{"id":"comp-vendor-diligence-followup-checklist","audience":"compliance","category":"legal-compliance","track":"legal","level":"intermediate","technique":"verification","title":"List follow-ups from a vendor due diligence questionnaire","free":false,"task":"Review the vendor's questionnaire answers and list only the items that need follow-up: answers that are blank, vague, or conditional. Write exactly 4 checkbox lines, in question order, each formatted like \"[ ] Q3 - what to request\" under 15 words. If an answer includes terms that counsel should read, end that line with \"Counsel to review.\" Then a last line exactly: Risk rating is for the vendor risk committee. Plain text.","materialLabel":"Questionnaire (attached to your prompt automatically)","material":"VENDOR QUESTIONNAIRE: Kestrel Data Services (fictional), received Nov 3\nQ1 Do you hold an information security certification? Yes, valid until March 2028.\nQ2 Do you use subcontractors to process our data? Some, depending on the workload.\nQ3 Any data breaches affecting customers in the last 3 years? None (checked Jan 2023 to Nov 2026).\nQ4 Do you carry cyber liability insurance? (blank)\nQ5 Where is our data stored? Frankfurt and Dublin data centers only.\nQ6 Will you allow us to audit your controls? Audit rights available on request, subject to our standard audit fees.\nQ7 Do you have a sanctions screening policy for your own customers and suppliers? Yes, a policy is in place.\nQ8 Do you test your business continuity plan? Annually, last test in June.\n\nInternal note: Kestrel's sales contact says the contract can be signed this week.","rules":[{"type":"maxWords","max":110},{"type":"plainText"}],"mistakes":[{"title":"Flagging complete answers","why":"The AI lists every question.","fix":"Say: \"Only blank, vague or conditional answers.\"","checks":["r0"]},{"title":"Vague requests","why":"The AI writes 'follow up on this'.","fix":"Say: \"Each line says exactly what to request.\"","checks":["r1"]},{"title":"Giving a verdict","why":"The AI rates the vendor or says to sign.","fix":"Say: \"Last line exactly: Risk rating is for the vendor risk committee.\"","checks":["r2"]},{"title":"Trusting the AI to count words","why":"AI is bad at counting. Ask for a total word limit and it often lands over it.","fix":"Cap each part instead, for example: \"each line under 15 words.\"","checks":["maxWords"]},{"title":"Markdown","why":"The AI bolds words or adds headings.","fix":"Say: \"Plain text, no bold, no headings.\"","checks":["plainText"]}],"promptHints":[{"label":"Checkbox format","patterns":["\\[ \\]"]},{"label":"Only gaps","patterns":["blank","vague","conditional","only"]},{"label":"Question order","patterns":["question order","q\\d"]},{"label":"Counsel to review","patterns":["counsel to review"]},{"label":"Exact last line","patterns":["vendor risk committee"]}],"hint":"Define what to flag, show the checkbox line and give the last line.","mission":"Pick out the vendor answers that need follow-up.","musts":["Only gaps and vague answers","Checkbox lines","Counsel flag on terms"],"rubricLabels":["Has exactly four lines starting \"[ ] \" for Q2, Q4, Q6 and Q7 in that order, and no line for Q1, Q3, Q5 or Q8","The requests are specific: Q2 names the subcontractors, Q4 asks for the insurance certificate, Q6 ends with \"Counsel to review.\" and Q7 asks for a copy of the policy","The last line is exactly \"Risk rating is for the vendor risk committee.\" and nothing recommends signing or rejecting the vendor"]}