Answering the Questionnaire Before It Arrives: A Due Diligence Library for UK Firms
Photo: Evelyn Simak , CC BY-SA 2.0, via Wikimedia Commons
Client due diligence has changed character. For many UK advisory firms, it is no longer an occasional request from a new client but a recurring condition of panel membership, framework appointment and continuing instruction. The questionnaire may arrive from a client's procurement team, an outsourced panel manager, a bank or another regulated business. It will ask for evidence on professional indemnity insurance, anti-money laundering controls, data protection, business continuity and the use of subcontractors. It may also ask for information the firm has never thought to record in one place.
The instinctive response is to assemble a pack when the request lands. That approach works until several requests arrive at once, or until the person who assembled the previous pack has left. A better response is to treat due diligence evidence as a controlled business record: indexed, owned, reviewed and shared with care.
Begin with the questions, not the documents
A due diligence library should be built around the questions clients actually ask, not around the documents the firm happens to hold. Start by collecting the last twelve months of questionnaires and panel reviews. Group the recurring requests into themes: insurance, AML and client onboarding, data protection and information security, business continuity, complaints and regulatory status, subcontractors and confidentiality.
That map becomes the index. It also reveals where the firm is repeatedly writing bespoke answers that could be standardised. The aim is not to produce a glossy brochure. It is to make the firm's position easy to verify.
One owner, one version
A due diligence library without an owner becomes a shared drive of near-identical files. Assign responsibility to a named individual, typically within risk or compliance, with support from finance, IT and the relevant practice leads. The owner is not expected to write every answer. They are expected to know which answer is current, who approved it and when it is next due for review.
Version control should be simple enough to survive a busy week. Use a consistent file name that includes the document type, the firm name and the review date. Keep a short change log showing what changed and who approved it. Where possible, store the master copy in a controlled folder and issue read-only exports to clients. This prevents a well-meaning colleague from editing the live insurance certificate or overwriting the current business continuity plan.
Evidence that proves operation, not just intention
Panel reviewers are less interested in polished policy language than in evidence that controls operate. A professional indemnity schedule should show the current period, the limit and the insurer. An AML pack should include the firm's risk assessment, the money laundering reporting officer arrangement, client identification procedures and training records. Data protection evidence may include the privacy notice, a record of processing activities, breach procedures, data processing terms and a list of subprocessors.
Business continuity deserves particular attention. A plan with no test date is a statement of hope. Include the date of the last exercise, the assumptions tested, recovery objectives and the arrangements for alternative working. For subcontractors, maintain a register showing the service provided, the due diligence undertaken, the contract in place and the confidentiality terms. Redact client names where disclosure is unnecessary.
An answer bank, not an essay bank
Many firms over-share because they are anxious to appear thorough. That creates risk. A client asking whether the firm holds cyber insurance does not need the full policy wording. A panel manager asking how the firm verifies identity does not need a list of every client ever onboarded.
Maintain approved short answers to standard questions. Each answer should be factual, dated and linked to the underlying evidence. Adopt a rule: answer the question asked, provide the document requested, and escalate anything novel. If a questionnaire asks for information that is commercially sensitive or client-confidential, offer a summary or a redacted extract rather than the full record. Record what was shared and with whom.
Review on a cycle, and on triggers
An annual review is the minimum. Between reviews, set triggers: renewal of professional indemnity insurance, appointment of a new subcontractor, a material data incident, a change in money laundering reporting officer, a new office or a significant regulatory change. Each trigger should prompt an update to the relevant section and a note in the change log.
Stale evidence is worse than missing evidence because it suggests the firm is not paying attention. A certificate that expired three months ago, or a business continuity plan reviewed before a change in premises, undermines confidence quickly.
When the questionnaire lands
Even with a library in place, each request needs an intake step. Log the client, the deadline and the owner. Map the questions to the library and identify genuine gaps. Obtain sign-off for any bespoke response. Send the material through a secure portal rather than ordinary email where sensitive documents are involved, and keep a record of what was sent. After the review, note any questions that caused difficulty. Those are the next additions to the library.
A due diligence library is not bureaucracy for its own sake. It is a modest discipline that protects the firm's reputation, reduces wasted effort and gives clients a clearer view of how the business is controlled. The questionnaire will still arrive. The difference is that the answer will already be in order.
