Guide · Assessments
How to send a security questionnaire to a vendor
Sending a questionnaire has two halves: building the set of questions you want answered, and launching it as a trackable assessment against a specific vendor. Here is how both work on RiskBee.
Last updated: 2026-08-28
From draft to sent
1. Build or reuse a questionnaire
In Questionnaire Studio, add questions "From library," as a custom question, or let AI populate or draft them for you. Organise them into sections, mark items required, add notes, and set conditional show-when logic so irrelevant questions stay hidden. The questionnaire itself moves through Draft → Published → Archived status as you work on it.
2. Share it across clients (optional)
If you manage several clients, toggle "Share with all my client workspaces" on a questionnaire to make it reusable instead of rebuilding the same template per client.
3. Launch a new assessment
From a vendor record, open "New assessment." Pick the vendor, an optional questionnaire template, a title and type, a due date, the vendor contact's name and email, and an optional custom message. You can also turn on recurring re-assessment (monthly, quarterly, biannual or annual) so the same vendor gets re-surveyed automatically.
4. Send it
With "Send email now" on, submitting creates the assessment and emails the vendor contact a secure link. No account or password is required on their end.
What the vendor sees
The vendor opens the link in the email and lands on a token-authenticated response flow - no RiskBee login required. They move through verification, certifications, vendor info, and the questionnaire itself, uploading evidence as they go. Answers and evidence save incrementally, so they can leave and come back without losing progress. When they submit, the assessment locks and moves into your internal review queue.
Reviewing what comes back
Submitted assessments land on the review screen, where you can approve, reject with a reason, or request more information from the vendor. Approved answers and evidence feed straight into the vendor's risk score - see how vendor risk and health scoring works for how that happens.