You won the contract. Now somebody has to fill in the questionnaire.
The work you spent four months winning came with a security questionnaire, due back Friday, and nobody in a fourteen-person firm has that in their job description. Here is who should answer it, and why an honest no is worth more than a hopeful yes.
It comes stapled to the good news. Four months of calls and meetings and second meetings, a client you actually wanted, and then behind the signature pages there is a security questionnaire with a return date of Friday.
So it starts moving around the building. The partner who won the work gives it to the office manager, who gives it to whoever is good with computers, who answers what she knows on Thursday evening and does her best with the rest.
Who is supposed to answer it
Nobody in a fourteen-person firm has this in their job description, and that is the honest place to start. But most of the form is not really a technical document. It asks how your office behaves — who gets a login on their first day, who loses it on their last, which of your people can open the client files and which cannot.
It also helps to know what the form is for. The client is not testing you. Somebody over there has been told to ask the same questions of everybody they hire, and they need answers they can put in a folder and point to later.
Two people should sit with it for an hour: somebody who knows how the office actually runs day to day, and the owner who is going to sign it. Whoever signs is the one held to the answers, which is a fair reason for that person to have read them first.
The question where the answer is usually no
Somewhere in the middle there is a question about whether you have a written plan for the morning something goes wrong. For most of the firms we walk into, the honest answer is no. There is a plan of a sort — it lives in the head of the person who has quietly fixed the printers for six years, and it has never been on paper.
Write no. A no with a month beside it — not yet, in place by September — reads like a firm that knows itself. A hopeful yes reads fine on Friday and badly a year later, because these answers usually get folded into the contract you just signed.
Once, properly, beats yearly and approximately
The reason to do this carefully is that it is not the last one. Another client sends a similar form in the spring, your insurer’s renewal asks half the same things in a different order, and the rules your profession works under want their own version. Answered from memory each time, every one of those costs somebody a week. Answered once and written down, the next takes an afternoon. Keep a single page:
- Who gets which logins on a first day, and who takes them away on a last day.
- Where the copies of your files live, and the date somebody last put one back.
- Which of your people can reach the client files, and which of them cannot.
- Who gets called at seven in the morning, and who calls the client.
- What you have not done yet, and the month you intend to do it.
Most owners open one of these expecting it to go badly, and it usually does not. Two or three noes on a long form is ordinary for a firm your size, and the client asking generally wants a straight answer rather than a perfect one. If yours is due soon, ninety minutes on site is enough to get through most of it, and the written report is yours either way.