Send supplier questionnaires, chase them automatically, and get an AI review of every answer
Most supplier due diligence dies in an inbox. You email a spreadsheet, the vendor half-fills it, someone chases twice and gives up, and six months later the auditor asks for the assessment record. ISO-STANDARD.app runs the whole cycle — unique access codes, a save-and-resume vendor portal, automatic reminders and an AI review of what came back.
The problem with questionnaire-by-email
Supplier assessments fail for operational reasons, not technical ones. The spreadsheet goes to one person who leaves. Progress cannot be saved, so it gets done in one rushed sitting or not at all. Chasing is manual, so it stops. And when the answers finally arrive, nobody has time to read 90 responses closely enough to spot the ones that quietly say "no".
The result is a folder of half-completed forms that satisfies neither ISO 27001 A.5.19– A.5.23 nor your own risk appetite — and offers no defensible audit trail of who was asked what, and when.
How the assessment cycle runs
1. Pick or build the question set
2. Send a unique access code
3. They save progress and submit
4. Reminders run without you
5. AI reviews the submission
6. The record becomes evidence
What changes on day one
What the AI review gives you
The review is written for the person who has to make the risk decision, not for a scoring engine. For each submission it highlights:
- Answers that assert a control exists but offer no evidence to support it.
- Vague or hedged responses that need a specific follow-up question.
- Gaps against the control the question was written to test.
- Practical improvements the supplier could make — useful to send back verbatim.
- The themes worth escalating before you sign or renew.
You stay the decision maker. The review removes the reading burden that makes supplier assessments get rubber-stamped.
The artifacts buyers actually ask for
Every artifact below is generated inside the workspace, versioned, timestamped and shareable via a signed link — no last-minute PDF assembly, no "wait, which version did I send them?"
Who it's for
Pain: Due diligence happens when a customer asks about it, and only then.
With ISO-STANDARD.app: A repeatable cycle that runs on reminders instead of willpower.
Pain: The auditor wants evidence that critical suppliers were assessed and reviewed.
With ISO-STANDARD.app: Every assessment, review and reassessment date is in one register.
Pain: Each client has a different questionnaire and no way to track responses.
With ISO-STANDARD.app: Reusable question sets per workspace, with the same portal and reminder flow.
Answers buyers, procurement and auditors want
How do suppliers access the questionnaire?+
They receive an email containing a unique, single-vendor access code. The link opens their assessment directly — no account to create, no password to remember, and no access to anything else in your workspace.
Can a vendor save a part-finished questionnaire?+
Yes. Answers are saved as they go, so a supplier can gather evidence internally, come back with the same code and submit when the assessment is complete.
What does the AI review actually do?+
When an assessment is submitted, it is reviewed automatically and returns plain-English comments: which answers are weak or evasive, which evidence is missing, and the specific follow-up questions worth sending back before you accept the risk.
Do I have to write the questionnaire myself?+
No. A SIG-lite style baseline covering access control, encryption, business continuity, sub-processors, incident response and AI use ships with the product. You can edit it or build your own question set per vendor tier.
How are suppliers chased?+
Reminder emails go out automatically on a schedule until the assessment is submitted, and you are notified the moment it lands — so nobody has to keep a chasing spreadsheet.
Which controls does this evidence?+
Supplier assessment records map to ISO 27001 A.5.19–A.5.23, SOC 2 CC9.2 and GDPR Article 28 obligations on processors and sub-processors.
Related
See the wider vendor risk workspace and supplier due diligence. Read the TPRM programme guide and vendor trust & third-party risk. Pair it with automated posture checks on your own systems.
Stop chasing suppliers by email
Send the questionnaire, let the platform chase, and read an AI review instead of 90 raw answers.
Prefer a conversation? Email hello@iso-standard.app — a practitioner responds within one business day.