Blog · Security questionnaires · Problem 3 of 93
Last year we answered “yes” to everything. Now the customer wants proof.
· 3 min read · By Case Jones
You signed the deal a year ago with a questionnaire full of confident yeses. Some were written by someone who has since left. Now the customer’s security team, or their auditor, is asking for screenshots, policies and records behind those answers.
What it costs to leave it
Each yes you cannot back up becomes a finding, a contract issue or a hard conversation at renewal. Quietly changing the answers is worse: the customer still has the old ones on file and will compare.
How to get from “yes” to proof without bluffing
Most of last year’s yeses are probably partly true. The work is sorting which ones, fixing the cheap gaps fast and being straight about the rest.
- 1
Find the questionnaire you actually sent
Get the exact version the customer has, not a later draft. Note who answered each section and when. You are matching evidence to those words, so you need those words.
- 2
Put every yes into one of three piles
True and recorded: you do it and can show it. True but unrecorded: you do it, but there is no ticket, log or sign-off. Not true: nobody does it. Be honest here; this list is only for you.
- 3
Collect evidence for the first pile now
Screenshots of settings, exports from your identity provider, policy documents with their dates, tickets. Write one line per item saying what it shows and which answer it supports, so the reviewer does not have to guess.
- 4
Start recording the second pile from today
If you remove leavers’ access but never wrote it down, write a short checklist and use it for the next leaver. A record that starts today is honest evidence. A record backdated to last year is not.
- 5
Correct the third pile yourself, before they find it
Tell the customer which answers have changed, what you do instead and when the gap will close. Corrections offered early are usually accepted. Corrections discovered by the customer damage every other answer you gave.
Example
A correction that keeps trust
Question 4.3, “Do you review user access quarterly?” We answered Yes last year. Correction: we remove access when people leave, using a checklist since March, but we did not run quarterly reviews in 2025. The first review is scheduled for January 15 and we will share the sign-off.
Or check last year’s answers in 93 Compliance
Upload the questionnaire you sent. Each question becomes a requirement, and a test marks it green, yellow or red against the policies you have. The yeses with nothing behind them show up as red before the customer finds them.
For the answers you do keep, procedures become checklists that collect their own evidence as people work: photos, files, answers and sign-offs, each run kept as a record that is not edited. Next year’s proof builds up by itself.
When it is time to show the evidence, invite the customer’s auditor read-only for a set period, or hand over one audit package. The check, procedures and audits are free.
- Last year’s answers checked against your policies
- Missing policies drafted in the policy builder
- Checklists that keep evidence from the first run
- Read-only auditor access that ends by itself
Check my old answers
The policies, the questionnaire check, procedures and audits are free. Training records are $10 per employee per year.
Start freeWritten by Case Jones, who built 93 Compliance. Former VP of Information Security who took doxy.me from zero to SOC 2 Type 2, through a SOC 2 Type 1 audit, two Type 2 audits and a positive HIPAA assessment. doxy.me is not affiliated with 93 Compliance and has not endorsed it.
Questions
Can we change answers on a questionnaire we already sent?
Yes, and it is better to do it yourself. Send a short note listing the changed answers and why. Most customers care more that answers are accurate now than that they were perfect then.
Is evidence created today acceptable?
Evidence of what you do today is fine, as long as it is dated honestly. Never create records that pretend to be from the past. Auditors look at dates, and one backdated record makes them doubt the rest.
What counts as evidence?
Anything that shows the control happened: a settings screenshot, a log export, a ticket, a signed checklist, a dated policy. Say in one line what each item proves.
Who should answer next time?
Someone who can check each answer against what the team actually does, with the answers saved in one place. Questionnaires answered from memory are how this problem starts.