Establishing high-quality vendor risk assessment takes a lot of effort, from people to tools to processes. Risk management teams should be proud when they provide effective assessments of their vendors..

One way you can maintain the quality of your vendor risk assessments is with Standardized Information Gathering (SIG) questionnaires. A SIG questionnaire is a comprehensive checklist to review and monitor various risk factors associated with your vendors. With a well-designed SIG questionnaire, you can ensure your team delivers high-quality assessments by adhering to your risk management standards and criteria.

In this article, we'll cover what you should include in a SIG questionnaire (and why!), along with a few more tactics for maintaining assessment quality as you scale.

What is a SIG questionnaire?

A SIG (Standardized Information Gathering) questionnaire is a comprehensive tool used to assess and manage risks associated with third-party vendors. It's a set of questions designed to gather critical information about a vendor's security controls, privacy measures, and overall risk management practices. The SIG questionnaire helps organizations make informed decisions when selecting and working with vendors, ensuring they meet the necessary security and compliance standards.

The SIG questionnaire covers a wide range of topics, including:

• Information security: Data encryption practices, access controls, and incident response plans
• Business continuity: Disaster recovery plans, backup procedures, and business impact assessments
• Financial stability: Financial reports, credit ratings, and insurance coverage
• Regulatory compliance: Industry-specific regulations, such as HIPAA, GDPR, or PCI-DSS

This helps maintain a high level of due diligence and reduces the risk of overlooking critical risk factors.

Why was the SIG questionnaire created?

The SIG questionnaire was created to address the growing need for a standardized approach to vendor risk management. As organizations increasingly rely on third-party vendors to support their operations, they also face new risks related to data security, privacy, and compliance. 

Also, a data breach or security incident at a vendor can have serious consequences for an organization, including:

• Financial losses: Recovery costs, legal fees, and lost revenue
• Reputational damage: Negative publicity, loss of customer trust, and damage to brand reputation
• Legal liabilities: Regulatory fines, lawsuits, and breach of contract claims

Before the SIG questionnaire, organizations often used their own custom questionnaires to assess vendor risks. 

However, this approach was time-consuming and inconsistent, making it difficult to compare risks across different vendors. The SIG questionnaire provides a common framework that organizations can use to evaluate vendors consistently and efficiently.

The SIG questionnaire was developed by a consortium of leading organizations, including the Santa Fe Group and the Shared Assessments Program. These organizations recognized the need for a standardized approach to vendor risk management and worked together to create a comprehensive questionnaire that could be used across industries.

What are the types of SIG questionnaires?

There are two main types of SIG questionnaires: the SIG Core and the SIG Lite.

SIG Core

A comprehensive questionnaire that covers all major risk areas in depth. It includes over 1,200 questions and can take several weeks to complete. The SIG Core is designed for vendors that handle highly sensitive data or provide critical services to an organization.

SIG Lite

A shorter version of the questionnaire that focuses on the most critical risk areas. It includes around 400 questions and can be completed in a few days. The SIG Lite is designed for vendors with lower risk profiles or for initial screening purposes.

Difference between SIG Core vs SIG Lite

The main difference between the SIG Core and the SIG Lite is the level of detail and the scope of the questions.

SIG Core:

• Comprehensive assessment covering all major risk areas in depth
• Includes detailed questions on information security, business continuity, privacy, and compliance
• Provides a complete picture of a vendor's risk profile
• Best suited for high-risk vendors

‍

SIG Lite:

• Streamlined assessment focusing on the most critical risk areas
• Includes a subset of questions from the SIG Core
• Suitable for vendors with lower risk profiles or initial screenings
• Can be completed more quickly than the SIG Core

How can the SIG questionnaire be used?

The SIG questionnaire can be used throughout the vendor risk management lifecycle, from initial vendor selection to ongoing monitoring.

Vendor selection:

The SIG questionnaire can be used to evaluate potential vendors during the procurement process. By requiring vendors to complete the questionnaire, organizations can quickly identify vendors that meet their security and compliance requirements.

Contracting: 

The SIG questionnaire can be used to inform contract negotiations with vendors. Organizations can use the questionnaire responses to identify areas where vendors may need to implement additional controls or agree to specific security requirements.

Ongoing monitoring: 

The SIG questionnaire can be used to periodically reassess vendors to ensure they continue to meet the organization's security and compliance standards. Organizations can require vendors to update their questionnaire responses annually or whenever significant changes occur.

How is the SIG questionnaire different from other vendor risk assessment questionnaires?

The SIG questionnaire is different from other vendor risk assessment questionnaires because it is a standardized tool that is widely accepted and used across various industries. It also comes in two versions (Core and Lite) to accommodate different levels of risk and assessment needs.

Below is the key ways SIG questionnaire differs from other vendor risk assessment questionnaires:

Standardization: 

The SIG questionnaire is a standardized assessment tool that has been adopted by many organizations across industries. This standardization allows for consistent evaluation of vendors and easier comparison of risk profiles.

Comprehensiveness: 

The SIG questionnaire covers a wide range of risk areas, including information security, business continuity, privacy, and compliance. This comprehensive approach helps organizations identify and mitigate risks across multiple domains.

Flexibility: 

The SIG questionnaire comes in two versions (Core and Lite) to accommodate different levels of risk and assessment needs. Organizations can choose the version that best fits their requirements and vendor relationships.

Industry acceptance: 

The SIG questionnaire has been widely accepted and adopted by organizations and vendors alike. This widespread use makes it easier for organizations to request and for vendors to complete the assessment.

Proactive approaches to completing SIG questionnaires

Completing a SIG questionnaire can be a time-consuming and resource-intensive process for vendors.

However, there are several proactive approaches vendors can take to streamline the process:

Maintain up-to-date documentation: 

Vendors should maintain comprehensive documentation of their security controls, policies, and procedures. Having this documentation readily available can make it easier to complete the SIG questionnaire and respond to customer inquiries.

Assign dedicated resources: 

Vendors should assign dedicated resources, such as a compliance officer or security specialist, to manage the completion of SIG questionnaires. These resources can help ensure that questionnaires are completed accurately and efficiently.

Conduct self-assessments: 

Vendors can conduct regular self-assessments using the SIG questionnaire to identify gaps in their security controls and processes. Proactively addressing these gaps helps vendors to be better prepared to complete the questionnaire when requested by customers.

Engage with customers: 

Vendors should engage with their customers to understand their specific security and compliance requirements. With open communication and collaboration, vendors can ensure that they are meeting customer needs and can more easily complete the SIG questionnaire.

Third Party Risk Assessment with Spendflo 

Spendflo helps organizations like you manage third-party risks effectively. Spendflo's risk assessment module help you manage risks, protect your organization from potential issues, and ensure compliance with regulations.With Spendflo, you can:

• Simplify vendor due diligence and onboarding
• Monitor vendors regularly and receive risk alerts
• Tailor risk assessment frameworks to your industry's needs
• Centralize vendor risk management for better oversight
• Integrate with your existing procurement and contract management systems 

To learn more about how Spendflo can improve your third-party risk assessment and management, contact our team today.

Frequently Asked Questions About SIG Questionnaire

1. How often is the SIG questionnaire updated?

The SIG questionnaire is typically updated annually to reflect changes in industry standards, regulations, and best practices. The Shared Assessments Program, which maintains the SIG questionnaire, releases new versions of the questionnaire in the fourth quarter of each year.

2. Who created the SIG questionnaire?

The SIG questionnaire was created by the Shared Assessments Program, a member-driven organization that develops standardized tools and best practices for third-party risk management. The Shared Assessments Program is managed by The Santa Fe Group, a strategic advisory firm specializing in cybersecurity, privacy, and risk management.

The development of the SIG questionnaire involved collaboration among Shared Assessments Program members, which include leading organizations from various industries, such as financial services, healthcare, and technology. These organizations contributed their expertise and insights to create a comprehensive and standardized assessment tool that could be used across sectors.

3. Can vendors prepare for a SIG questionnaire assessment? 

Yes, vendors can prepare for a SIG questionnaire assessment by familiarizing themselves with the questionnaire, conducting self-assessments, gathering relevant documentation, and engaging with customers to understand their specific requirements. Taking these proactive steps can help vendors streamline the assessment process and demonstrate their commitment to security and risk management.

4. How many questions are in a SIG?

The number of questions in a SIG (Standardized Information Gathering questionnaire) can vary depending on the specific version and customization. Typically, a full SIG questionnaire contains around 700-850 questions covering various aspects of information security, privacy, and risk management.

‍

‍