The bank has sent an information security questionnaire: how valuation companies answer it

Banks audit the valuation companies they use as part of their own risk management. The most common tool is an information security questionnaire, together with data privacy questions, running to hundreds of items. Most questions are similar from bank to bank; even so, the answers are written from scratch every time, in a last-day rush.

The hardest headings in an information security questionnaire

• Whether multi-factor authentication is mandatory for all users and for remote access
• How quickly a leaver’s access is closed, and the record of it
• Whether backups are encrypted and kept off site, and the date of the last restore test
• The frequency of penetration tests and vulnerability scans, and how long findings take to close
• How bank data on appraisers’ personal devices is protected

We prepare an evidence file, not just answers

We group the questions by control heading and keep, for each control, a single standard answer with its evidence attached (a screenshot, a report, a policy clause). When a new questionnaire arrives, the work comes down to matching its questions to the headings in that file.

The questions you cannot answer “yes” to become the input for an improvement plan. Being able to put a date next to the answer “planned” leaves a far stronger impression on the bank than leaving it blank.

This approach also overlaps largely with preparing for the CMB’s information systems regulations; the same evidence file serves two audits at once. See our Real Estate Valuation page for details.