Answer a customer security questionnaire

A customer or prospect sends you a security questionnaire: a SIG, a CAIQ, or their own spreadsheet. This workflow takes it from the file in your inbox to an answered copy you can send back, with every answer drafted from your own documents and approved by a person. It crosses Documents, Questionnaires, the Review Center, and the Evidence Library.

You are done when every question has an approved answer and you have sent the answered copy. As a side effect, each approved answer is kept as evidence and as reference wording for the next questionnaire.

Before you start

• The questionnaire file. Excel (.xlsx), CSV, PDF, or Word (.docx), up to 25 MB. If the customer sent a PDF and a spreadsheet version exists, ask for the spreadsheet: it parses most reliably.
• Permissions. Uploading, parsing, and drafting answers need create permission on Questionnaires. Approving answers needs update permission.
• Your source documents. Security policies, procedures, your latest audit report, and earlier completed questionnaires.

On the dashboard, the Answer security questionnaires goal walks you through the same path in five steps, from uploading your first documents to registering an answer as evidence.

1. Get the right documents in

The AI drafts only from what is in your workspace, so start in Documents. Click Upload Document, one file at a time, and wait for each to reach Ready. A document that is rejected, deprecated, expired, or not yet effective is not used for answers.

Audit reports, such as a SOC 2 report, are withheld from citations by default for each questionnaire, because they can reveal findings. If you want the AI to cite one, you allow it per questionnaire in step 2, before drafting.

You're done when the documents that cover the questionnaire's topics show Ready in Documents.

This hands on the corpus the AI searches and cites.

Details: Add & classify.

2. Upload and parse the questionnaire

On the Questionnaires page, click New questionnaire. In Upload Questionnaire, give it a Name you will recognize (usually the customer), add a description if you like, choose the file, and click Upload. The card appears as Draft.

Click Parse. SolveGRC reads the file and pulls each question into its own row; scanned PDFs go through OCR on their own. If a PDF yields no questions, the No questions found dialog lets you retry with Fast Processing or Advanced Forms & Tables.

Click the card to check the extracted questions in the Review Center. You can't edit extracted questions, so if the parse picked up stray rows or missed some, delete the questionnaire and upload a cleaner file. While you are there, if the answers should be allowed to cite an audit report, click Authorise audit sources in the header; the chip changes from Audit sources withheld to Audit sources citable.

You're done when the card shows Ready with its question count, and the questions look right.

Details: Upload & parse.

3. Draft the answers

On the Ready card, click Process AI. The questionnaire moves to In Progress and drafts fill in as SolveGRC works through the questions. You can leave the page and come back.

Process AI runs once. Some questions come back without a usable draft:

• No draft at all when nothing relevant was found in your documents.
• A blank draft filed under Needs authoring when evidence was found but didn't answer the question.
• A placeholder for questions reserved for a person, such as legal positions.

You handle all of these one at a time in the next step.

You're done when the drafting has finished. The questionnaire moves to In Review once every question has an answer; until then it stays In Progress.

Details: Generate answers.

4. Review and approve

Open the questionnaire in the Review Center (click its card, or … > Review Answers).

Work the queue from the filter on the left:

1. Ready first. These passed SolveGRC's checks. Read a few, then use Quick-approve N ready or select them and approve in bulk. Flagged answers are held back from a bulk approve.
2. Needs evidence and Needs authoring next. Open each answer, read the trust panel (Assurance, Citations, Integrity, Model self-rating), and open a citation to check the passage. Edit and save, or click Regenerate after adding a document.
3. Questions with no draft: click Generate AI answer once you have added supporting documents, or Write it myself.

When one of SolveGRC's checks is open on an answer, the button reads Approve anyway… instead of Approve. Use it only when you are sure the wording is what you want to send; it asks you to confirm and records your decision on the answer.

You're done when the Review Center shows every answer approved.

This hands on approved answers. Each one is registered in the Evidence Library automatically, except answers approved over an open check, which you can register with Register as evidence.

Details: Review & approve.

5. Export and send

On the questionnaire card, open … and choose Download Answered Copy. SolveGRC rebuilds the questions with Answer and Review Status columns. A CSV questionnaire comes back as CSV; everything else comes back as Excel (.xlsx). The copy contains each question's latest answer whatever its status, so check the Review Status column before you send. Text held back by an unresolved disclosure check is replaced with a withheld notice.

Send the file the way the customer asked for it, by email or through their portal. SolveGRC does not send it for you.

You're done when the customer has the answered copy.

Details: Register evidence & export.

What carries forward

• Evidence. Approved answers sit in the Evidence Library as attestations titled "Questionnaire Answer: name". You can link them to controls from Assessments like any other evidence.
• Reference wording. Answers approved in the past year are used as examples when the AI drafts the next questionnaire, so your second questionnaire starts from your approved wording.
• Evidence packs. If you want this questionnaire's evidence bundled under one name, use Create Evidence Pack in the Review Center header. See Reuse & packs.