What is a DDQ, and how do you complete one?

A due diligence questionnaire, usually shortened to DDQ, is a structured set of questions one organisation sends to another to check how it operates before entering into a relationship. The questions cover things like security, finances, legal standing, data handling and ethics, and the answers help the sender decide whether the risk of working with you is acceptable. If you have been asked to complete one for the first time it can look daunting, because a single DDQ might run to dozens or hundreds of questions across several topics. This guide explains what a DDQ is, who sends them, the common types you will meet, and a clear process for completing one without losing your week to it.

Who sends a DDQ, and when

DDQs come from anyone who needs confidence in an organisation before they commit to it. The most common sender is a prospective or existing customer running a third-party or vendor risk check. Before they buy your software or hand over data, their procurement, security or risk team wants to understand how you protect information, meet legal obligations and stay financially stable. You will usually receive a DDQ during a sales process, at contract renewal, or when a customer reviews its suppliers on a regular cycle.

Investors send them too. When a fund raises money, its limited partners, meaning the institutions and individuals who invest in it, issue DDQs to understand how the fund is run before committing capital. Acquirers use them to inspect a company they are thinking of buying, and business partners use them before signing a joint venture or reseller agreement. In every case the timing is the same. The questionnaire arrives at the point where someone is about to take on risk and wants evidence before they do.

The main types of DDQ

Although every DDQ is a set of questions, they tend to fall into a few recognisable types. A third-party or vendor risk DDQ is the broadest, covering security, data protection, business continuity, legal and financial health, and it is what most suppliers see most often. A security due diligence questionnaire is narrower and goes deep on how you protect systems and data. It often arrives in a standard format such as the SIG, CAIQ or VSAQ, which are industry templates designed so that answers can be compared across vendors.

A fund or investor DDQ focuses on how an investment fund operates, including its strategy, governance, controls and track record, and it is aimed at people deciding whether to invest. An ESG or sustainability DDQ asks about environmental impact, social practices and governance, and these are becoming more common as organisations report on the conduct of their supply chain. Knowing which type you have received helps, because it tells you who needs to be involved and what evidence you are likely to be asked for.

How to complete a DDQ, step by step

Start by reading the whole questionnaire before you answer anything. Note the deadline, the format required, and any questions that do not apply to you, then triage the rest into groups by topic, such as security, legal, data protection and finance. This first pass stops you writing detailed answers to questions that turn out to be duplicates or irrelevant, and it shows you how large the task really is.

Next, assign an owner to each group, because no single person usually holds every answer. Security questions might go to your IT or security lead, legal questions to whoever manages contracts, and financial questions to finance. Ask each owner to gather the supporting evidence first, such as policies, certificates, diagrams or reports, then draft answers that are specific and match that evidence. Vague answers tend to trigger follow-up questions, so it is worth being precise the first time.

Reviewing, verifying and submitting

Before anything goes back to the sender, have someone review the whole set of answers together, not just each section in isolation. Check that answers are consistent, that nothing contradicts another response, and above all that every claim is accurate and can be backed by the evidence you hold. Overstating what you do is the most damaging mistake in a DDQ, because it can surface later in an audit or a contract dispute, so it is better to describe honestly what is and is not in place.

When the answers are verified, submit them in the format the sender asked for and keep a complete copy of what you sent, along with the evidence and the date. Logging your submission matters for two reasons. It gives you a record if the sender queries an answer, and it gives you a head start on the next DDQ, because much of what you have just written will be asked again.

How to make recurring DDQs faster

Most organisations answer the same questions again and again, so the biggest time saving comes from not starting from scratch each time. Build an approved answer library, meaning a maintained set of questions and correct answers that your subject matter experts have signed off, with each answer linked to the source document it came from. When a new DDQ arrives you reuse the approved answers where questions match, and only write fresh responses for the genuinely new ones.

Keeping that library current is the part people forget. Policies change, certificates expire and systems get replaced, so set a regular review to keep your reused answers and evidence accurate. This turns each DDQ from a blank page into a shorter exercise of matching, checking and updating.

This is where a tool can help. Airprose drafts DDQ answers from your own approved content, and every answer it produces is traceable to the source document it came from, so a reviewer can verify it in seconds rather than trusting an unsourced response. Your content stays within your own tenant, is stored in the UK, and is never used to train shared models, and you can start for free without a card to see whether it fits how your team works.