DDQ examples and templates by due diligence type

A due diligence questionnaire template takes the shape of whoever is asking it: procurement teams want operational resilience and financial stability, investors want fund governance and key person risk, security teams want data handling and incident response, and ESG teams want carbon numbers and labor policy. The questions look different across each type, but the underlying facts you're pulling from usually don't change much between them.

Vendor and third-party risk DDQs

This is the DDQ procurement and third-party risk teams send before onboarding a new supplier, and it mixes operational, financial and security questions because the buyer is really asking one thing: if this vendor fails, how exposed are we. Real questions look like 'Describe your business continuity and disaster recovery plan for a facility outage lasting more than 48 hours,' 'List all subcontractors who will have access to our data or systems,' or 'What is your annual revenue, and how much of it comes from us as a customer.'

A typical template runs through company overview, financial health, operational resilience, security and data handling, insurance and legal, and references, anywhere from 20 to over 100 questions depending on how critical the relationship is. Financial services buyers tend to push hardest on the financial stability section, since a supplier going under mid contract is their worst case scenario, not a data breach.

Investment and fund DDQs

Institutional investors, allocators and pension funds send these before committing capital to an asset manager, and they're built for comparison across dozens of managers at once. Expect questions like 'Describe the investment team's key person risk and succession plan,' 'Has the firm or any principal been subject to regulatory action in the last 10 years,' or 'Detail your valuation policy for illiquid assets.'

These questionnaires often follow standardized frameworks, ILPA style for private equity, AIMA style for hedge funds, and they run long: 200 to 300 questions is normal for a full fund DDQ. Because the format is so standardized, most of the answers are reused near verbatim from one investor's DDQ to the next, which is exactly the kind of repetitive drafting that eats a compliance team's week.

Security and IT due diligence questionnaires

This overlaps heavily with standard security questionnaires like SIG or CAIQ, but it's framed around a specific deal rather than generic vendor onboarding. Typical questions: 'Where is customer data physically stored, and does it ever leave that jurisdiction,' 'Walk us through the last confirmed security incident and how it was handled,' and, almost always, 'Do you hold SOC 2 Type II or ISO 27001 certification, and can you share the report.'

That last question deserves an honest answer, not a dodge. Plenty of well run vendors don't hold either certification yet. Airprose is one of them, and the right move when asked is to say so plainly and then point to what's actually true: data stored in the UK, per-tenant isolation, customer data never used to train shared models. Buyers respect a clear no far more than vague reassurance that falls apart under a follow-up question.

ESG and sustainability DDQs

Enterprise buyers and investors increasingly send these alongside or instead of a standard security questionnaire. Expect 'What percentage of your energy consumption comes from renewable sources,' 'Describe your supply chain labor practices audit process,' and 'What is your Scope 1 and Scope 2 carbon footprint for the last fiscal year.'

There's no single dominant standard here the way SIG dominates security. Some buyers write their own sustainability questionnaire, some lean on EcoVadis style scoring, some ask CDP-aligned questions. That inconsistency means your answer library has to hold both hard numbers and policy descriptions, and be flexible enough to answer either kind of question depending on who's asking.

Building one template that covers all of them

Most teams that answer DDQs regularly stop trying to build a template per questionnaire type and instead keep one master library organized by category: financial, security, operational, legal, ESG. The wording of the question changes every time it lands in your inbox, but the facts underneath it, your revenue, your insurance limits, your data storage location, your last incident, barely move between one quarter and the next.

Airprose doesn't publish a DDQ example library of its own, but this is exactly the problem it's built for: it drafts each answer from your approved content, shows the source document behind it, and flags anything it can't support with real evidence instead of guessing. For a 250 question fund DDQ or a security-heavy vendor DDQ landing the same week, that source trail matters more than which template you started from.