Scope the error first. Honest drift — a stale answer copied from last year’s spreadsheet, a question read too fast — needs a correction. A material misstatement — a control you claimed that doesn’t exist — needs a correction plus a remediation owner and a date. Both get the same treatment; only the second changes what you attach.
The correction itself is a short note to your buyer contact: which answers were wrong, what is true today, what’s changing and by when, with evidence attached for anything already fixed. Skip the throat-clearing. Security reviewers read candor as the signature of a program that actually runs — they’ve seen every flavor of evasion and remarkably few straightforward corrections.
Silence, meanwhile, has a mechanism for failing. Questionnaire answers get folded into contracts as security exhibits and representations, and buyers re-verify — cross-checking answers against your SOC 2 report, requesting evidence on high-risk rows, re-running the assessment annually; their side of the process is the vendor security review. A mismatch they find reads as misrepresentation even when it began as a typo, and a wrong answer discovered after signature is a breach-of-contract conversation instead of an email.
Wrong answers almost always come from the same factory: whoever had a free afternoon, copy-pasting from an old spreadsheet nobody re-verifies. The fix is structural — one source of truth wired to your live compliance program, and human verification before anything ships to a buyer. That’s the model behind Agency’s security questionnaire services; and if sheer volume is the real problem, questionnaire fatigue is its own page.
Correct it anyway, to the same contact, with remediation status attached. Most security exhibits contemplate updates, and counterparties handle a volunteered fix quietly. A misstatement they discover later — during an incident, an audit, or a renewal — is the expensive version.
Increasingly, yes: answers get cross-checked against audit reports, evidence gets requested for high-risk claims, and mature programs re-assess vendors annually. Treat every answer as one a reviewer will eventually test, because the important ones will be.
