Main idea

Answering a security questionnaire takes an investigation: understanding what the prospect is really asking, finding the information, verifying it is still true, deciding what can be disclosed, putting the answer back into the expected format. For forty-three questions, seven technical sources and one round trip with the operations team: three to six hours.

Then the document goes out, and all that work stays locked inside the file that was sent. What was verified, with whom, with which caveats, now exists only as a sentence in a client's spreadsheet. The next questionnaire covers the same topics, under a different numbering, and the investigation starts again.

The document is made for one client, one moment, one format. It is necessary, but it is not where a company can keep what it knows.

Why it matters

It explains the feeling of answering the same question for the tenth time while having to rebuild it: the knowledge exists, but it has been placed in containers that don't give it back.

It also gives the corrective move: keep, outside the document, what the research has established — the fact, its origin, its date, its limits — and leave in the document only the wording meant for the client.

Nuances and limits

Not everything a piece of research establishes deserves keeping: a detail specific to a single prospect has no reuse. Sorting assumes you know which topics come back, which only shows after several documents.

Open questions

• At what point in preparing a document should the facts be kept, so that this doesn't become a task postponed until after sending?