Free template · Excel + Markdown · For buyers
DDQ template (due diligence questionnaire)
A due diligence questionnaire (DDQ) is a structured set of questions one organization sends another before signing, investing or renewing, to understand its ownership, finances, legal exposure, compliance, security, resilience and practices. This template is a general vendor due diligence DDQ: 32 original questions across 12 sections, plus a document request list, laid out so the responding company can assign each row to an owner and track status.
Updated Oct 2026
Download the DDQ template
32 vendor due diligence questions across 12 sections, with owners, status and a document list.
Direct download, no form. Works in Word, Google Docs and LibreOffice Writer. The Markdown copy is plain text for wikis, Notion or an AI assistant.
What it is and when to use it
Use it to vet a supplier or partner, or as a responder to rehearse the questions that arrive in most DDQs. Investment due diligence is a different job: limited partners assessing private-fund managers commonly use the ILPA Due Diligence Questionnaire, which ILPA publishes free of charge, and that should be your starting point for fund diligence.
Use it when
- You are onboarding a supplier or partner and need more than a security review: ownership, finances, compliance and resilience too.
- You answer DDQs regularly and want a master list of likely questions to pre-approve answers against.
Skip it when
- Fund or investment manager diligence: start from the ILPA DDQ or the questionnaire your allocators use.
- A security-only review: use the vendor security questionnaire template, which goes deeper on controls.
What is inside the template
The workbook opens on an Instructions sheet, followed by 2 working sheets: DDQ, Documents. Shaded cells are inputs; cells marked Auto below are formulas.
Sheet: DDQ
Responder: answer every row, attach or link supporting documents, and set status to Approved once a named owner has signed off.
| ID | Section | Question | Response | Supporting document | Owner | Status |
|---|---|---|---|---|---|---|
| DD-01 | Company and ownership | State the full legal name, registration number and country of incorporation of the contracting entity. | Certificate of incorporation | Open | ||
| DD-02 | Company and ownership | Who are the ultimate beneficial owners holding 25% or more of the company? | Ownership chart | Open | ||
| DD-03 | Company and ownership | List the parent company and any affiliates that would deliver part of the service. | Open | |||
| DD-04 | Company and ownership | Has the company undergone a change of control in the last three years, or is one expected? | Open |
Preview shows 4 of 32 pre-filled rows.
Sheet: Documents
Share confidential documents under NDA or via a data room.
| Document | Needed for | Provided | Date or period | Notes |
|---|---|---|---|---|
| Certificate of incorporation | Company and ownership | |||
| Ownership structure chart | Company and ownership | |||
| Audited financial statements (two years) | Financial | |||
| Regulatory registrations | Legal and regulatory |
Preview shows 4 of 12 pre-filled rows.
How to fill it in, section by section
Questionnaire: sections
Groups questions into the 12 areas most vendor DDQs cover, from company ownership to references.
- Delete sections that do not apply to the relationship rather than accepting "N/A" on every row.
- Add sector-specific questions (for example clinical data or payment card handling) at the end of the relevant section.
Questionnaire: response
Where the responding company answers each question in full sentences.
- Answer directly first, then give the detail. Point to a named document rather than paraphrasing a policy.
- Keep answers consistent with any security questionnaire or RFP response you have sent the same organization.
Questionnaire: owner and status
Lets the responder split the DDQ across legal, finance, security and operations and see what is left.
- Assign each row to one person. DDQs stall when "legal" owns twelve rows and nobody in legal knows.
- Status moves from Open to Drafted to Approved. Nothing goes out until every row is Approved.
Document request list
Lists the supporting documents the requester expects, with dates, so stale evidence is obvious.
- Record each document’s date or period. An insurance certificate that expired last month is a follow-up waiting to happen.
- Share sensitive documents (financials, audit reports) under NDA or through a data room, not as email attachments.
Common mistakes
One DDQ for every relationship
A marketing agency and a payments processor carry different risks. Trim sections that do not apply, or responders will fill them with boilerplate and you will read it.
Answers that contradict earlier documents
The DDQ says data stays in the EU; the security questionnaire sent last month lists a US backup region. Reviewers cross-check. Responders should answer from the same approved source every time.
Policy paraphrase instead of policy
"We take compliance seriously" answers nothing. Name the policy, its owner and the date it was last reviewed, and attach it when asked.
No owner per row
DDQs that circulate as one shared file with no owners end up half-answered the night before the deadline. Assign rows on day one.
Stale supporting documents
Last year’s SOC 2 report or an expired insurance certificate turns a finished DDQ into a follow-up thread. Check dates before sending.
Tools that automate parts of this
If you answer DDQs more than a few times a quarter, the work is mostly finding the last approved answer and the current document. That is the part DDQ response tools automate.
- TR
Tribble: Dedicated DDQ workflow for asset managers, with compliance review routing and answers linked to evidence.
- RO
RocketDocs: RFPs, DDQs and security questionnaires from one approved library, with an audit trail on by default.
- AR
Arphie: AI-native RFP and DDQ drafting from live-connected sources, with source review and confidence scores.
- IN
Inventive AI: Drafts with a citation and confidence score on each answer and flags stale or duplicate content.
Capabilities above are restated from each vendor’s profile, where the sources are listed. Confirm current features and pricing with the vendor before you buy.
Related pages
Sources
- ILPA: Due Diligence Questionnaire and Diversity Metrics Template (checked October 2026)
Frequently asked questions
What is a DDQ?
A due diligence questionnaire is a structured list of questions an organization sends a supplier, partner or investment manager to assess its ownership, finances, legal and regulatory standing, compliance, security, resilience and practices before committing.
What sections does a vendor DDQ usually include?
Company and ownership, financial standing, legal and regulatory matters, compliance (anti-bribery, sanctions, code of conduct), information security, privacy, business continuity, insurance, subcontractors, ESG, people and references. This template covers all of them in 32 questions.
What is the difference between a DDQ and a security questionnaire?
A security questionnaire focuses only on information security controls. A DDQ is broader and usually includes a short security section alongside financial, legal, compliance and operational questions.
Is there a standard DDQ for private equity and fund managers?
Yes. The Institutional Limited Partners Association publishes the ILPA Due Diligence Questionnaire for limited partners assessing fund managers. ILPA says it is publicly available at no cost, and version 2.0 was updated in 2021.
How long does it take to complete a DDQ?
It depends on length and how much you can reuse. Teams with approved answers and current documents ready spend most of the time on review; teams starting from scratch spend it finding owners and documents.
Can DDQ software answer due diligence questionnaires automatically?
DDQ and response tools draft answers from a library of approved answers and source documents and route them for review. They speed up the repeat questions; new or sensitive questions still need the owner’s judgment.