What if my security questionnaire answers were wrong?

Scope the error first. Honest drift — a stale answer copied from last year’s spreadsheet, a question read too fast — needs a correction. A material misstatement — a control you claimed that doesn’t exist — needs a correction plus a remediation owner and a date. Both get the same treatment; only the second changes what you attach.

The correction itself is a short note to your buyer contact: which answers were wrong, what is true today, what’s changing and by when, with evidence attached for anything already fixed. Skip the throat-clearing. Security reviewers read candor as the signature of a program that actually runs — they’ve seen every flavor of evasion and remarkably few straightforward corrections.

Silence, meanwhile, has a mechanism for failing. Questionnaire answers get folded into contracts as security exhibits and representations, and buyers re-verify — cross-checking answers against your SOC 2 report, requesting evidence on high-risk rows, re-running the assessment annually; their side of the process is the vendor security review. A mismatch they find reads as misrepresentation even when it began as a typo, and a wrong answer discovered after signature is a breach-of-contract conversation instead of an email.

Wrong answers almost always come from the same factory: whoever had a free afternoon, copy-pasting from an old spreadsheet nobody re-verifies. The fix is structural — one source of truth wired to your live compliance program, and human verification before anything ships to a buyer. That’s the model behind Agency’s security questionnaire services; and if sheer volume is the real problem, questionnaire fatigue is its own page.