The round that never ends.
A supplier gets a security questionnaire, an ESG questionnaire and a compliance questionnaire, often from different people. Weeks later, the answers land in a folder. Someone marks the task as complete.
Nothing has been decided yet.
Three traps.
Answers get filed, not read against anything. A supplier's answer may contradict its own contract or certificate. Nobody compares them, because nobody has time.
Every party gets the same questions. A catering firm and a critical cloud provider should not get the same treatment. Ask what each party actually touches, and let that set the depth.
"Complete" gets mistaken for "accepted". A finished questionnaire says the supplier replied. It says nothing about whether you accept the risk.
A better order of work.
Start with what you already have. Read the contract and the earlier answers first, and ask only what is still unanswered. Bring security, ESG and compliance into one round, so the supplier answers once.
Check the answers against registers and against each other. Flag what disagrees. Then put the actual decision in front of a named person, with the sources next to it.
That person can accept, set conditions or send an item back. The questionnaire becomes an input again, which is all it ever should have been.