity",
      "types": [
        "it",
        "services"
      ],
      "text": "What is your recovery time and recovery point objective for systems we rely on?",
      "answer": "text",
      "why": "Defines how much time and data could be lost in an outage."
    },
    {
      "id": "continuity-8",
      "area": "continuity",
      "types": [
        "logistics"
      ],
      "text": "What alternative routes or carriers can you use if a lane is disrupted?",
      "answer": "text",
      "why": "Route and carrier options reduce delay risk."
    },
    {
      "id": "continuity-9",
      "area": "continuity",
      "types": "all",
      "text": "How will you notify us of a disruption, and how quickly?",
      "answer": "text",
      "why": "Early warning gives us time to respond."
    },
    {
      "id": "quality-1",
      "area": "quality",
      "types": "all",
      "text": "Which quality management certifications do you hold (for example ISO 9001)?",
      "answer": "document",
      "why": "Independent evidence of a quality system."
    },
    {
      "id": "quality-2",
      "area": "quality",
      "types": [
        "materials",
        "components"
      ],
      "text": "What was your defect rate for the last 12 months (parts per million)?",
      "answer": "number",
      "why": "A direct measure of quality performance."
    },
    {
      "id": "quality-3",
      "area": "quality",
      "types": "all",
      "text": "What was your on-time delivery rate for the last 12 months?",
      "answer": "number",
      "why": "Reliability of delivery matters as much as price."
    },
    {
      "id": "quality-4",
      "area": "quality",
      "types": "all",
      "text": "How do you handle non-conforming products or services and corrective actions?",
      "answer": "text",
      "why": "Shows how problems get fixed and prevented."
    },
    {
      "id": "quality-5",
      "area": "quality",
      "types": [
        "materials",
        "components"
      ],
      "text": "Can you provide certificates of conformity or material test reports with each shipment?",
      "answer": "yesno",
      "why": "Traceable proof that what arrives meets the specification."
    },
    {
      "id": "quality-6",
      "area": "quality",
      "types": [
        "materials",
        "components"
      ],
      "text": "Do you have batch or lot traceability back to raw materials?",
      "answer": "yesno",
      "why": "Needed to contain a defect or recall quickly."
    },
    {
      "id": "quality-7",
      "area": "quality",
      "types": [
        "services"
      ],
      "text": "How do you measure and report service quality to clients?",
      "answer": "text",
      "why": "Agreed measures make service levels enforceable."
    },
    {
      "id": "quality-8",
      "area": "quality",
      "types": "all",
      "text": "Have you had any product recalls or major customer complaints in the last 3 years?",
      "answer": "yesno",
      "why": "Past incidents indicate process weaknesses."
    },
    {
      "id": "quality-9",
      "area": "quality",
      "types": [
        "construction"
      ],
      "text": "Can you share references for comparable projects completed in the last 3 years?",
      "answer": "text",
      "why": "Evidence you've delivered similar work."
    },
    {
      "id": "cyber-1",
      "area": "cyber",
      "types": "all",
      "text": "Will you store, process or access any of our data or systems?",
      "answer": "yesno",
      "why": "Determines whether the rest of this section applies."
    },
    {
      "id": "cyber-2",
      "area": "cyber",
      "types": [
        "it",
        "services"
      ],
      "text": "Which security certifications or reports do you hold (for example ISO 27001, SOC 2)?",
      "answer": "document",
      "why": "Independent assurance of security controls."
    },
    {
      "id": "cyber-3",
      "area": "cyber",
      "types": "all",
      "text": "Do you enforce multi-factor authentication for all staff with access to our data or systems?",
      "answer": "yesno",
      "why": "MFA prevents most account takeovers."
    },
    {
      "id": "cyber-4",
      "area": "cyber",
      "types": [
        "it",
        "services"
      ],
      "text": "Where (which countries) will our data be stored and processed?",
      "answer": "text",
      "why": "Data location affects legal obligations and risk."
    },
    {
      "id": "cyber-5",
      "area": "cyber",
      "types": [
        "it",
        "services"
      ],
      "text": "Is our data encrypted in transit and at rest?",
      "answer": "yesno",
      "why": "Encryption limits damage if data is intercepted or stolen."
    },
    {
      "id": "cyber-6",
      "area": "cyber",
      "types": "all",
      "text": "Have you had a security incident affecting customer data in the last 3 years?",
      "answer": "yesno",
      "why": "Past breaches indicate risk and response maturity."
    },
    {
      "id": "cyber-7",
      "area": "cyber",
      "types": "all",
      "text": "How quickly will you notify us of a security incident affecting our data?",
      "answer": "text",
      "why": "Fast notification lets us meet our own obligations."
    },
    {
      "id": "cyber-8",
      "area": "cyber",
      "types": [
        "it",
        "services"
      ],
      "text": "Which subcontractors or cloud providers will have access to our data?",
      "answer": "text",
      "why": "Each additional party widens exposure."
    },
    {
      "id": "cyber-9",
      "area": "cyber",
      "types": [
        "it",
        "services"
      ],
      "text": "How will our data be returned or deleted when the contract ends?",
      "answer": "text",
      "why": "Prevents data being left behind after exit."
    },
    {
      "id": "cyber-10",
      "area": "cyber",
      "types": [
        "it",
        "services"
      ],
      "text": "How often do you run independent penetration tests, and can you share a summary?",
      "answer": "document",
      "why": "Shows weaknesses are looked for and fixed."
    },
    {
      "id": "cyber-11",
      "area": "cyber",
      "types": "all",
      "text": "Do staff receive security awareness training at least yearly?",
      "answer": "yesno",
      "why": "People are the most common entry point for attacks."
    },
    {
      "id": "ai-1",
      "area": "ai",
      "types": "all",
      "text": "Do you use AI tools or AI agents in the work you do for us?",
      "answer": "yesno",
      "why": "Determines whether the rest of this section applies."
    },
    {
      "id": "ai-2",
      "area": "ai",
      "types": "all",
      "text": "Will any of our data be entered into AI tools? If so, which tools?",
      "answer": "text",
      "why": "Our data may leave your control once entered into an AI service."
    },
    {
      "id": "ai-3",
      "area": "ai",
      "types": "all",
      "text": "Is our data used to train or improve any AI model, yours or a provider's?",
      "answer": "yesno",
      "why": "Training use can expose our information to others."
    },
    {
      "id": "ai-4",
      "area": "ai",
      "types": "all",
      "text": "Do you keep an inventory of the AI agents and tools your staff use?",
      "answer": "yesno",
      "why": "You can't control AI use you don't know about."
    },
    {
      "id": "ai-5",
      "area": "ai",
      "types": "all",
      "text": "Are consequential AI decisions or actions reviewed by a person before they take effect?",
      "answer": "yesno",
      "why": "Human review limits the impact of AI errors."
    },
    {
      "id": "ai-6",
      "area": "ai",
      "types": "all",
      "text": "Can you show which AI actions were taken on our data, and when?",
      "answer": "yesno",
      "why": "An audit trail is needed to investigate problems."
    },
    {
      "id": "ai-7",
      "area": "ai",
      "types": "all",
      "text": "Do you have a written AI use policy for staff?",
      "answer": "document",
      "why": "Shows AI use is governed, not ad hoc."
    },
    {
      "id": "ai-8",
      "area": "ai",
      "types": [
        "it",
        "services"
      ],
      "text": "Do AI agents in your service hold credentials that can act in our systems?",
      "answer": "yesno",
      "why": "Agents with credentials can take real actions and need strict limits."
    },
    {
      "id": "esg-1",
      "area": "esg",
      "types": "all",
      "text": "Do you have a supplier code of conduct or responsible sourcing policy?",
      "answer": "document",
      "why": "Sets expectations for your own supply chain."
    },
    {
      "id": "esg-2",
      "area": "esg",
      "types": "all",
      "text": "Do you measure your greenhouse gas emissions (scope 1 and 2 at least)?",
      "answer": "yesno",
      "why": "Needed if we report emissions across our supply chain."
    },
    {
      "id": "esg-3",
      "area": "esg",
      "types": [
        "materials",
        "components"
      ],
      "text": "Can you disclose the country of origin of the main materials in our items?",
      "answer": "yesno",
      "why": "Origin affects labour, environmental and trade risks."
    },
    {
      "id": "esg-4",
      "area": "esg",
      "types": "all",
      "text": "How do you check for forced or child labour in your operations and supply chain?",
      "answer": "text",
      "why": "A serious legal and reputational risk."
    },
    {
      "id": "esg-5",
      "area": "esg",
      "types": "all",
      "text": "Do you hold any environmental certifications (for example ISO 14001)?",
      "answer": "document",
      "why": "Independent evidence of environmental management."
    },
    {
      "id": "esg-6",
      "area": "esg",
      "types": [
        "materials",
        "components",
        "logistics",
        "facilities",
        "construction"
      ],
      "text": "How do you manage waste and hazardous materials from the work you do for us?",
      "answer": "text",
      "why": "Improper disposal can create liability for both parties."
    },
    {
      "id": "esg-7",
      "area": "esg",
      "types": "all",
      "text": "What share of your workforce and spend is local to the countries you serve us from?",
      "answer": "text",
      "why": "Relevant where local-content goals apply."
    },
    {
      "id": "esg-8",
      "area": "esg",
      "types": "all",
      "text": "Do you have targets to reduce emissions, energy use or waste? Please describe them.",
      "answer": "text",
      "why": "Shows whether environmental performance is managed over time."
    },
    {
      "id": "esg-9",
      "area": "esg",
      "types": "all",
      "text": "Do workers in your operations have written contracts, fair working hours and a way to raise grievances?",
      "answer": "yesno",
      "why": "Basic labour standards that buyers are expected to check."
    },
    {
      "id": "compliance-1",
      "area": "compliance",
      "types": "all",
      "text": "Do you have an anti-bribery and corruption policy, and do staff receive training on it?",
      "answer": "document",
      "why": "Bribery by a supplier can create liability for the buyer."
    },
    {
      "id": "compliance-2",
      "area": "compliance",
      "types": "all",
      "text": "Do you screen your company, owners and partners against sanctions lists?",
      "answer": "yesno",
      "why": "Dealing with sanctioned parties is prohibited in many jurisdictions."
    },
    {
      "id": "compliance-3",
      "area": "compliance",
      "types": "all",
      "text": "Are you, your owners or directors subject to any sanctions or debarment?",
      "answer": "yesno",
      "why": "A direct compliance blocker."
    },
    {
      "id": "compliance-4",
      "area": "compliance",
      "types": "all",
      "text": "Do any of your owners or staff have a relationship with our employees that could be a conflict of interest?",
      "answer": "yesno",
      "why": "Conflicts of interest undermine fair selection."
    },
    {
      "id": "compliance-5",
      "area": "compliance",
      "types": "all",
      "text": "Do you have a whistleblowing channel for staff and third parties?",
      "answer": "yesno",
      "why": "Lets problems be reported before they grow."
    },
    {
      "id": "compliance-6",
      "area": "compliance",
      "types": "all",
      "text": "Have you been subject to regulatory fines or investigations in the last 5 years?",
      "answer": "yesno",
      "why": "Indicates compliance risk."
    },
    {
      "id": "compliance-7",
      "area": "compliance",
      "types": "all",
      "text": "Do you hold all licences and permits required for the work you'd do for us?",
      "answer": "document",
      "why": "Unlicensed work can be stopped or invalid."
    },
    {
      "id": "compliance-8",
      "area": "compliance",
      "types": [
        "logistics"
      ],
      "text": "Are you licensed for customs brokerage or dangerous goods where relevant?",
      "answer": "document",
      "why": "Some shipments require specific licences."
    },
    {
      "id": "insurance-1",
      "area": "insurance",
      "types": "all",
      "text": "Please provide certificates for your current insurance policies.",
      "answer": "document",
      "why": "Evidence that cover exists and is current."
    },
    {
      "id": "insurance-2",
      "area": "insurance",
      "types": "all",
      "text": "What is your general / public liability cover limit?",
      "answer": "number",
      "why": "Covers damage or injury to third parties."
    },
    {
      "id": "insurance-3",
      "area": "insurance",
      "types": [
        "materials",
        "components"
      ],
      "text": "What is your product liability cover limit?",
      "answer": "number",
      "why": "Covers harm caused by defective products."
    },
    {
      "id": "insurance-4",
      "area": "insurance",
      "types": [
        "services"
      ],
      "text": "What is your professional indemnity cover limit?",
      "answer": "number",
      "why": "Covers losses from errors in professional advice or work."
    },
    {
      "id": "insurance-5",
      "area": "insurance",
      "types": [
        "it",
        "services"
      ],
      "text": "Do you hold cyber insurance, and what is the limit?",
      "answer": "number",
      "why": "Helps cover the cost of a breach involving our data."
    },
    {
      "id": "insurance-6",
      "area": "insurance",
      "types": [
        "logistics"
      ],
      "text": "What cargo insurance applies to goods in your care, and up to what value?",
      "answer": "number",
      "why": "Determines who bears loss or damage in transit."
    },
    {
      "id": "insurance-7",
      "area": "insurance",
      "types": [
        "facilities",
        "construction",
        "logistics"
      ],
      "text": "Do you hold employer's liability or workers' compensation cover as required locally?",
      "answer": "yesno",
      "why": "Protects workers and limits our exposure on site."
    },
    {
      "id": "insurance-8",
      "area": "insurance",
      "types": "all",
      "text": "Will you name us as an additional insured where appropriate?",
      "answer": "yesno",
      "why": "Lets us claim directly under your policy."
    },
    {
      "id": "subsuppliers-1",
      "area": "subsuppliers",
      "types": "all",
      "text": "Will you subcontract any part of the work for us? If so, which parts?",
      "answer": "text",
      "why": "Subcontracting moves work outside direct control."
    },
    {
      "id": "subsuppliers-2",
      "area": "subsuppliers",
      "types": "all",
      "text": "Will you ask for our approval before adding or changing a subcontractor?",
      "answer": "yesno",
      "why": "Keeps visibility of who actually does the work."
    },
    {
      "id": "subsuppliers-3",
      "area": "subsuppliers",
      "types": "all",
      "text": "Do you apply the same requirements (quality, security, ethics) to your subcontractors?",
      "answer": "yesno",
      "why": "Risks pass down the chain unless requirements do too."
    },
    {
      "id": "subsuppliers-4",
      "area": "subsuppliers",
      "types": [
        "materials",
        "components"
      ],
      "text": "Which critical inputs come from a single source?",
      "answer": "text",
      "why": "Single-source inputs are a common cause of shortages."
    },
    {
      "id": "subsuppliers-5",
      "area": "subsuppliers",
      "types": "all",
      "text": "How do you monitor the performance and risk of your key suppliers?",
      "answer": "text",
      "why": "Shows whether upstream problems would be caught early."
    },
    {
      "id": "subsuppliers-6",
      "area": "subsuppliers",
      "types": "all",
      "text": "Please list the subcontractors and key suppliers you would use for our work, with their countries.",
      "answer": "document",
      "why": "You can't manage risks in a chain you can't see."
    },
    {
      "id": "subsuppliers-7",
      "area": "subsuppliers",
      "types": [
        "it",
        "services"
      ],
      "text": "Which subprocessors or cloud providers will store or process our data?",
      "answer": "text",
      "why": "Each subprocessor is another place your data lives."
    },
    {
      "id": "subsuppliers-8",
      "area": "subsuppliers",
      "types": [
        "materials",
        "components",
        "logistics",
        "facilities",
        "construction"
      ],
      "text": "What would you do if a key supplier of yours failed or stopped delivering?",
      "answer": "text",
      "why": "Tests whether upstream failure has a backup plan."
    },
    {
      "id": "hse-1",
      "area": "hse",
      "types": [
        "facilities",
        "construction",
        "logistics"
      ],
      "text": "Do you have a health and safety management system (for example ISO 45001)?",
      "answer": "document",
      "why": "Structured safety management reduces incidents on site."
    },
    {
      "id": "hse-2",
      "area": "hse",
      "types": [
        "facilities",
        "construction",
        "logistics"
      ],
      "text": "What was your lost-time injury rate in the last 12 months?",
      "answer": "number",
      "why": "A standard measure of safety performance."
    },
    {
      "id": "hse-3",
      "area": "hse",
      "types": [
        "facilities",
        "construction",
        "logistics"
      ],
      "text": "Will your staff receive our site induction and follow our site rules?",
      "answer": "yesno",
      "why": "Consistent rules protect everyone on site."
    },
    {
      "id": "hse-4",
      "area": "hse",
      "types": [
        "construction"
      ],
      "text": "Please provide a method statement and risk assessment for the proposed work.",
      "answer": "document",
      "why": "Shows how the work will be done safely."
    },
    {
      "id": "hse-5",
      "area": "hse",
      "types": [
        "facilities",
        "construction",
        "logistics"
      ],
      "text": "Have you had any serious incidents or safety enforcement actions in the last 3 years?",
      "answer": "yesno",
      "why": "Past incidents indicate safety risk."
    },
    {
      "id": "hse-6",
      "area": "hse",
      "types": [
        "logistics"
      ],
      "text": "How do you manage driver hours, fatigue and vehicle maintenance?",
      "answer": "text",
      "why": "Key causes of road incidents."
    },
    {
      "id": "hse-7",
      "area": "hse",
      "types": [
        "facilities",
        "construction",
        "logistics"
      ],
      "text": "Are your staff trained and certified for the work they will do (for example working at height or with electrical systems)?",
      "answer": "yesno",
      "why": "Untrained work is a leading cause of serious injury."
    },
    {
      "id": "hse-8",
      "area": "hse",
      "types": [
        "facilities",
        "construction",
        "logistics"
      ],
      "text": "Please share your written health and safety policy, signed by senior management.",
      "answer": "document",
      "why": "Shows safety is owned at the top of the company."
    }
  ]
}