Writing a due diligence questionnaire for a QA vendor

Most organisations already have a supplier due diligence questionnaire. It was usually written for suppliers of hosted software, facilities or outsourced operations, and it runs to many pages. Sent to a testing vendor unchanged, it produces long answers to questions that do not matter and no answers to the questions that do.

This post explains how to adapt the questionnaire for a QA vendor.

What due diligence is for

The 2023 US interagency guidance on third-party relationships says that due diligence assesses a third party's ability to perform the activity as expected, follow the buyer's policies, comply with the law and operate safely. It also says the scope and depth of due diligence should match the level of risk and complexity of the relationship.

That gives a simple test for each question: does the answer change your view of whether this vendor can do this work safely? If not, remove it.

Sections to keep, with testing-specific questions

Legal entity and ownership. Confirm the entity that will sign, its registration number, country and ultimate owner. Check the registration yourself in the national company register. A proposal that comes from a brand name, with a different entity on the invoice, is a question to resolve before shortlisting.

Financial standing. Ask for recent filed accounts. A testing vendor is people, so what matters is whether it can keep paying its team through the contract term.

Information security. Ask for the ISO 27001 certificate or SOC 2 report. Then check it:

• For ISO 27001, confirm the certificate number, certification body, scope and expiry. The IAF CertSearch database lets you look up certificates issued by accredited bodies.
• For SOC 2, confirm the report type and period. A Type II report covers how controls operated over a period; a Type I report covers design at a point in time.

Qualifications and key personnel. The interagency guidance lists the qualifications and backgrounds of key personnel as a due diligence factor, including background checks for people with access to systems or confidential information. For a testing vendor this is the centre of the questionnaire: who, by name, will do the work, what have they tested before, and how will they be replaced if they leave.

Subcontractors. Ask whether any part of the work goes to subcontractors or freelancers, which firms, and in which countries. The guidance lists reliance on subcontractors as a due diligence factor.

Insurance. Ask for professional indemnity and cyber cover, with certificates.

Sections to add

Generic questionnaires rarely ask about the things that make testing different:

• Access. Which repositories, pipelines and environments will the team need, and at what privilege?
• Test data. How does the vendor create test data? Will they ever ask for production data? How do they handle personal data found in logs or screenshots?
• Test assets. Where will test code and test cases live? Who owns them? Can you run them without the vendor?
• Tooling. Does the approach depend on a proprietary framework or platform you would need to licence?
• Evidence of work. Can the vendor share a redacted test strategy, a test report and a defect report from comparable work?

Sections you can usually shorten

Physical site security, business continuity for hosted services and detailed data centre controls matter less when the vendor does not host your systems. Keep a short confirmation rather than the full section, unless testers will work from a shared office on your data.

Ask for evidence, not assertions

A questionnaire answer is a claim. Pair each question with the evidence you expect: a certificate, a report, a CV, a sample document, a named reference. Decide which answers you will verify yourself, and do it.

The interagency guidance also covers the case where a third party will not share information. It says the buyer should identify and document the limits of its due diligence, understand the resulting risks and consider alternatives, such as extra controls or a different third party. Record refusals the same way.

Keep it proportionate

A two-person exploratory testing engagement on a public website does not need the same questionnaire as a team maintaining the regression suite for a payments service. Rate the risk first, then choose the sections.

What this means for your selection

The due diligence checklist generates a questionnaire tailored to testing work, with the evidence to request for each item. Use the questionnaire for the interview stage and the reference check tool for the calls. For verification detail, read how to verify ISO 27001 and SOC 2, the vendor security questionnaire guide, how to check references properly and professional indemnity insurance for IT suppliers.