What questionnaires actually cost
A year of inbound security questionnaires at a company selling into regulated buyers.
Inbound questionnaires this year
Questionnaires received, total questions across them, and engineering and security days consumed
Questionnaires
148
received and completed
Questions
31,400
Person-days
96
security and engineering time
Why it matters
Thirty-one thousand questions, and the underlying facts number in the low hundreds. Almost all of that effort is restating things the organisation already knows, in a template it has not seen before.
Why copy-paste fails slowly
Teams do build answer libraries, and they work until a control changes. Then the library keeps confidently returning the old answer, nobody notices because it reads correctly, and the organisation is making a claim its own controls stopped supporting some months ago.