What a DDQ covers
A DDQ asks the questions a careful investor, client or buyer would want answered before trusting you with money, data or a contract. The exact list depends on who is asking and why, but most DDQs return to the same themes: who you are, how you work, how you manage risk and how you protect the assets and information in your care.
Questions come in many forms, from simple yes or no checks to long narrative answers, tables to complete and requests to attach policies, reports or financial statements. Most DDQs group their questions into topics like these:
- Firm and ownership: legal structure, ownership, history, key people and any changes in leadership
- Strategy and track record: what you do, how decisions are made, how results are measured and what sets you apart
- Operations: systems, service providers, processes, staffing, business continuity and disaster recovery plans
- Compliance and legal: policies, regulatory registrations, conflicts of interest, litigation and any regulatory actions
- Information security: access controls, data protection, encryption, monitoring, incident response and oversight of third parties
- Risk management: how risks are identified, monitored, reported and escalated, and who is responsible for each
- Financial condition: financial statements, insurance coverage, fees or pricing and the stability of the business
- Environmental, social and governance practices: policies, oversight and how they are reported
- Supporting documents: policies, audit and assurance reports, certifications and references
The main kinds of DDQ
The term DDQ is used for several related documents. They share a format, a long list of questions with room for answers and attachments, but they differ in who asks, what they want to learn and how the answers are used.
Investment and fund manager DDQs are sent by institutional investors, consultants and other allocators to the managers they are considering, and often again while they remain invested. They cover the firm, the investment team, strategy, risk management, operations, compliance, valuation and reporting. Because a manager can receive many similar DDQs, industry bodies publish standard templates to cut down on repetition: the Institutional Limited Partners Association (ILPA) publishes a DDQ template for private equity, and the Alternative Investment Management Association (AIMA) publishes due diligence questionnaires for hedge fund managers. Many investors use these templates as a base and add their own questions, and some run a separate operational due diligence review focused on operations, controls and service providers.
Vendor and security DDQs are sent by companies to suppliers, software providers and other third parties before signing a contract or granting access to systems or data. They concentrate on information security, data privacy, business continuity, financial stability and compliance, and usually sit inside a wider procurement or third-party risk process. Security questionnaires, vendor assessments and third-party risk questionnaires are close relatives, and buyers often use the names interchangeably.
M&A diligence request lists are sent by a buyer and its advisers to the seller in a merger or acquisition. They ask for corporate records, financial statements, tax filings, material contracts, employee and benefits information, intellectual property, technology and litigation history. The seller usually answers by uploading documents to a virtual data room and responding to follow-up questions, so these lists read more like a structured document request than a questionnaire.
Who sends and answers DDQs
DDQs are sent by whoever is responsible for checking a relationship before it starts. That includes investors and their consultants, investment and operational due diligence teams, procurement and vendor management teams, information security and risk teams, compliance officers, and buyers and their advisers in a deal. They use the answers to compare candidates, spot risks, decide what to follow up on and keep a record of what they were told.
Answering a DDQ is usually a team effort coordinated by one person or group. At an investment firm, that is often investor relations, client service or a dedicated RFP and DDQ team, working with compliance, operations, legal, finance and the investment professionals. At a software or services company, it is often sales, a proposal team or the security team, with help from legal, finance and IT. Subject matter experts supply or approve the content, and a senior person signs off before the DDQ goes back.
Because many of the same questions come up in every DDQ, teams that answer them regularly keep a library of approved answers and current documents, whether in shared folders or in dedicated DDQ software. That library is also what they draw on for RFPs and RFIs, which ask many of the same things about the business.
How to answer a DDQ well
A DDQ is often the first detailed look a requester gets at how you operate, and your answers may be checked against documents, calls and site visits later. Accuracy and consistency count for more than polish. These habits make the work faster and the answers stronger:
- Reuse approved answers: keep a library of reviewed responses to common questions, then adapt each one to the exact wording of the new question instead of pasting it in unchanged.
- Keep evidence current: maintain the latest versions of the policies, reports, certifications and financial statements you are asked to attach, and refresh library answers whenever the underlying facts change.
- Flag gaps: when you do not have the policy, control or document a question asks about, say so plainly and explain what you do instead, rather than leaving the answer blank or vague.
- Answer the question asked: read each question closely, follow the requested format and keep answers direct and specific.
- Stay consistent: make sure related answers agree with each other and with what you have told the same requester in earlier DDQs, RFPs and meetings.
- Assign owners and review: route each section to the person who knows it best, and have compliance or legal review sensitive answers before submission.
- Plan for the deadline: confirm the due date, list who needs to contribute and leave time for review and follow-up questions.
- Keep a record: save the final version and every attachment you sent, so you can handle follow-up questions and start the next DDQ from a better place.
How XiCLOPS helps you answer a DDQ
XiCLOPS uses your own documents to fill out RFPs, RFIs and due diligence questionnaires, so your DDQ answers start from the material your firm already has. It works with Word, Excel, PowerPoint and PDF files.
You can see the source documents behind each answer, so you can check where every response came from before it goes back. Yellow highlights flag details your files do not cover, which shows you where to add information or note a gap.
Your questionnaire comes back in its original format. You can try one run free, with no card required.