Professional services vendor questionnaire

Questions for consultants, agencies and outsourced service providers: who you are contracting with, how they handle your information, conflicts of interest, insurance, and who actually does the work.

69 questions in 10 sections. Each has the kind of answer you need and a one-line reason you can keep in the questionnaire, so suppliers understand why you ask.

Download Word (.doc) Download spreadsheet (.csv) Customise it in the builder

1. Company and ownership (8)

What is your company's full legal name and registration number?TextWhy we ask: Confirms you're contracting with the right legal entity.
Who are your ultimate beneficial owners (holding 25% or more)?TextWhy we ask: Ownership affects conflicts of interest and sanctions checks.
In which countries do you have operations that would serve us?TextWhy we ask: Shows where work is done and which rules apply.
How many years has the company been trading?NumberWhy we ask: Track record is a simple indicator of stability.
How many employees do you have?NumberWhy we ask: Indicates capacity and dependence on key people.
Please provide a current certificate of registration or trade licence.Document requestedWhy we ask: Evidence that the company is registered and active.
Has the company changed ownership in the last 3 years?Yes / NoWhy we ask: Recent ownership changes can change priorities and risk.
Who will be our main contact, and who is their backup?TextWhy we ask: Avoids depending on one person.

2. Financial stability (7)

Please share your last two years of financial statements.Document requestedWhy we ask: The basic evidence of financial health.
What was your annual revenue in the last financial year?NumberWhy we ask: Lets us see how large our spend is relative to your business.
What share of your revenue would our business represent?NumberWhy we ask: Very high dependence on one customer is a risk for both sides.
Are you subject to any insolvency, restructuring or major debt proceedings?Yes / NoWhy we ask: Direct signal of financial distress.
Have your audited accounts ever been qualified by the auditor?Yes / NoWhy we ask: A qualified opinion can signal accounting problems.
Are there any outstanding legal claims above 5% of your annual revenue?Yes / NoWhy we ask: Large claims can affect your ability to deliver.
Which bank(s) do you use for operations?TextWhy we ask: Supports payment set-up and verification.

3. Business continuity (5)

Do you have a written business continuity plan?Document requestedWhy we ask: Shows you have prepared for disruption.
When did you last test the plan, and what was the result?DateWhy we ask: An untested plan often fails when needed.
Which of your own suppliers could stop your service to us if they failed?TextWhy we ask: Reveals hidden dependencies further up the chain.
What is your recovery time and recovery point objective for systems we rely on?TextWhy we ask: Defines how much time and data could be lost in an outage.
How will you notify us of a disruption, and how quickly?TextWhy we ask: Early warning gives us time to respond.

4. Quality (5)

Which quality management certifications do you hold (for example ISO 9001)?Document requestedWhy we ask: Independent evidence of a quality system.
What was your on-time delivery rate for the last 12 months?NumberWhy we ask: Reliability of delivery matters as much as price.
How do you handle non-conforming products or services and corrective actions?TextWhy we ask: Shows how problems get fixed and prevented.
How do you measure and report service quality to clients?TextWhy we ask: Agreed measures make service levels enforceable.
Have you had any product recalls or major customer complaints in the last 3 years?Yes / NoWhy we ask: Past incidents indicate process weaknesses.

5. Cyber security and data protection (11)

Will you store, process or access any of our data or systems?Yes / NoWhy we ask: Determines whether the rest of this section applies.
Which security certifications or reports do you hold (for example ISO 27001, SOC 2)?Document requestedWhy we ask: Independent assurance of security controls.
Do you enforce multi-factor authentication for all staff with access to our data or systems?Yes / NoWhy we ask: MFA prevents most account takeovers.
Where (which countries) will our data be stored and processed?TextWhy we ask: Data location affects legal obligations and risk.
Is our data encrypted in transit and at rest?Yes / NoWhy we ask: Encryption limits damage if data is intercepted or stolen.
Have you had a security incident affecting customer data in the last 3 years?Yes / NoWhy we ask: Past breaches indicate risk and response maturity.
How quickly will you notify us of a security incident affecting our data?TextWhy we ask: Fast notification lets us meet our own obligations.
Which subcontractors or cloud providers will have access to our data?TextWhy we ask: Each additional party widens exposure.
How will our data be returned or deleted when the contract ends?TextWhy we ask: Prevents data being left behind after exit.
How often do you run independent penetration tests, and can you share a summary?Document requestedWhy we ask: Shows weaknesses are looked for and fixed.
Do staff receive security awareness training at least yearly?Yes / NoWhy we ask: People are the most common entry point for attacks.

6. AI use on your data (8)

Do you use AI tools or AI agents in the work you do for us?Yes / NoWhy we ask: Determines whether the rest of this section applies.
Will any of our data be entered into AI tools? If so, which tools?TextWhy we ask: Our data may leave your control once entered into an AI service.
Is our data used to train or improve any AI model, yours or a provider's?Yes / NoWhy we ask: Training use can expose our information to others.
Do you keep an inventory of the AI agents and tools your staff use?Yes / NoWhy we ask: You can't control AI use you don't know about.
Are consequential AI decisions or actions reviewed by a person before they take effect?Yes / NoWhy we ask: Human review limits the impact of AI errors.
Can you show which AI actions were taken on our data, and when?Yes / NoWhy we ask: An audit trail is needed to investigate problems.
Do you have a written AI use policy for staff?Document requestedWhy we ask: Shows AI use is governed, not ad hoc.
Do AI agents in your service hold credentials that can act in our systems?Yes / NoWhy we ask: Agents with credentials can take real actions and need strict limits.

7. ESG and responsible sourcing (7)

Do you have a supplier code of conduct or responsible sourcing policy?Document requestedWhy we ask: Sets expectations for your own supply chain.
Do you measure your greenhouse gas emissions (scope 1 and 2 at least)?Yes / NoWhy we ask: Needed if we report emissions across our supply chain.
How do you check for forced or child labour in your operations and supply chain?TextWhy we ask: A serious legal and reputational risk.
Do you hold any environmental certifications (for example ISO 14001)?Document requestedWhy we ask: Independent evidence of environmental management.
What share of your workforce and spend is local to the countries you serve us from?TextWhy we ask: Relevant where local-content goals apply.
Do you have targets to reduce emissions, energy use or waste? Please describe them.TextWhy we ask: Shows whether environmental performance is managed over time.
Do workers in your operations have written contracts, fair working hours and a way to raise grievances?Yes / NoWhy we ask: Basic labour standards that buyers are expected to check.

8. Compliance and ethics (7)

Do you have an anti-bribery and corruption policy, and do staff receive training on it?Document requestedWhy we ask: Bribery by a supplier can create liability for the buyer.
Do you screen your company, owners and partners against sanctions lists?Yes / NoWhy we ask: Dealing with sanctioned parties is prohibited in many jurisdictions.
Are you, your owners or directors subject to any sanctions or debarment?Yes / NoWhy we ask: A direct compliance blocker.
Do any of your owners or staff have a relationship with our employees that could be a conflict of interest?Yes / NoWhy we ask: Conflicts of interest undermine fair selection.
Do you have a whistleblowing channel for staff and third parties?Yes / NoWhy we ask: Lets problems be reported before they grow.
Have you been subject to regulatory fines or investigations in the last 5 years?Yes / NoWhy we ask: Indicates compliance risk.
Do you hold all licences and permits required for the work you'd do for us?Document requestedWhy we ask: Unlicensed work can be stopped or invalid.

9. Insurance (5)

Please provide certificates for your current insurance policies.Document requestedWhy we ask: Evidence that cover exists and is current.
What is your general / public liability cover limit?NumberWhy we ask: Covers damage or injury to third parties.
What is your professional indemnity cover limit?NumberWhy we ask: Covers losses from errors in professional advice or work.
Do you hold cyber insurance, and what is the limit?NumberWhy we ask: Helps cover the cost of a breach involving our data.
Will you name us as an additional insured where appropriate?Yes / NoWhy we ask: Lets us claim directly under your policy.

10. Sub-suppliers (6)

Will you subcontract any part of the work for us? If so, which parts?TextWhy we ask: Subcontracting moves work outside direct control.
Will you ask for our approval before adding or changing a subcontractor?Yes / NoWhy we ask: Keeps visibility of who actually does the work.
Do you apply the same requirements (quality, security, ethics) to your subcontractors?Yes / NoWhy we ask: Risks pass down the chain unless requirements do too.
How do you monitor the performance and risk of your key suppliers?TextWhy we ask: Shows whether upstream problems would be caught early.
Please list the subcontractors and key suppliers you would use for our work, with their countries.Document requestedWhy we ask: You can't manage risks in a chain you can't see.
Which subprocessors or cloud providers will store or process our data?TextWhy we ask: Each subprocessor is another place your data lives.

Track the answers, not just the questions

Once suppliers reply, Qeluntra keeps due-diligence evidence, remediation owners and deadlines in one place, linked to your contracts.

Track answers and evidence in Qeluntra, free How Qeluntra handles supplier risk

Free plan: no card, no expiration, one company workspace.

This questionnaire is a starting point, not legal or compliance advice. Adapt it to your contracts, your sector and the laws that apply to you. Question bank last reviewed 2026-09-25.