RFP, RFI, RFQ and DDQ glossary

RFP means request for proposal: a formal document asking vendors how they would deliver a project, product or service, and at what price. RFI means request for information: a set of questions buyers send to learn what suppliers offer before committing to a purchase. RFQ means request for quotation, also called a request for quote: a request for firm prices on clearly specified goods or services.

They differ in how much the buyer already knows and what it wants back. An RFI asks what is possible, an RFP asks how a supplier would solve a defined problem and an RFQ asks what a clearly specified requirement will cost. A simple test: if you cannot yet describe what you want, start with an RFI; if you can describe the problem but not the best solution, use an RFP; if you can describe exactly what you want, use an RFQ.

DDQ means due diligence questionnaire: a structured set of questions one organization sends another to assess its business, operations, controls and risks before investing, buying or signing a contract. Investors use DDQs to vet fund managers, companies use them to check vendors and suppliers, and buyers use them to examine a business they plan to acquire. The answers give the requester a written record to rely on.

When a buyer uses all three, they usually run in sequence: an RFI to learn the market and build a shortlist, an RFP to compare proposed solutions and an RFQ to settle final prices once the scope is fixed. Many purchases use only one or two of these steps. A DDQ often travels alongside them, attached to an RFP, sent to shortlisted suppliers or required before a contract is signed.

The ILPA DDQ is a standardized due diligence questionnaire published by the Institutional Limited Partners Association. Limited partners use it to evaluate private equity fund managers, known as general partners, with one common set of questions about the firm, team, strategy, fund terms and operations. It is a voluntary industry standard, and many investors send it as written or use it as the base for their own questions.

The SIG, or Standardized Information Gathering questionnaire, is a standard set of questions from Shared Assessments that organizations use to assess the risk of working with third-party vendors. It asks how a vendor protects data, manages risk and keeps its services running. SIG Lite is the shorter version for lower-risk vendors and initial screening, while SIG Core is the comprehensive version for higher-risk vendors.

Vendor due diligence is the process an organization uses to assess a supplier or service provider before and during the business relationship, covering security, financial, compliance and operational risk. It usually combines a vendor due diligence questionnaire, a review of supporting documents and a risk rating that shapes whether the vendor is approved and on what terms. The review usually goes deeper for riskier vendors, and critical vendors are reassessed most often.

Look at what it asks for. A request for general information about your company and offering is usually an RFI, a request for your approach and pricing against defined requirements is an RFP, and a request for firm prices on specified items is an RFQ. Questions about your organization itself, such as its controls, security, compliance and policies, point to a DDQ, a SIG or another vendor due diligence questionnaire.

Buyers and investors need the same core facts from everyone they assess, so questions about ownership, security, compliance and operations come up again and again. Standard templates such as the ILPA DDQ, the AIMA due diligence questionnaires and the SIG give everyone a common set of questions, so one well-prepared answer can be reused with small changes. Teams that answer them regularly keep a library of approved answers and current documents, then tailor each one to the new question.

XiCLOPS uses your own documents to fill out RFPs, RFIs and due diligence questionnaires, including security and vendor questionnaires like the SIG and private equity DDQs like the ILPA DDQ. It does not handle price quotes, so RFQs are outside its scope. It works with Word, Excel, PowerPoint and PDF files, shows the source documents behind each answer and returns your questionnaire in its original format. The free trial includes 1 run of up to 25 questions and 750 source pages, with no card required.

Yes. In construction, an RFI is a question a contractor sends to the architect or engineer to clarify drawings or specifications while a project is under way. That is a different document from the procurement RFI, which a buyer sends to suppliers to learn what products, services and capabilities are available before it commits to a formal purchase. This glossary uses the procurement meaning.

An RFP invites vendors to explain how they would meet a defined need and what it would cost, so the buyer can compare offers. A DDQ looks at the organization behind the offer, asking about its operations, controls, compliance and security. Because both ask many of the same things about the business, teams that answer them often work from one library of reviewed answers and current documents.

A security questionnaire is a set of questions a buyer sends a vendor about how it protects information, such as its access controls, encryption, monitoring and incident response. A vendor questionnaire overlaps with it but can also ask about financial health, compliance, operations and ownership, and many buyers combine both in one document. Vendor assessments and third-party risk questionnaires are close relatives, and the names are often used interchangeably.

Inherent risk is the judgment of how critical a vendor is and how much harm a failure or breach could cause, and it sets how deep the review goes. Residual risk is what remains once the controls the vendor described are taken into account. Reviewers list any gaps that still need fixing, then approve the vendor, approve it with conditions or turn it down.