# Due Diligence Questionnaire (DDQ) Template

> Free template from RFP Software Tools (https://rfp-software-tools.com/templates/ddq-template). No sign-up. The Excel version has dropdowns and formulas; this Markdown copy shows the same structure.

## How to use it

| Area | What it is for | How to fill it |
| --- | --- | --- |
| Questionnaire: sections | Groups questions into the 12 areas most vendor DDQs cover, from company ownership to references. | Delete sections that do not apply to the relationship rather than accepting "N/A" on every row. Add sector-specific questions (for example clinical data or payment card handling) at the end of the relevant section. |
| Questionnaire: response | Where the responding company answers each question in full sentences. | Answer directly first, then give the detail. Point to a named document rather than paraphrasing a policy. Keep answers consistent with any security questionnaire or RFP response you have sent the same organization. |
| Questionnaire: owner and status | Lets the responder split the DDQ across legal, finance, security and operations and see what is left. | Assign each row to one person. DDQs stall when "legal" owns twelve rows and nobody in legal knows. Status moves from Open to Drafted to Approved. Nothing goes out until every row is Approved. |
| Document request list | Lists the supporting documents the requester expects, with dates, so stale evidence is obvious. | Record each document’s date or period. An insurance certificate that expired last month is a follow-up waiting to happen. Share sensitive documents (financials, audit reports) under NDA or through a data room, not as email attachments. |

## Sheet: DDQ

Responder: answer every row, attach or link supporting documents, and set status to Approved once a named owner has signed off.

| ID | Section | Question | Response | Supporting document | Owner | Status |
| --- | --- | --- | --- | --- | --- | --- |
| DD-01 | Company and ownership | State the full legal name, registration number and country of incorporation of the contracting entity. |  | Certificate of incorporation |  | Open |
| DD-02 | Company and ownership | Who are the ultimate beneficial owners holding 25% or more of the company? |  | Ownership chart |  | Open |
| DD-03 | Company and ownership | List the parent company and any affiliates that would deliver part of the service. |  |  |  | Open |
| DD-04 | Company and ownership | Has the company undergone a change of control in the last three years, or is one expected? |  |  |  | Open |
| DD-05 | Financial | Provide audited financial statements for the last two financial years, or explain why they are unavailable. |  | Audited accounts |  | Open |
| DD-06 | Financial | Has the company, or any director, been subject to insolvency proceedings in the last five years? |  |  |  | Open |
| DD-07 | Financial | Does any single customer account for more than a quarter of annual revenue? |  |  |  | Open |
| DD-08 | Legal and regulatory | Is the company party to any current or threatened litigation that could affect its ability to deliver the service? |  | Litigation summary |  | Open |
| DD-09 | Legal and regulatory | Is the company, or are any of its activities, regulated? Name the regulator and registration number. |  | Regulatory registration |  | Open |
| DD-10 | Legal and regulatory | Has any regulator taken enforcement action against the company in the last five years? |  |  |  | Open |
| DD-11 | Compliance | Do you have an anti-bribery and corruption policy, and do staff receive training on it? |  | ABC policy |  | Open |
| DD-12 | Compliance | Do you screen the company, owners and key staff against sanctions lists? How often? |  | Screening procedure |  | Open |
| DD-13 | Compliance | Do you have a code of conduct and a whistleblowing channel? |  | Code of conduct |  | Open |
| DD-14 | Compliance | Describe how you identify and manage conflicts of interest. |  |  |  | Open |
| DD-15 | Information security | Do you hold an ISO/IEC 27001 certificate or SOC 2 Type II report covering the service? Give scope and period. |  | Certificate or report |  | Open |
| DD-16 | Information security | Will you complete our security questionnaire, or provide a completed SIG or CAIQ? |  | Completed questionnaire |  | Open |
| DD-17 | Information security | Have you had a security incident affecting customer data in the last three years? Describe the response. |  |  |  | Open |
| DD-18 | Privacy | Will you act as a processor of personal data, and will you sign our data processing agreement? |  | DPA |  | Open |
| DD-19 | Privacy | In which countries will personal data be stored or accessed, including by subprocessors? |  | Subprocessor list |  | Open |
| DD-20 | Privacy | Who is your data protection officer or privacy lead? |  |  |  | Open |
| DD-21 | Business continuity | Do you maintain a business continuity plan covering this service, and when was it last tested? |  | BCP test summary |  | Open |
| DD-22 | Business continuity | What are the recovery time and recovery point objectives for the service? |  |  |  | Open |
| DD-23 | Business continuity | Which key dependencies (suppliers, sites, people) could interrupt delivery, and how are they covered? |  |  |  | Open |
| DD-24 | Insurance | List insurance policies relevant to the service, with insurer, limit and expiry (for example professional indemnity, cyber, general liability). |  | Insurance certificates |  | Open |
| DD-25 | Subcontractors | Will any part of the service be subcontracted? Name the subcontractors and what they do. |  |  |  | Open |
| DD-26 | Subcontractors | How do you assess and monitor your own critical suppliers? |  | Supplier management procedure |  | Open |
| DD-27 | ESG | Do you have an environmental policy, and do you measure your greenhouse gas emissions? |  | Environmental policy |  | Open |
| DD-28 | ESG | Do you have policies on modern slavery and human rights in your supply chain? |  | Policy or statement |  | Open |
| DD-29 | ESG | Do you publish diversity, equity and inclusion commitments or data? |  |  |  | Open |
| DD-30 | People | How many employees and contractors will work on this account, and in which locations? |  |  |  | Open |
| DD-31 | People | Do you perform pre-employment screening for staff with access to customer data, where permitted by law? |  |  |  | Open |
| DD-32 | References | Provide two customer references of similar size and scope, with contact details and permission to contact. |  | Reference contacts |  | Open |

Dropdown values:

- **Status:** Open / Drafted / Approved / Not applicable

## Sheet: Documents

Share confidential documents under NDA or via a data room.

| Document | Needed for | Provided | Date or period | Notes |
| --- | --- | --- | --- | --- |
| Certificate of incorporation | Company and ownership |  |  |  |
| Ownership structure chart | Company and ownership |  |  |  |
| Audited financial statements (two years) | Financial |  |  |  |
| Regulatory registrations | Legal and regulatory |  |  |  |
| Anti-bribery and corruption policy | Compliance |  |  |  |
| Code of conduct | Compliance |  |  |  |
| ISO/IEC 27001 certificate or SOC 2 Type II report | Information security |  |  |  |
| Completed security questionnaire | Information security |  |  |  |
| Data processing agreement and subprocessor list | Privacy |  |  |  |
| Business continuity plan test summary | Business continuity |  |  |  |
| Insurance certificates | Insurance |  |  |  |
| Environmental and modern slavery policies | ESG |  |  |  |

Dropdown values:

- **Provided:** Yes / No / Under NDA / Not applicable