Last month a founder forwarded me a security questionnaire a prospect had sent through. A UK SaaS company, a deal big enough to matter to the quarter. Two hundred and forty questions across access control, data handling, business continuity, sub-processors, incident response.
The problem was not that their security was weak. Their security was fine. The problem was that no single person could answer the questions, and no single place held the answers. One section came from the CTO's memory. One came from a policy document written eighteen months earlier. One came from a message to someone who had left in the spring. By the time it went back to the prospect, three people had attested to three slightly different versions of how the company worked.
That is not a security problem. That is a documentation problem, and it only became visible because someone outside the business finally asked.
A questionnaire only reads what you wrote down.
A security questionnaire feels like a test of your security. It is not. It is a test of your documentation - whether what you have written down still matches what you actually do.
The questionnaire cannot see your controls. It can only see your answers. If those answers come from an accurate, current record of how the business runs, the questionnaire is a read. If they come from memory, old files and whoever happens to be online that afternoon, it is a reconstruction - performed under deal pressure, by people half-guessing at their own company.
Whatever state your source of truth is in, the questionnaire reflects it back. A mirror does not flatter. It shows what is there.
A questionnaire is only ever as good as the record behind it. It cannot know more about your business than your business has bothered to write down.
How the truth comes unstuck.
Documentation does not go wrong on the day you write it. It goes wrong slowly, because the business keeps moving and the document stays still.
A control changes - you move from one identity provider to another - and the policy still names the old one. An owner leaves, and the detail that lived in their head leaves with them, uncaptured. A tool gets swapped, a process gets tightened, a new data flow opens up, and none of it reaches the page that claims to describe how things are done. Each change is small. Each one is reasonable. None of them feels like the moment the record stopped being true.
The deeper issue is rarely a single stale document. It is that there is no one source of truth to keep current in the first place. Security sits in one person's head, data handling in a spreadsheet, the policies in a folder nobody has opened since the last audit. Each team answers from its own copy, and the copies quietly disagree.
Nobody decides to let the documentation go out of date. It drifts, one small change at a time, while everyone is busy doing the actual work.
You are not filling in a form. You are signing it.
Here is what turns an administrative nuisance into a real risk.
A security questionnaire is an attestation. When you answer it, you are making written representations a customer will rely on, often as a condition of the contract. Yes, we encrypt data at rest. Yes, access is reviewed quarterly. Yes, we have a tested incident response plan. Each yes is a statement of fact, signed and sent on behalf of the business.
If the documentation behind those answers has drifted, the problem is no longer a slow or untidy response. You are attesting, in writing, to controls you may no longer run. The gap between what you said and what you actually do then sits in a customer's file until the one moment it matters - a breach, a renewal, a dispute, a buyer's diligence team reading last year's answers against this year's reality.
The cost of drift is not a failed questionnaire. It is a true answer you can no longer stand behind.
A business that is legible and defensible can answer honestly, because the honest answer is already written down and kept current. A business that cannot is one incident away from discovering the difference the hard way.
One record the business actually keeps.
The fix sits upstream of the questionnaire itself. It is not a smarter way to fill in the form. It is having one source of truth the business maintains whether or not anyone is asking to see it.
Not a document you dust off when a prospect sends a form through. A living record of how the company operates - the controls, the owners, the data flows, the policies - with three things attached to every entry: who owns it, when it was last reviewed, and whether it still reflects what the business does today. Reviewed on a cadence, not in a panic. Owned by a named person, not by everyone and therefore no one.
When that record exists, a questionnaire stops being an event. It becomes a read from a source you already trust. The answers come back consistent, because they come from one place. They come back honest, because the place is kept current. And they hold up afterwards, because the thing you attested to is the thing you actually do.
Fewer late nights assembling answers is not the point. The point is that what you tell a customer about your business is true on the day you tell them, and still true when someone checks. The fast, clean questionnaire is only what that looks like from the outside.
A single, owned, current source of truth is part of the governance and compliance foundations I build inside a founder-led business. If your last security questionnaire was assembled from memory and old files, that is a thirty minute conversation. No deck, no pitch, no pressure.
Twenty-five years inside founder-led, PE-backed and international scale-ups. Two businesses built, both successfully exited as a shareholder and director. HudsonRoux is the operations, governance and compliance practice he built to bring that operator discipline to the founders walking the same path.
Operations
The system that lets the business run without the founder in every room.
Finance
Built into how I think - not bolted on at the end. 25 years at COO and CFO level.
Governance
Statutory Directorships across two businesses, two M&A processes, UK and US entities.
Compliance
Audited posture across ISO, GDPR, HIPAA, NHS and other international frameworks.
The engine room - four disciplines, one operator.