Questionnaire Red-Flag Scanner

Scan a completed questionnaire or RFP response the way a skeptical reviewer reads it: not for what it says, but for what it avoids saying. Output a severity-ranked findings list where every finding quotes the exact language (or names the exact missing disclosure), explains why it matters, and gives the follow-up question to ask.

Why this skill exists

Questionnaire responses are written by the respondent's sales, proposal, or investor-relations team and their counsel, and they are very good at producing answers that are technically responsive and substantively empty. The tells are systematic: passive voice around incident or compliance history, "from time to time" hedges, a data-retention policy that never mentions backups, a business-continuity answer that never states a recovery time, a quality-control answer that describes the process but not the failure rate, key-person questions answered with org charts. A human reviewer skimming 80 pages misses these; a systematic scan against a checklist of standard disclosures doesn't. This skill is the systematic scan — it ranks what it finds so the human spends time on what matters.

Inputs

Required:

• A completed questionnaire, assessment, application, or RFP response (PDF, document, spreadsheet export, or pasted text)

Optional (enables the cross-document consistency check — the highest-value finding type):

• The respondent's pitch deck, proposal, sales collateral, website copy, or marketing one-pager
• Third-party attestations, certifications, or audit reports the respondent references (or tell the skill to pull public registrations, licenses, or filings via your AI's web search where the respondent is in a regulated industry)
• A prior version of the same questionnaire — enables a "what changed" diff
• The user's own questionnaire standard, scoring rubric, or pet questions

Missing-input behavior: The questionnaire alone is enough to run. If no comparison materials are provided, run the scan and note that the cross-document consistency section was skipped. Don't ask for anything unless the questionnaire itself is unreadable or clearly partial — in that case ask once which sections exist.

How it works

1. Map the document. List the sections present and immediately note standard sections that are absent (see the disclosure checklist in step 4).
2. Evasiveness pass. Flag answers that are vague, deflecting, or non-responsive. Tells: passive voice where an actor matters ("incidents are addressed promptly" — by whom, and how fast?), answers that restate the question, "please refer to" loops that never land, qualifiers like "generally," "typically," "from time to time," "we are not aware of," "industry-standard," "as appropriate," answers conspicuously shorter than neighboring ones, "N/A" where the question clearly applies, and boilerplate where specifics were asked.
3. Internal consistency pass. Cross-check the questionnaire against itself: headcount vs. team bios, customer counts or revenue in one section vs. another, stated capabilities vs. described controls or limits, subcontractors or service providers named inconsistently, certification dates that don't line up with the claimed scope, dates that contradict each other.
4. Missing-disclosure checklist. Verify the document substantively addresses, at minimum, the core items below and the type-specific additions that apply. Each item is answered / partially answered / absent.
   • Core (any questionnaire): regulatory actions, enforcement history, and material litigation; incident history (security breaches, safety events, quality failures, service outages, restatements, recalls — whichever applies) with dates and remediation; named policy owners including who can override the policy; key-person dependence, succession, and staffing continuity; conflicts of interest and related-party arrangements; subcontractors and critical third parties; business continuity and disaster recovery with stated recovery objectives; cybersecurity posture and who owns it; compliance or quality staffing and whether that role is dedicated; identity of auditors, certifiers, or assessors and any recent changes; insurance coverage; financial stability.
   • Security / IT vendor questionnaire: data classification and handling, encryption at rest and in transit, access control and privileged-access review, subprocessors and data location, vulnerability management and penetration-testing cadence, breach-notification commitments.
   • Supplier / manufacturing assessment: quality certifications and their scope, capacity and lead times, single-source components, labor and ethics standards, environmental compliance, change-notification obligations.
   • Grant application / nonprofit assessment: governance and board oversight, budget detail and indirect-cost basis, prior grant outcomes and reporting history, financial controls, program measurement.
   • Investor questionnaire: valuation policy including who values hard-to-value assets and who can override, preferential terms given to other investors, expenses charged to the vehicle vs. the manager, counterparty arrangements.
5. Cross-document consistency pass (if materials provided). Compare questionnaire claims against the deck, proposal, website, and attestations: performance or results characterizations, size and scale figures, team size and tenure, capacity statements, capability and certification claims, customer logos. Quote both documents wherever they disagree.
6. Severity-rank everything and write the findings report.

Output format

# Questionnaire Red-Flag Scan — [Respondent / Organization]
Document: [title, date/version, questionnaire type] | Comparison materials: [list or "none"]
Sections covered: [list] | Standard sections absent: [list]

## Summary
[3–5 sentences: overall responsiveness, the 2–3 findings that matter most,
and whether the pattern suggests sloppiness or deliberate opacity.]

Findings: [N] HIGH / [N] MEDIUM / [N] LOW

## HIGH severity
### H1. [Short title]
- **Location:** [section / question number / page]
- **Exact language:** > "[verbatim quote]"  — or — **Missing:** [the disclosure that should be here]
- **Why it matters:** [1–3 sentences]
- **Possible benign explanation:** [1 sentence — there often is one]
- **Follow-up to ask:** "[specific question]"

[Repeat per finding; same structure for MEDIUM and LOW.]

## Cross-document inconsistencies
| Claim | Questionnaire says ([loc]) | Other doc says ([doc, loc]) |
|---|---|---|

## Disclosure checklist
| Standard disclosure | Status | Note |
|---|---|---|
[answered / partial / absent for each checklist item]

## Follow-up question list (consolidated)
[All follow-ups in one copy-paste-ready block, ordered by severity.]

Severity scale — HIGH: missing or evasive on compliance or incident history, on the hard case for the questionnaire type (data handling for a security questionnaire, quality failures for a supplier, valuation of hard-to-value assets for an investor questionnaire, financial controls for a grant), conflicts, key-person, or a direct contradiction with other documents. MEDIUM: vague on material operational items, internal inconsistencies, boilerplate where specifics were asked. LOW: sloppiness, stale dates, minor gaps.

Guardrails

• Quote exactly. Every finding about language must reproduce the language verbatim with its location. No paraphrased accusations.
• An absence is a finding, not an allegation. "The response does not disclose X" is correct; "the vendor is hiding X" is not. Always offer the benign explanation where one plausibly exists.
• Never fabricate document content, question numbers, or quotes. If text extraction from a PDF or spreadsheet is uncertain, say so and flag the section for manual reading.
• Fact vs. inference: the quote is fact; the interpretation is inference — keep them visually separate in every finding.
• This is a document scan, not full due diligence. It does not replace reference checks, certification verification, site visits, penetration testing, financial review, or background checks, and it is not a purchase, award, partnership, or investment recommendation.
• Confidentiality: completed questionnaires are confidential and often submitted under NDA. Remind the user to handle the scan output under the same restrictions as the source document.

Quality checks

• Every language-based finding has a verbatim quote and location
• Every absence-based finding names the specific standard disclosure
• Each HIGH finding includes a possible benign explanation
• Every checklist item has a status
• Every finding has a concrete follow-up question
• No claim about other documents without a quote from that document

Example prompts

"Attached: the completed security questionnaire from the payroll vendor we're evaluating, plus their sales deck. Scan the questionnaire for red flags — especially incident history and subprocessor disclosures — and check whether anything in it contradicts the deck. Rank findings by severity and give me the follow-up questions for Thursday's vendor call."

"Here are the three RFP responses for our district's student-information system. Scan each for evasive answers and missing standard disclosures, and tell me which one has the most 'please refer to' loops."

"Grant application from a community health nonprofit, plus their last two annual reports. What's missing on governance and financial controls, and does the budget line up with what the annual reports say?"

"Completed investor questionnaire from a fund manager, plus their pitch deck. Scan for red flags — valuation policy and compliance history first — and flag any contradictions with the deck."

Works well with

Run counterparty-diligence for the broader picture once the scan has surfaced what to ask; contract-obligations-extractor when the relationship moves to paper. If you are the one answering questionnaires, questionnaire-response-drafter is the other side of this skill.