Due diligence questionnaire guide: 10 DDQ examples

If you've ever spent hours tracking down the same compliance answers across five different spreadsheets, you already know DDQs are a necessary pain. Buyers send them to verify you're who you say you are, and your job is to prove it without burning a week every time. We're walking through the 10 DDQ examples that cover most of what you'll face, the questions that repeat across all of them, and what actually speeds up the process when you're stuck answering the same things over and over.

TL;DR:

• DDQs verify risk and compliance before contracts, while RFPs compare vendor capabilities
• Standard 100-question DDQs take 4-5 hours per response without automation
• 87% of private equity funds now use the ILPA DDQ framework as baseline
• Common questions focus on SOC 2, encryption, incident response, and third-party access
• Wolfia (used by Amplitude, Miro, and ThoughtSpot) auto-fills DDQs, RFPs, and customer security questionnaires across Excel, PDF, Word, and portals so teams review instead of writing

A standard 100-question DDQ takes 4-5 hours for a first draft before any internal reviews, and ILPA or M&A DDQs that run 200+ questions take longer. Companies receiving 200+ DDQs per year spend roughly 1,000 hours annually at 5 hours per response, which is why many teams turn to AI automation that can cut response time by 90%+ by auto-filling answers from existing documentation.

DDQ stands for Due Diligence Questionnaire. In business, finance, and legal contexts, it is a structured set of questions one organization sends to another to assess risk before a deal, investment, or vendor relationship moves forward. Buyers send DDQs to vendors to vet security practices. Investors send them to fund managers before committing capital. Acquirers send them during M&A transactions to audit financials, legal exposure, and operations.

What separates a DDQ from other procurement documents is intent. Where a request for proposal asks what a vendor can do, a DDQ asks what they are. It's an investigation, not an invitation. The goal is verifying that a potential partner meets your organization's standards before any agreement is signed.

The acronym does double duty. In chemistry, DDQ refers to 2,3-Dichloro-5,6-dicyano-1,4-benzoquinone, a reagent used in oxidation reactions. So if you landed here from a chemistry textbook, you're in the right place too; we cover both meanings below.

For most people searching this term, the business definition is what matters. That's where we'll spend most of our time.

RFPs and DDQs often get lumped together, but they serve different purposes at different stages.

An RFP comes early. It's how buyers gather proposals from multiple vendors, comparing capabilities, pricing, and fit. Security questionnaires often follow later in the process. The questions are forward-looking: what can you build, what will it cost, how will you deliver it?

A DDQ comes later, often after a vendor has already been shortlisted. The questions shift from "what can you do" to "prove who you are." Security posture, compliance certifications, financial stability, how you run the business. The buyer isn't shopping anymore. They're stress-testing.

In practice, some organizations send both. An RFP winnows the field; the DDQ closes the loop before a contract is signed.

DDQs flow in one direction: from the party assessing risk to the party being assessed.

On the sending side, you'll typically find institutional investors running fund manager assessments, enterprise procurement teams vetting new vendors, and legal or compliance teams reviewing acquisition targets. Finance and healthcare companies tend to send the most detailed ones.

On the receiving side are vendors, SaaS companies, fund managers, and anyone else being asked to prove they're trustworthy before a deal closes. If your security team spends time filling out spreadsheets from prospects, you're on the receiving end.

Your position in this exchange shapes everything, including how much time DDQs cost your team.

DDQs show up at predictable inflection points, moments when one organization is about to place real trust in another. Four scenarios drive most of the volume.

• Vendor onboarding: Before signing a new supplier or SaaS vendor, procurement and security teams issue DDQs to confirm the vendor can handle the data and access they're being granted.
• Investment screening: Institutional investors send DDQs to fund managers before committing capital. Hedge funds and private equity firms face these regularly.
• M&A transactions: Acquirers need to understand what they're buying. DDQs surface legal liabilities, business gaps, and compliance exposures before a deal closes.
• Third-party risk management: Ongoing vendor relationships often require periodic re-assessments beyond initial vetting.

The vendor onboarding context gets the most attention right now, and for good reason: third-party risk keeps rising, which is why security-specific DDQs have grown longer and more detailed year over year. Buyers aren't being difficult. They're responding to real exposure.

If your team receives DDQs regularly, it almost always means your prospects are enterprise buyers with formal procurement requirements. That's a good sign for deal size. The friction, though, is real.

Most DDQs follow a recognizable structure, even if the questions vary by industry. Whether you're sending one or filling one out, knowing what's inside helps you move faster.

The core sections you'll find in nearly every DDQ:

• Company overview: basic corporate info, ownership structure, key personnel, and business history
• Financial information: audited statements, revenue trends, debt obligations, and funding sources
• Compliance and regulatory: certifications held (SOC 2, ISO 27001, GDPR adherence), audit history, and any regulatory violations
• Information security: data handling practices, access controls, incident response plans, and third-party risk management
• Day-to-day processes: business continuity plans, vendor dependencies, SLA track records
• ESG considerations: environmental policies, diversity practices, and governance standards

Longer or more specialized DDQs add sections on legal disputes, insurance coverage, or AI usage policies. The depth of each section typically scales with how much risk the relationship carries.

DDQ structure varies widely depending on the context in which it's being used. Here are the four most common types you'll encounter.

These are the most common type in B2B software. Enterprises send them to vet a vendor's security posture before signing. Expect questions on SOC 2, penetration testing, data residency, and incident response.

Investors use DDQs to vet fund managers before committing capital. The ILPA DDQ is the industry standard here. Questions focus on performance history, fee structures, portfolio risk, and governance.

Acquirers send these during transactions to surface legal liabilities, financial exposure, and IP ownership questions. Higher stakes mean longer questionnaires.

Industries like healthcare and finance that face strict compliance requirements send standalone cybersecurity DDQs. These go deep on controls, vulnerability management, and third-party risk, often mapped to frameworks like NIST or ISO 27001.

The Institutional Limited Partners Association (ILPA) DDQ is the closest thing private equity has to a universal standard. Created to reduce the chaos of every LP sending a different questionnaire to every GP, it gives both sides a shared language for due diligence.

The numbers tell the story of how seriously it's been adopted. 87% of private equity funds now receive DDQs that follow the ILPA framework, and the questionnaire itself has grown from 8 sections to 21 as the asset class has matured.

Those 21 sections cover a wide range of GP information:

• Fund strategy and investment philosophy
• Team background, key person risk, and succession planning
• Historical performance data and attribution
• Fee structures, carried interest, and co-investment terms
• Risk management and portfolio monitoring processes
• ESG policies and responsible investing commitments
• Legal disclosures and regulatory filings
• Infrastructure and cybersecurity controls

The weight placed on any given section changes depending on the LP. A pension fund may care most about ESG disclosures. A family office may focus almost entirely on fees and governance. The framework sets the structure; the LP decides where to dig.

For GPs, responding to the ILPA DDQ thoroughly is table stakes. Gaps or vague answers raise flags faster than almost anything else in the fundraising process.

Here's a quick breakdown of ten DDQ types you're likely to encounter, what drives them, and where each one focuses.

Templates for these exist across ILPA, NIST, and various industry bodies. Most SaaS vendors get hit hardest by types 3 and 5, often receiving both in the same sales cycle.

Across every industry and transaction type, certain questions show up almost everywhere. Knowing them in advance lets you prepare answers before the questionnaire even arrives.

• Do you have a SOC 2 Type II report, and is it current?
• How do you handle data encryption in transit and at rest?
• What is your incident response process if a breach occurs?
• Do you conduct regular penetration testing? How often?
• What is your business continuity and disaster recovery plan?
• Who has access to customer data, and how is that access controlled?
• Are you compliant with GDPR, HIPAA, or other applicable regulations?
• What third-party vendors do you share data with?
• Have you experienced any security incidents in the past 24 months?
• What certifications does your organization currently hold?

Security and compliance questions dominate, but financial and process questions follow close behind. Expect questions about audit history, revenue stability, key person dependencies, and vendor concentration risk. The more sensitive the data or capital involved, the deeper those questions get.

A standard 100-question DDQ takes an average of 4 to 5 hours just for a first draft. That's before revisions, SME reviews, or legal sign-off.

Three factors push that number higher:

• Questionnaire complexity: ILPA or M&A DDQs routinely run 200+ questions with multi-part answers required, each demanding sourced, verifiable detail instead of a quick summary
• Internal coordination: security, legal, finance, and operations teams often all need to weigh in, and scheduling that review adds days even when the answers themselves are ready
• Documentation gaps: if your SOC 2 report is outdated or your policies aren't written down, answering takes research first

First-time responses are always slower. Teams without a central knowledge base waste hours hunting down answers that should already exist. Our due diligence questionnaire hub walks through the sections, the evidence each one expects, and the order to answer them in.

These three documents get conflated constantly, but they serve different purposes.

An RFP (Request for Proposal) is a sourcing document. A buyer describes a project or need and asks vendors to propose how they'd solve it. It's forward-looking and competitive.

A security questionnaire zeros in on cybersecurity controls: encryption, access management, incident response, certifications. Scope is narrow by design.

A DDQ is broader. It pulls together financial health, legal history, how the business runs, and compliance posture into one assessment. Security may be one section, but it's not the whole document.

If a prospect sends you 150 questions covering your SOC 2 status, subprocessors, and data retention policy, that's a security questionnaire. If it also asks about your financials and litigation history, that's a DDQ.

Knowing the category isn't enough. You need to know what the actual questions look like so your responses land at the right level of detail.

• Do you encrypt data at rest and in transit? If so, what encryption standards do you follow?
• How do you manage access controls and privileged user accounts?
• What is your incident response process, and how quickly do you notify affected customers?
• Have you experienced any data breaches in the last 24 months?

• Can you provide audited financial statements for the last two fiscal years?
• What is your current debt structure and any outstanding liabilities?
• How do you recognize revenue, and is that consistent with GAAP?

• Do you have a documented business continuity plan? When was it last tested?
• What is your recovery time objective (RTO) in the event of a system outage?
• How do you manage key-person dependencies across leadership roles?

The depth of answer expected varies by context. A PE investor asking about revenue recognition wants documentation, not a paragraph. Compliance platforms often include DDQ features alongside their audit preparation capabilities. A procurement team asking about incident response wants a named process and a timeframe, not a vague "we take security seriously."

A standard 100-question DDQ takes an average of 4 to 5 hours for a first draft, before reviews even begin. Security questionnaire automation cuts that time meaningfully. Multiply that across dozens of requests per quarter and the math gets painful fast.

A few practices cut that time down meaningfully:

• Build a centralized answer library with pre-approved responses to common questions, organized by category so the right person can find the right answer without digging through old email threads.
• Keep security documentation current so you're not hunting for last year's SOC 2 report mid-response.
• Assign a single owner per DDQ to avoid version confusion and conflicting edits.
• Create a review workflow with clear handoffs between security, legal, and sales so nothing stalls waiting on the wrong inbox.

The biggest time sink isn't answering hard questions. It's re-answering the same questions you've already answered ten times before, just in different formats.

Most DDQ delays don't come from hard questions. They come from avoidable mistakes that trigger follow-up rounds.

• Stale answers: Pulling responses from a submission you sent 18 months ago, before your SOC 2 audit or infrastructure migration, creates factual mismatches that reviewers will catch.
• Inconsistent responses: Sending conflicting answers to the same organization across two separate submissions destroys credibility fast.
• Missing evidence: Claiming a control exists without attaching the policy, cert, or audit report invites follow-up requests every time.
• No ownership: When three people contribute answers with no single reviewer, contradictions slip through.
• Outdated knowledge bases: If your stored answers don't reflect your current security posture, every DDQ you send carries hidden risk.

Each mistake adds a review cycle. One follow-up round can add weeks to a procurement process that was already slow.

In chemistry labs, DDQ refers to 2,3-Dichloro-5,6-dicyano-1,4-benzoquinone, a synthetic organic compound with the molecular formula C6Cl2(CN)2O2. Chemists use it as a selective oxidizing agent in organic synthesis reactions.

DDQ works as a dehydrogenation reagent, removing hydrogen atoms from molecules to create double bonds or aromatic rings. The compound excels at benzylic oxidation, where it converts benzylic alcohols or methylene groups into carbonyl compounds. It also drives aromatization reactions that convert saturated ring systems into aromatic structures.

Pharmaceutical and steroid synthesis depend on DDQ for selective oxidation steps. The reagent offers control that lets chemists modify complex molecules without damaging other functional groups.

DDQ's molecular weight sits at 227.0 g/mol. Solubility varies by solvent, with better dissolution in organic solvents like dichloromethane or chloroform than in water.

Three forces are driving the surge in DDQ volume and complexity.

Regulatory pressure keeps expanding. GDPR, HIPAA, SEC cybersecurity rules, and DORA in Europe all push enterprises to document vendor risk more formally. When your buyer faces a regulator, your DDQ answers become their paper trail.

Supply chain anxiety is real. An estimated 60% of security incidents originate from third-party vendors. Enterprises have learned this the hard way, so third-party risk programs now require deeper questionnaires before any contract is signed.

Enterprise security requirements have also scaled. What once fit in 50 questions now runs 150, with sub-questions on AI usage, data residency, and subprocessor lists that didn't exist five years ago.

The math here is simple. A 100-question DDQ takes 4 to 5 hours from scratch. Field 200+ per year and that's a part-time job that never ends.

AI changes the equation. Instead of rebuilding answers for every new DDQ, AI pulls from your existing documentation and auto-fills responses across Excel, PDF, Word, and web portals. Every answer cites its source, so reviewers can verify without guessing. Teams review pre-filled answers instead of writing them cold.

The result is less time per DDQ and fewer mistakes from copying stale answers across documents.

DDQ automation software completes due diligence questionnaires by matching incoming questions against a knowledge base of your organization's policies, prior answers, certifications, and evidence, then drafting responses a reviewer approves. The better tools ground each answer in a specific source document, attach a citation, fill answers back into the portal or spreadsheet the DDQ arrived in, and flag low-confidence answers for a human. The job it removes is repetitive: answering the same due diligence questions about ownership, financials, security, privacy, and operations across every new deal, fund, or vendor relationship. If you need a refresher on the document itself rather than the software, the sections above cover what a DDQ is, who sends it, and how to structure a response.

Feature lists in this category look interchangeable. The distinction that matters is how the knowledge base is maintained, because that determines whether the tool saves you time in month six or quietly hands the work back.

Manual answer library tools store approved Q&A pairs. A person, or the AI, searches the library and reuses a stored answer. This works well at low volume and goes stale predictably: when a policy changes, a certification renews, or a control is added, someone has to remember to update the library. The maintenance grows with the library, and the window between updates is where wrong answers slip out.

Self-maintaining knowledge base tools connect to your live sources (Confluence, Google Drive, SharePoint, your policy tool) and stay current as those sources update. Answers are grounded in current content, and there is no separate library to groom. The difference is most visible on volume: manual libraries scale in maintenance cost, self-maintaining ones do not. Our guide to building a questionnaire knowledge base that maintains itself goes deeper on why this is the load-bearing decision.

• Evidence grounding with a citation on every answer. Each answer should trace to a source document a reviewer can open and verify. Without citations, review collapses back into hunting through your own documents by hand.
• A self-maintaining knowledge base. The system should stay current from your live sources rather than requiring manual tagging and cleanup cycles.
• Portal and spreadsheet fill-back. DDQs arrive as Excel, Word, PDF, and web portals. The tool should write answers back into the format the DDQ came in, not just draft them in its own interface.
• A review workflow. All proposed answers in one view, low-confidence answers flagged, edits tracked, and collaboration across the team, because due diligence answers can become contractual claims.
• Pricing that does not cap volume. Per-response caps and credit systems penalize exactly the high-volume teams with the most to gain from automation.

Wolfia is built around a self-maintaining knowledge base that grounds every answer and attaches a citation, with fill-back across dozens of vendor portals and spreadsheet formats, a consolidated review view, more than ten hallucination guardrails, and flat all-inclusive pricing with no volume caps. It answers DDQs, security questionnaires, and RFPs from the same content, so there is no per-format library to maintain.

Loopio and Responsive (formerly RFPIO, founded in 2015) are established response-management platforms built around a content library that a team tags and maintains. Both have added portal support: Loopio ships a Chrome and Edge extension with SmartScan and SmartFill that imports portal questions and fills answers back. The recurring theme in reviews of library-based tools is that upkeep grows into a significant maintenance burden over time, which is the cost the self-maintaining approach is designed to remove.

Conveyor is a questionnaire automation tool with an AI layer over a document library and credit-based pricing, where questionnaire volume draws from a credit balance. It fits teams whose main constraint is drafting speed and who can manage credit allocations.

For the broader field including RFP-specific tooling, our best RFP software reviews and comparisons covers more of these platforms side by side.

The payback from DDQ automation is not the raw speed of drafting an answer. It is eliminating the review loop that untrustworthy output creates. A tool that drafts an answer you cannot trace forces you to re-verify every answer by hand, which adds a step without removing one. A tool that grounds each answer, cites it, and flags the uncertain ones lets a reviewer approve the confident answers in seconds and spend real attention only on the flagged minority. That is the difference between a tool that reorganizes where the time goes and one that actually removes it. How grounding and accuracy translate into deal timelines is traced in how AI accuracy affects security questionnaire deal velocity.

Managing DDQs and RFPs shouldn't require a dedicated team member, but for many companies it already does. The math is simple: 200 questionnaires at 5 hours each is 1,000 hours of work your team could spend elsewhere. Schedule a quick walkthrough if you want to see how other teams cut that time by 90%+ without sacrificing accuracy. Your DDQ volume will keep climbing, your response time doesn't have to.

A standard 100-question DDQ takes 4-5 hours for a first draft, before any internal reviews. That number climbs higher for ILPA or M&A DDQs that run 200+ questions, especially if your team is hunting down missing documentation or coordinating answers across security, legal, and finance.

An RFP comes early in vendor selection to compare capabilities and pricing across multiple vendors. A DDQ comes later, after you've shortlisted a partner, to verify their security posture, compliance certifications, and how they run the business before signing a contract.

No. DDQ structure varies by industry and risk profile. A SaaS vendor security DDQ focuses on SOC 2 and encryption controls, while a private equity ILPA DDQ digs into performance history and fee structures. Your DDQ should match the type of relationship and data exposure involved.

Expect questions about SOC 2 reports, data encryption methods, incident response processes, penetration testing frequency, business continuity plans, access controls, regulatory compliance (GDPR, HIPAA), third-party vendors, past security incidents, and current certifications. Having these answers documented saves hours per response.

Three factors drive the increase: expanding regulations like GDPR and SEC cybersecurity rules require formal vendor risk documentation, enterprises face real supply chain risk (60% of security incidents originate from third parties), and security questionnaires themselves have grown from 50 to 150+ questions as requirements around AI usage and data residency became standard.

Yes, but most AI tools only suggest answers that you copy-paste. Wolfia's Portal Agent actually fills OneTrust, ServiceNow, Zip, Ariba, Coupa, and other web-based platforms end-to-end without manual data entry.

If you're a B2B SaaS company selling to enterprise buyers, you'll see DDQs during vendor onboarding processes. They typically show up before contract signing, especially from prospects with formal procurement and security requirements.

In our experience, finance and healthcare tend to send the longest, most detailed DDQs. Investment managers need fund performance data and risk controls, while healthcare organizations require extensive HIPAA compliance documentation and patient data handling procedures.

Update it immediately after any material change: a new SOC 2 audit, infrastructure migration, policy revision, or security incident. Stale answers that don't reflect your current posture create mismatches that reviewers will catch and question.

Because they serve different purposes at different stages. RFPs ask what you can do and what it costs. DDQs verify you're safe to work with by checking risk, compliance, and business controls. Buyers need both, even if the overlap feels redundant.

Six main categories: company background (ownership, structure), financial information (revenue, insurance), compliance (certifications, regulations), information security (encryption, access controls), operational continuity (disaster recovery, backups), and ESG policies (environmental impact, labor practices).