Due diligence questionnaire (DDQ)

DDQ stands for Due Diligence Questionnaire, a structured set of questions one organization sends to another to assess risk before a deal, an investment, or a vendor relationship proceeds. The acronym also has an unrelated chemistry meaning, 2,3-Dichloro-5,6-dicyano-1,4-benzoquinone, an oxidizing reagent used in organic synthesis.

A security questionnaire is scoped to cybersecurity controls such as encryption, access management, incident response, and certifications. A DDQ covers the full risk picture, with financial health, legal history, operational processes, and compliance posture alongside security. A security questionnaire is effectively one section of a DDQ, sent on its own.

A first draft of a 100-question DDQ typically takes 4 to 5 hours, and reported end-to-end effort runs 10 to 20 hours once internal review and evidence gathering are counted. Most of that time goes to searching previous answers and chasing colleagues for current certification documents, not to writing anything new.

Most institutional DDQs contain 100 to 200 questions. Investor DDQs that add ESG and operational sections often exceed 150, and M&A due diligence questionnaires run longer still because the capital at stake is larger.

The ILPA DDQ is the standardized due diligence template published by the Institutional Limited Partners Association, used by limited partners to evaluate general partners before committing capital. It covers fund strategy, organizational structure, performance, fee structures, risk management, and ESG, so LPs can compare funds on consistent criteria instead of each writing their own variant.

No, and the acronym is the only thing they share. In software, a DDQ is a vendor risk document a buyer sends before signing a contract, and its centre of gravity is security, privacy and operational continuity. In finance, a DDQ assesses a firm rather than a product, and it has its own published templates, the ILPA DDQ for investors evaluating fund managers and the Wolfsberg Group’s Correspondent Banking Due Diligence Questionnaire for banks evaluating each other. Wolfia answers the first kind, the security and vendor due diligence questionnaires a B2B company receives from its customers.

They use questionnaire automation built on their own documentation rather than an answer library somebody has to maintain by hand. Wolfia reads your policies, audit reports and past responses, drafts each answer with a citation to the source it came from, routes anything it cannot ground to the person who owns that topic, and returns the file in the format it arrived in. Amplitude runs more than 400 security questionnaires a year through it with a single reviewer.

Look for three things, because they are what separate tools on the tenth questionnaire rather than the first. Every answer should cite the document it came from, corrections should stick so the same fix is never made twice, and the tool should return Excel as Excel and Word as Word instead of handing you text to re-key. Wolfia does all three, and a DDQ, a security questionnaire and an RFP all draw on the same knowledge base because they ask the same things in different orders.

Answer inside the portal instead of exporting from it. Wolfia’s Chrome extension fills OneTrust, ServiceNow, ProcessUnity, UpGuard, Zip and dozens more directly in the browser, including the portals that never offered an export in the first place, so a reassessment becomes a review pass rather than a re-keying project. Publishing the documentation buyers ask for on a trust center removes a share of the requests before they reach anyone.

The party being evaluated fills it out, whether that is the vendor responding to a procurement team, the fund manager answering an investor, the SaaS company meeting an enterprise security requirement, or the acquisition target supplying information to an acquirer. Sending and receiving are separate roles, and most companies that receive DDQs never send them.

Yes, and it is where most of the time saving lives, because the same questions recur across buyers in different formats. The reuse has to be of a reviewed answer and its source, not of an old file. An answer written before your last audit, migration, or policy revision creates a factual mismatch a reviewer will catch.

Most AI tools only suggest an answer for a person to copy and paste. Wolfia fills DDQs in Excel, PDF, and Word, and its browser agent completes web-based portals such as OneTrust and ServiceNow end to end, with every answer citing the source document it came from.

No, and it should not. Due diligence answers can become contractual claims, so a person approves them. What automation changes is the shape of the work. The agent drafts grounded, cited answers and flags the low-confidence ones, so the reviewer clears the routine answers quickly and spends attention on the few that need it.