After reading, you can write questions that reveal what really happens, and turn the answers into a corrective plan.
Definition
Each question traces back to a requirement and calls for an answer that can be checked. It is often the opening move of a gap assessment, and asking the same questions a year later shows how far you have come.
Why it matters
It draws knowledge out of many departments quickly, in a form you can compare.
Bear its limit in mind, though: it records what people say. Where an answer really matters, ask to see the record behind it.
How it works
Choose the text and the scope. Turn each requirement into one question about practice, asking who does what and how often.
Fix the possible answers in advance. In place, partly in place, not in place and not applicable work well, as long as each “not applicable” comes with a reason.
Send each section to the person who knows it and ask for evidence on the answers that matter most. Each gap then becomes an action with an owner.
A worked case
A retailer drops “Do you manage access rights?” and asks instead: “Who reviews access to the order system, how often, and where is the last review recorded?”
The answer comes back: “IT, when someone leaves, no record.” That scores as partly in place and becomes one action, a quarterly review signed by the head of sales, first due on 30 June.
Good practices
- Ask about what is done. “Do you have a policy on…” tells you very little.
- Keep to one requirement per question, so that a partial answer stays readable.
- Keep the dated answers, because the comparison at the next round is where much of the value lies.
Common mistakes
- Writing questions that can only be answered yes. They produce a reassuring score and no information.
- Sending the whole questionnaire to one person, who then guesses at the parts they do not run.
- Accepting “not applicable” without a reason. It is the easiest way to make a gap disappear.
- Stopping at the score. A percentage without actions changes nothing.
Questions
- How is a compliance questionnaire different from a gap assessment?
- The questionnaire collects the answers. The gap assessment compares them with the requirement and says what is missing.
- How many questions should a compliance questionnaire have?
- As many as there are requirements in scope, and no more. A focused scope keeps it short enough to be answered well.
- Are yes or no answers enough?
- Usually not. A short scale with defined levels captures partial situations, and those are the most common.
- Who should answer the questionnaire?
- The people who run each process, with one person consolidating and challenging the answers.
- How often should it be repeated?
- When the text or the business changes, and otherwise on a rhythm that shows progress, often yearly.