Questionnaire-Based vs Evidence-Based Third-Party Risk Management (TPRM)

Questionnaire-based third-party risk management (TPRM) judges a supplier by what the supplier says about its own controls, and evidence-based TPRM judges it by what can be checked: independent audit reports, observations from outside the supplier’s network and control data read from the supplier’s own systems. A questionnaire tells you what the supplier believes and intends on the day it answers. Evidence tells you whether that is still true.

The Federal Reserve, the FDIC and the OCC describe the purpose of third-party risk management in their Interagency Guidance on Third-Party Relationships of June 2023, which says it is important for a banking organization to “identify, assess, monitor, and control risks related to third-party relationships.” Most programs need both methods, because each one answers a question the other cannot. This article compares them, shows where US and EU regulators draw the line, and sets out how to combine questionnaire answers with outside telemetry.

What is questionnaire-based third-party risk management (TPRM)?

Questionnaire-based TPRM sends each supplier a standard set of questions, scores the answers and asks for documents where an answer needs support. Industry bodies publish 2 common questionnaires. Shared Assessments publishes the Standardized Information Gathering questionnaire, known as the SIG, on an annual content release cycle. The Cloud Security Alliance publishes the Consensus Assessment Initiative Questionnaire, CAIQ v4, which it describes as “a set of Yes/No questions” that a cloud customer may ask a cloud provider about the Cloud Controls Matrix, and which providers submit as a self-assessment at STAR Level 1.

Questionnaires do real work. They set the scope of the relationship, they cover what no system records, such as policies, staffing, subcontractors and incident procedures, and they ask every supplier the same questions, so the answers can be compared. Their limit is who answers them. A questionnaire is a self-attestation that describes one moment, and nothing in it shows whether the controls it describes are operating. How to read a cloud provider’s published answers quickly is covered in How to Assess a Cloud Vendor’s Security Posture in 30 Minutes.

What is evidence-based third-party risk management (TPRM)?

Evidence-based TPRM tests a supplier’s answers against sources the supplier does not write on the day. In practice, 4 kinds of evidence do most of the work.

• Independent assurance reports, such as a SOC 2 report or an ISO/IEC 27001 certificate, show what an auditor tested over a stated period and scope.
• Outside-in observation shows what anyone on the internet can see about the supplier, such as exposed services, misconfigured domains, leaked credentials and known vulnerabilities.
• Control evidence read from the supplier’s own systems shows whether specific controls are in their expected state, and it needs a contract clause and the supplier’s consent.
• Performance and incident records show whether the supplier meets its service levels and reports incidents as the contract requires.

The idea is built into the questionnaire standards themselves. Shared Assessments, which publishes the SIG, also publishes the Standardized Control Assessment procedures, and it says they fit “the ‘verify’ portion of a third-party risk program, typically employed after an initial questionnaire”. In Shared Assessments’ own model, the questionnaire and the verification are 2 halves of one program. The full definition of the evidence-based approach is in What Is Evidence-Based Third-Party Risk Management?

How do questionnaire-based and evidence-based third-party risk management (TPRM) compare?

The 2 approaches differ in who supplies the answer, how current it is and what an auditor can test afterwards.

Are security questionnaires enough to assess vendor risk?

For a supplier that supports a critical activity, a questionnaire on its own is not enough, and the main US and EU sources say so in their own words. The stakes have grown as well. Verizon’s 2026 Data Breach Investigations Report found that breaches with third-party involvement rose by 60% from the previous year’s dataset, to 48% of all breaches.

• The interagency guidance says appropriate due diligence includes evaluating the effectiveness of a third party’s overall risk management, “including policies, processes, and internal controls”, and that ongoing monitoring may include “direct testing of the third party’s own controls” where the risk warrants it.
• DORA, Regulation (EU) 2022/2554, requires contracts for ICT services that support critical or important functions to include “the right to monitor, on an ongoing basis” the provider’s performance, with rights of access, inspection and audit (Article 30(3)(e)).
• The EBA Guidelines on outsourcing arrangements of February 2019 list self-certification as one tool among several for evaluating a service provider, next to key performance indicators, key control indicators, service delivery reports and independent reviews (paragraph 104). The EBA’s final guidelines on third-party risk of 18 September 2026 will replace them once they apply.
• NIST CSF 2.0 outcome GV.SC-07 asks that supplier risks be “understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship.”

For a low-risk supplier with no access to sensitive data or systems, a questionnaire, an outside-in scan and a review at renewal may be proportionate. The interagency guidance says the scope of due diligence “should be commensurate with the level of risk and complexity of the third-party relationship”, and DORA applies the same principle of proportionality in Article 28(1).

How should questionnaire data and external telemetry be combined?

Combine them by using each source for what it can prove, and by treating every disagreement between them as a finding.

1. Use the questionnaire to set the scope and the expected state. If a supplier says it enforces multifactor authentication for all remote administrative access, that sentence becomes the expected state of a control.
2. Test each claim against the source that can check it. Outside-in observation checks claims about exposure, an audit report checks claims within its scope and period, and control evidence checks the specific controls a critical supplier agreed to share.
3. Record a contradiction as a finding with an owner at the supplier, instead of quietly lowering a score.
4. Weight verified evidence above self-attestation, and keep the source and the date of every data point, so the score can be traced back to what supports it.
5. Let the supplier’s criticality decide how deep the checks go.
6. Reopen the questionnaire when the evidence changes, instead of waiting for the next annual cycle.

NIST asks for the same discipline in SP 800-161 Rev. 1, its guide to cybersecurity supply chain risk management. Its guidance on supplier assessments (control SR-6) calls the quality of the information relied on, including its relevance, completeness and accuracy, “an important consideration”, and it asks that the reference sources for assessment information be documented.

An illustration: one claim, 3 sources

This example is an illustration. The supplier is invented, and the example uses no figures.

A bank’s payroll provider answers its annual questionnaire. It says that administrative interfaces are not exposed to the internet and that all administrator access requires multifactor authentication. Its SOC 2 report covers the hosting platform, but it does not cover a support tool the provider added after the audit period. Outside-in observation then finds a login page for that support tool that anyone on the internet can reach.

None of the 3 sources is wrong. The questionnaire describes the platform the provider had in mind, the audit report describes the period its auditor tested, and the observation describes what is exposed today. The bank records the contradiction as a finding with an owner at the provider and asks for evidence that the new tool enforces multifactor authentication. Because the provider supports a critical activity and the contract carries a right-to-audit clause, the bank also asks for consent to read that control directly. The finding closes when the login page is restricted and the evidence shows multifactor authentication enforced, which is a stronger ending than a revised answer.

What questions should buyers ask a third-party risk management (TPRM) vendor?

Ask the questions that show whether a platform checks supplier answers or only collects them.

• Ask which kinds of evidence the platform reads besides questionnaire answers, and for which suppliers.
• Ask how each data point in a supplier’s score is dated, and whether an auditor can trace the score to its sources.
• Ask what happens when an outside observation contradicts a questionnaire answer.
• Ask how consent and scope are recorded when evidence is read from a supplier’s own systems.
• Ask how subcontractors are recorded, and whether the record can feed a regulatory register such as DORA’s register of information.
• Ask who reviews an AI conclusion about a supplier document before it counts.
• Ask what triggers a reassessment between scheduled reviews.

How DigitalXForce runs evidence-based third-party risk management (TPRM)

DigitalXForce was named a Leader in the IDC MarketScape: Worldwide Third-Party Risk Management Software 2026 Vendor Assessment, IDC document US53007725 of September 2026, which is listed on IDC’s own page.

The AI-Powered Third-Party Risk Management (TPRM) module covers vendor onboarding, category questionnaires, AI-assisted document analysis and review and reassessment workflows. Each vendor is scored from its questionnaire answers, its evidence and external signals, verified evidence carries more weight than self-attestation, and every vendor gets its own score. External Risk View is the outside-in engine, and it monitors exposed services, misconfigurations, vulnerability exposure, dark web and breach intelligence, lookalike domains and cyber ratings. For critical suppliers, connectors read control evidence from the supplier’s own systems under the customer’s right-to-audit clause and with the supplier’s consent.

AI JedAI is the DigitalXForce AI engine that analyzes: it reasons over control evidence and live telemetry, maps documents to controls and frameworks, scores and prioritizes risk, and recommends remediation mapped to framework requirements. In third-party work, the TPRM module’s AI-assisted document analysis reads the reports a supplier returns. An analyst reviews AI output before anyone relies on it, and every conclusion links back to the evidence it used. Each stage of the process is documented in How does DigitalXForce third-party risk management work?

Where DigitalXForce is not the answer

A startup preparing its first SOC 2 report, with a short list of suppliers, does not need evidence-based TPRM at this depth, and DigitalXForce Lite serves that case in the cloud, with the same functionality as the full platform and a faster deployment. A team that only needs outside-in ratings across a very large supplier list, with no plan to assess controls, can start with a security ratings service. DigitalXForce reads cyber ratings as one of its outside signals, so the two can work together, as the FAQ answer on security ratings explains.

Questions about questionnaire-based and evidence-based third-party risk management (TPRM)

What is the difference between questionnaire-based and evidence-based third-party risk management (TPRM)?

Questionnaire-based TPRM judges a supplier by what the supplier says about its own controls. Evidence-based TPRM judges it by what can be checked, such as independent audit reports, outside-in observation and control data read from the supplier’s systems with its consent. Most programs use both, with the questionnaire setting the scope and the evidence confirming it.

Are security questionnaires enough to assess vendor risk in third-party risk management (TPRM)?

For a supplier that supports a critical activity, a questionnaire alone is not enough, because it is a self-attestation that describes one moment. US banking guidance allows direct testing of a third party’s own controls where the risk warrants it, and DORA requires ongoing monitoring rights for ICT services that support critical or important functions. For a low-risk supplier, a questionnaire and an outside-in scan may be proportionate.

How should questionnaire answers and external telemetry be combined in third-party risk management (TPRM)?

Use the questionnaire to set the expected state of each control, test each claim against the source that can check it and record every contradiction as a finding with an owner. Weight verified evidence above self-attestation, date every data point and reopen the questionnaire when the evidence changes.

Does evidence-based third-party risk management (TPRM) replace the questionnaire?

It does not. The questionnaire still covers policies, staffing, subcontractors and procedures that no system records, and it sets the scope for the evidence. Evidence-based TPRM checks the answers and keeps checking them between reviews.

What counts as evidence in evidence-based third-party risk management (TPRM)?

In practice, 4 kinds of evidence do most of the work: independent assurance reports such as SOC 2, outside-in observation of what the supplier exposes to the internet, control evidence read from the supplier’s own systems under a contract clause and with consent, and performance and incident records. Each item should carry its source and the date it was read.

Do regulators require evidence-based third-party risk management (TPRM)?

No regulator uses that phrase. US banking agencies expect due diligence and ongoing monitoring commensurate with risk, and they state that they are not encouraging any specific approach to monitoring. DORA goes further for ICT services that support critical or important functions and requires contract rights to monitor, access, inspect and audit the provider.

Can a supplier refuse to share evidence from its own systems?

It can, because control evidence from a supplier’s systems needs its consent and a contract clause. The interagency guidance expects the organization to document the limitation, understand the risk it leaves and consider alternatives, such as other information, additional monitoring or a different supplier.

Sources

• The Federal Reserve, the FDIC and the OCC issued the Interagency Guidance on Third-Party Relationships: Risk Management on 6 June 2023, published at 88 FR 37920 on 9 June 2023, at https://www.federalregister.gov/documents/2023/06/09/2023-12340/interagency-guidance-on-third-party-relationships-risk-management. The OCC issued it as OCC Bulletin 2023-17, at https://www.occ.gov/news-issuances/bulletins/2023/bulletin-2023-17.html. Due diligence is in section C.2, ongoing monitoring in section C.4, and the agencies’ comment on monitoring approaches is in the preamble, section E.3.
• Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA), of 14 December 2022, applies from 17 January 2025, and Articles 28 and 30 were read from the Publications Office text at https://publications.europa.eu/resource/celex/32022R2554.
• The EBA published its Guidelines on outsourcing arrangements, EBA/GL/2019/02, on 25 February 2019, at https://www.eba.europa.eu/sites/default/files/documents/10180/2551996/38c80601-f5d7-4855-8ba3-702423665479/EBA%20revised%20Guidelines%20on%20outsourcing%20arrangements.pdf, and paragraph 104 is in section 14. Its final Guidelines on the sound management of third-party risk related to non-ICT services, EBA/GL/2026/09, were published on 18 September 2026 and are listed at https://www.eba.europa.eu/activities/single-rulebook/regulatory-activities/internal-governance/guidelines-third-party-risk-management.
• NIST published The NIST Cybersecurity Framework (CSF) 2.0, CSWP 29, on 26 February 2024, at https://doi.org/10.6028/NIST.CSWP.29.
• NIST published SP 800-161 Rev. 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations, in May 2022, with updates as of 1 November 2024, at https://csrc.nist.gov/pubs/sp/800/161/r1/upd1/final, and control SR-6 is in Appendix A.
• Shared Assessments describes the SIG and its annual content release cycle at https://sharedassessments.org/sig-faq/ and the Standardized Control Assessment procedures at https://sharedassessments.org/sca/.
• The Cloud Security Alliance describes the STAR Level 1 Security Questionnaire (CAIQ v4) at https://cloudsecurityalliance.org/artifacts/star-level-1-security-questionnaire-caiq-v4.
• Verizon published the 2026 Data Breach Investigations Report Executive Summary at https://www.verizon.com/business/resources/executivebriefs/2026-dbir-executive-summary.pdf.
• Every source above was read on 26 September 2026.

See it on your own data.

The comparison above is honest about where each platform fits. If your situation is the one DigitalXForce fits, the fastest way to check is a 30 minute walkthrough on your own frameworks and your own integrations, not a slide deck. You leave with a mapped control set and a view of what continuous monitoring would surface in your environment.

Request a demo