Quick Read
SPK DDMS2000:2026 Section 10.4.13 permits questionnaires as a data collection tool but prohibits relying on completed questionnaires alone to reach Tier 2 or above due diligence conclusions without independent corroboration against sources meeting the evidence standard in Section 10.4.8. For Tier 3 findings, material answers must be verified across at least two independent sources, with at least one being a primary source such as a corporate registry or court record, since questionnaire responses constitute self-reported rather than independently verified information. Where corroboration is not obtained, organisations must document the specific reason and the residual risk created.
Why This Whitepaper Exists
A very large proportion of what organisations call “due diligence” consists of a form being sent to a counterparty, and the same form being returned, completed, and filed. The counterparty has told the organisation what it wants to know. Nobody has checked whether any of it is true.
This is not a fringe problem. It is close to the default mode of due diligence across supplier onboarding, third-party risk assessment, and counterparty screening more broadly. SPK DDMS2000:2026 addresses it directly at Section 10.4.13, and reinforces it in the evidence and source quality standard at Section 10.4.8 and in the defined term at Section 3 (Self-declaration / questionnaire). This whitepaper sets out why the standard treats questionnaires the way it does, and how an organisation builds a due diligence process that uses questionnaires properly — as one input, not the whole answer.
A questionnaire tells the organisation what the subject says about itself. It does not, on its own, tell the organisation what is true.
What the Standard Actually Says
Section 10.4.13 does not prohibit questionnaires. It is explicit that questionnaires and other self-declaration instruments are a valid data collection mechanism — a legitimate and often necessary way of gathering information a subject holds about itself, particularly information no external source can provide, such as internal policies, ownership structure, or planned activities.
What the clause prohibits is reliance on a completed questionnaire alone as the basis for a Tier 2 or above conclusion, without corroborating the material answers against independent sources consistent with the evidence standard at Section 10.4.8. Where an organisation does rely on a questionnaire response without independent corroboration, Section 10.4.13 requires it to document the specific reason corroboration was not obtained, and the residual risk this creates. The self-declaration term at Section 3 reinforces the same point in the standard's own definitions: a questionnaire is a legitimate data collection mechanism, and the information it produces is self-reported rather than independently verified.
The evidence standard at Section 10.4.8 gives this teeth by tier. For Tier 1–2, a single source — which can include a questionnaire response — is ordinarily sufficient absent a hit. For Tier 3, a material finding must be corroborated across at least two independent sources, at least one of which is a primary source, such as a corporate registry, court record, or regulatory filing, rather than secondary commentary or aggregated screening output. A questionnaire response is neither a primary source nor an independent source of the fact it asserts — it is the subject's own account. Read together, the two clauses mean a questionnaire can help an organisation identify what to check; it cannot, by itself, be the check.
What a Questionnaire Is Actually Good For
None of this makes questionnaires a poor tool. Used correctly, a questionnaire does several things well that no external database or corroborating source can replace on its own:
Surfacing information only the subject holds — internal policies, planned changes in ownership or activity, or the subject's own account of its control environment.
Establishing a documented, attributable starting position against which later corroboration can be tested — a discrepancy between a questionnaire answer and an independent source is itself a finding worth investigating.
Efficiently triaging low-tier subjects where, under the organisation's own risk appetite determination at Section 6.6, a single source is a proportionate standard.
Signalling engagement quality — how a subject answers, not only what it answers, can itself be informative, as the table below illustrates.
Reading the Questionnaire, Not Just Collecting It
A well-designed due diligence process treats the pattern of a questionnaire response as data in its own right, not only the content of the individual answers. The following patterns, drawn from the categories addressed throughout SPK DDMS2000:2026, illustrate the kind of corroboration a genuine due diligence process builds in behind a questionnaire, rather than stopping at the completed form.
Questionnaire response pattern | What it can indicate | Corroboration step |
|---|---|---|
Beneficial ownership declared but supporting documentation not provided or delayed | Structural opacity; possible shell/nominee arrangement | Corporate registry extract or equivalent primary source per Section 10.4.8 |
Boilerplate or templated answers with no subject-specific detail | Response may not have been completed by someone with genuine knowledge of the subject | Follow-up questions targeting subject-specific facts; independent source check |
Reluctance or delay in providing end-use information for goods or technology | Primary export control red-flag indicator under Section 10.7.2 | Do not proceed absent satisfactory clarification |
Declared anti-bribery or compliance controls with no evidence offered | Possible overstatement of actual control maturity | Request underlying policy documents; consider vendor-style verification per Section 10.17.4 |
Sanctions or PEP status declared as “not applicable” without explanation of basis | Self-assessment may not reflect actual screening | Independent sanctions/PEP screening under Section 10.6.2 |
Environmental, labour, or safety practices described only in general or aspirational terms | Possible absence of underlying management system | Independent audit or certification evidence per Section 10.8, 10.13, 10.14 |
This is illustrative, not exhaustive. Organisations should build their own corroboration pathways consistent with their Red Flag Response Library under Section 10.22.2, calibrated to the specific modules and subject types within their own scope determination at Section 5.2.
Building the Corroboration Layer
The practical fix is rarely to abandon questionnaires — they remain an efficient and often necessary starting point — but to design the process so a questionnaire is never the last step for anything above Tier 1. Three design choices matter most.
Tier the corroboration requirement explicitly
Decide, for each module and tier, exactly what independent source is required before a questionnaire answer can be relied upon, consistent with Section 10.4.8. This should be written into the module's own procedure under Section 10.3, not left to individual analyst judgement case by case.
Make the exception visible, not silent
Section 10.4.13 does not require corroboration in every case — it requires that the absence of corroboration be a documented, reasoned decision. A process where an analyst can simply skip corroboration without anyone noticing is not compliant, even if corroboration would have been genuinely disproportionate for that specific case.
Treat the questionnaire itself as an evidence source, not the file
The completed questionnaire, the independent sources checked against it, and the analyst's reconciliation of the two together form the case record required at Section 13.1.1 — not the questionnaire in isolation.
Common Gaps Worth Checking
A Tier 2 or above conclusion is reached and the file contains only the completed questionnaire, with no independent source referenced anywhere.
The organisation has no documented threshold for when questionnaire-only reliance is acceptable, so the decision is made inconsistently, analyst by analyst.
Questionnaire responses are accepted at face value even when they are templated, evasive, or internally inconsistent, with no escalation triggered by the pattern of the response itself.
A discrepancy between a questionnaire answer and an independently obtained fact is documented but never resolved or escalated.
How Speeki Sentinel Certification Assesses This
Certification against SPK DDMS2000:2026 tests case files directly against Section 10.4.13 and Section 10.4.8: an assessor will expect to see, for any Tier 2 or above conclusion in the sample reviewed, either independent corroboration or a documented, reasoned exception. A file that consists solely of a completed questionnaire, with no visible reasoning either way, is treated as a gap against the standard, not a matter of assessor preference.
Speeki Sentinel is the certification product through which this assessment is delivered. Adoption of SPK DDMS2000:2026, including the corroboration discipline this whitepaper describes, does not require Sentinel or certification — organisations may build and operate a conformant DDMS independently, and pursue certification separately, at any point they choose.
Speeki is an accredited certification body. For current information on the specific accreditations Speeki holds and their scope, please refer to speeki.com rather than relying on this whitepaper, as accreditation status and scope are maintained centrally and can change.
Closing Note
The questionnaire is not the problem. The problem is treating a completed questionnaire as the finish line rather than the starting point. SPK DDMS2000:2026 does not ask organisations to stop using questionnaires — it asks them to be honest, in their own documentation, about what a questionnaire has and has not established, and to build the corroboration layer that turns a self-declared answer into an evidenced conclusion.