Best Practices· 3 min read· By The SpideyChat Team

Security Questionnaires And The Three Week Delay

The deal is agreed and then a spreadsheet arrives with two hundred questions for three departments. A teardown.


A deal is agreed in principle. Everybody is happy and a start date is discussed.

Then procurement sends a spreadsheet with two hundred questions covering security, data handling, business continuity, insurance and subcontracting. It needs input from engineering, legal and operations, none of whom have time this week.

Three weeks pass. The start date moves, the champion loses momentum, and a deal that was effectively closed becomes a deal that is still open, which is a meaningfully different thing.

The first failure: the questionnaire arrives after agreement

By which point the timeline is already promised, so every day of delay is a day of visible slippage rather than invisible preparation.

The second failure: nobody owns answering it

It is passed between three departments, each of whom treat it as somebody else's priority, which is how three days becomes three weeks.

The third failure: the answers are written from scratch

Despite the same questions having been answered several times before, because nobody kept the previous responses anywhere findable.

The fourth failure: no answer bank exists

A maintained set of answers to the standard questions would cover the majority of any new questionnaire and is rarely assembled.

The fifth failure: the documentation is not published

Certifications, architecture, subprocessors and policies, which a buyer could read themselves, sit behind a request, as described in enterprise procurement questions on a b2b website.

The sixth failure: the gaps are discovered late

Where something genuinely is not in place, finding out during a live deal is the worst possible moment to address it.

The seventh failure: the honest answer is avoided

Hedged responses to questions where the answer is no create a worse impression than a plain no with an explanation and a timeline.

The eighth failure: the buyer cannot self serve

An evaluator gathering information for their own internal review is forced into a meeting, which is the friction in b2b buyers who research for weeks before contact.

The ninth failure: the process is not anticipated in the timeline

Salespeople promise start dates without allowing for a review that happens on almost every deal above a certain size.

The tenth failure: the smaller buyers ask too

Not only enterprises. Mid sized businesses increasingly run the same reviews and vendors are consistently unprepared for it.

The eleventh failure: nothing is reused afterwards

The completed questionnaire is emailed and forgotten rather than becoming the answer bank for the next one.

The twelfth failure: the delay is never measured

Nobody reports the average time from commercial agreement to signature, so the longest delay in the pipeline remains unexamined.

The thirteenth failure: the questionnaire is treated as an obstacle

It is a buyer doing their job properly, and a vendor who answers it quickly and plainly looks like a company that has done this before. Treating it as an imposition is visible in the responses and it costs credibility at the last moment.

The fix: answer the review before it starts

An assistant that supplies the security documentation, answers the standard questions accurately from a maintained bank, states the gaps honestly and routes anything genuinely novel to the right person moves three weeks off a deal that was already agreed. Use the structured intake at forms, the buyer side in ai chatbot security questions to ask a vendor, and the review detail in security review and questionnaire questions. Start at try, see features, and the sector view sits under b2b.

Frequently asked questions

Why do security questionnaires delay deals so much?
Because they arrive after commercial agreement, require input from several people who have other work, and are answered from scratch every time as though nobody had ever asked before.
Are the questions actually different each time?
Largely no. Most questionnaires cover the same ground in different wording, which means a maintained answer bank covers the large majority of any new one.
What should a vendor publish?
A security page, the certification position, the subprocessor list, the architecture summary and a completed standard questionnaire, downloadable without a sales conversation.

Want a 24/7 AI Employee for Your Website?

See how SpideyChat can answer customer questions, capture leads and handle enquiries while your team is offline.

No obligation. We will review your website and show you how SpideyChat could work for your business.

Keep reading