Supplier questionnaires leave the hardest resilience question unanswered

“Yes, we have a business continuity plan” is an easy answer to give and a difficult answer to buy against. A procurement team needs to know whether the service it is purchasing can support its own recovery needs. The supplier may have answered a narrower question: whether a document exists.

That difference becomes expensive when a critical service fails. The buyer discovers that a tested recovery procedure covered another product, that customer action is required before restoration, or that the supplier’s commitment stops at the platform boundary. A completed questionnaire has value, but it cannot settle those distinctions by itself.

The same supplier can leave you with different responsibilities

AWS’s shared responsibility model makes the boundary concrete. Customers using Amazon EC2 manage the guest operating system and installed applications. With Amazon S3, AWS operates more of the underlying stack, while customers retain responsibilities for data and permissions. A company-level answer about security cannot explain every service configuration.

For the buyer, the implication is to attach important answers to a service, deployment and operating arrangement. If a supplier says recovery is tested annually, ask which recovery path the test exercised. Was customer configuration included? Were dependent services available? Did the test finish when infrastructure started or when a customer could use the application?

Those questions need not produce an adversarial exchange. They help both sides identify where their plans join. A supplier may have a sound recovery process while the buyer has never rehearsed the credentials, network changes or reconciliation needed to benefit from it.

Spend the extra scrutiny on a consequential claim

Repeating a hundred questions with slightly different wording creates work without necessarily improving assurance. Select the claims whose failure would change the purchase decision. For a payroll service, that could be restoring access before a payment deadline. For a collaboration tool, retaining and exporting business records might matter more.

Follow each selected claim through three layers: the assertion, the supporting evidence and the remaining dependency. A report can support the assertion without covering the entire dependency. Keep those distinctions visible in the recommendation to the business sponsor.

In a hypothetical review, a supplier provides a recovery-test summary for its main application. The summary excludes a newly acquired analytics module included in your proposal. The correct response is a targeted question about that module, not rejection of the whole report and not an assumption that the existing evidence extends to it.

Evidence can be proportionate without becoming superficial

Suppliers have legitimate reasons to restrict detailed internal records. A buyer can often work with a scoped independent report, a redacted exercise summary or a joint walkthrough. What matters is whether the alternative addresses the decision. A generic assurance badge cannot substitute for an explanation of an excluded service.

When evidence remains unavailable, consider the consequence and the available options. A less critical purchase may proceed with a recorded limitation. A critical dependency may justify a contractual commitment, a customer-side workaround or another supplier. The useful outcome is a conscious choice, not a perfect-looking questionnaire.

Commercial terms also deserve their own reading. An operational aspiration, a support response target and a contractual restoration commitment are different promises. Ask procurement and the service owner to agree which promise the business case actually relies on.

Keep the answer useful after the contract is signed

Pass the consequential commitments to the people operating the service. They need the escalation route, customer tasks and evidence that should trigger a new review. Otherwise the assessment remains in procurement while the live service changes around it.

Our supplier assessment approach helps decide where to concentrate this effort. For a critical supplier, the final question is simple: can your service owner explain what happens when this dependency fails? If the answer still depends on an unexplained “yes”, the questionnaire has opened the conversation rather than finished it.