Gathering accurate client information is essential in the financial services industry.
Without reliable data and insight into a customer’s financial situation, meaningful advice becomes difficult to provide.
For this reason, using an effective method to assess client needs and goals is critically important.
This need leads directly to the Standardized Information Gathering, or SIG, questionnaire.
The SIG helps professionals quickly assess individual or business financial situations.
It enables efficient collection of relevant data needed for informed decision-making.
This blog post explores what a SIG questionnaire includes and the different types available.
It also shares practical tips for using the SIG effectively during client meetings.
What is the Standardized Information Gathering (SIG) questionnaire
The Standardized Information Gathering (SIG) questionnaire is a financial tool used by professionals to assess the current financial situation of an individual or business. It helps professionals quickly collect important data, such as income and expenses, assets and liabilities, risk tolerance levels, and more. This information allows them to make informed decisions regarding the customer’s finances.
Types of SIG Questionnaires
SIG Core questionnaire: The Standardized Information Gathering (SIG) Core questionnaire contains roughly 850 questions that address all 18 risk controls. Its goal is to provide an in-depth insight of how a third party secures information and services. Based on industry norms, it is intended to cover practically all third-party risk evaluations.
SIG Lite questionnaire: The Standardized Information Gathering (SIG) Lite questionnaire is a more condensed version of the Core questionnaire. While it still covers most, if not all, of the risk controls, it does so in fewer questions. This questionnaire should be used for customers who require less in-depth evaluation and are considered “low-risk” from a third-party standpoint.
SIG Custom questionnaire: The Standardized Information Gathering (SIG) Custom questionnaire is a tailored version of the Core and Lite questionnaires. It is used when specific customer requirements require targeted questions not covered by Core or Lite questionnaires.
This questionnaire should be used sparingly, as development can be time-consuming and costly.
Who designed the SIG Questionnaire?
The SIG questionnaire was developed by Shared Assessments, a non-profit organization led by its members. It equips third-party risk management teams with best practices, solutions, and tools to foster a secure environment for outsourcers and their vendors. Each year, members decide how the organization will evolve the SIG to meet changing industry needs.
Shared Assessments originated in regulatory and compliance-driven financial services.
However, it has expanded across industries that treat strong vendor risk management as a standard practice, including HIPAA-regulated entities.
What are the risk control categories SIG covers
As per the Shared Assessments website, SIG covers the below areas of risk
- Access Control
- Application Security
- Asset and Information Management
- Cloud Hosting Services
- Compliance Management
- Cybersecurity Incident Management
- Endpoint Security
- Enterprise Risk Management
- Environmental, Social, Governance (ESG)
- Human Resources Security
- Information Assurance
- IT Operations Management
- Network Security
- Nth Party Management
- Operational Resilience
- Physical and Environmental Security
- Privacy Management
- Server Security
- Threat Management
Tips on how to best use the SIG Questionnaire
1. Use the SIG questionnaire as a starting point for developing your own vendor assessment questionnaire. The questions in the SIG are broad and generic, so you can use them as a foundation and then customize them to fit your specific needs.
2. Keep it short and sweet – make sure that your questionnaire contains the essential questions necessary to assess your vendors’ security and compliance controls, without getting too long or repetitive.
3. Make sure that all questions are relevant to your business objectives – it is important to focus on the areas of risk that are most critical for you.
4. Allow for customization based on industry or compliance regulations – your vendors may have additional controls that you need to assess.
5. Make sure all questions are clear and concise – this will help vendors understand what is being asked and allow them to provide accurate answers.
6. Make sure the questionnaire can be completed easily – make sure it is easy for vendors to complete, so they can save time and you can get accurate responses quickly.
7. Use the questionnaire to identify gaps – use the questionnaire to help you understand where there may be gaps in your vendors’ security and compliance controls that need to be addressed.
8. Use analytics tools to analyze results – use analytics tools such as dashboards or graphs so that you can quickly identify any areas of concern.
9. Provide feedback to vendors – use the questionnaire results to provide feedback to your vendors on their security and compliance controls, so they can make improvements where necessary.
10. Review and Monitor changes in vendor risk profiles – monitor changes in your vendors’ risk profiles over time, as well as the effectiveness of the controls they have in place. This will help you ensure that your vendors are continuously improving their security and compliance posture.
Identifying potential risks associated with your business using SIG
The Shared Assessments SIG can be used to identify potential risks associated with your business, as it covers a variety of topics across multiple risk control categories. By using the, you can gain insights into areas such as access control, application security, cloud hosting services, enterprise risk management and. This will help you identify weaknesses in your current security and compliance posture which can then be addressed. Additionally, you can use the questionnaire to assess third parties who may pose a risk to your business, helping you understand their level of compliance with industry regulations and best practices. Furthermore, by leveraging analytics tools you can track changes in vendor risk profiles over time so that you can identify any areas of concern.
Benefits of regularly completing a SIG questionnaire
1. Improved security posture – by regularly completing a SIG questionnaire, you can ensure that your organization’s security and compliance controls are up-to-date and compliant with industry regulations.
2. Increased visibility into third party risks – the questionnaire helps you gain insights into potential risks posed by third parties, so you can make better decisions when selecting vendors.
3. Simplified vendor assessments – the questionnaire can help streamline and simplify your vendor assessment process, allowing you to get accurate responses quickly.
4. Improved communication with vendors – by providing feedback to vendors based on the results of the questionnaire, you can ensure that they are taking the necessary steps to improve their security and compliance posture.
5. Improved proactive risk management – by leveraging analytics tools, you can monitor changes in your vendors’ risk profiles over time, allowing for better proactive risk management.
6. Gain Better Insights into Best Practices- The questionnaire helps you understand best practices for assessing security and compliance controls. With this knowledge, you can proactively prepare to address potential threats and strengthen your security approach.
7. Cost savings – by regularly completing a SIG questionnaire, you can save time and money as it is a more efficient way of assessing vendor risk profiles than traditional methods.
Overall, the Shared Assessments SIG is an invaluable tool for organizations looking to gain insights into their security and compliance posture, as well as any potential risks posed by third parties.
Common mistakes to avoid when creating a SIG questionnaire
1. Not tailoring the questionnaire to the vendor – it is important that you tailor the questions in your SIG questionnaire to each individual vendor, making sure they are specific enough to get a comprehensive understanding of their security and compliance posture.
2. Not focusing on important topics – make sure that you cover all relevant topics in your questionnaire, such as access control, application security and cloud hosting services.
3. Ask the right questions to ensure accurate responses. Instead of vague inquiries, focus on specifics. For example, ask, “What steps do you take to encrypt data during storage and transmission?” This direct approach helps gather clear, precise information and encourages detailed answers, allowing you to assess data security practices effectively.
4. Not considering cultural differences – different countries may have different regulations, so take this into account when creating the questionnaire.
5. Not clarifying any misunderstandings – if there is any confusion around a question, make sure to provide further clarification in order to get accurate responses from the vendor.
6. Not using analytics tools – leveraging analytics tools can help you track changes in vendor risk profiles over time, allowing for better proactive risk management.
7. Once vendors complete the questionnaire, provide them with feedback to help improve their security and compliance. Address areas where they need enhancement to ensure they stay aligned with industry regulations and maintain a strong compliance posture. This proactive feedback approach supports continuous improvement and strengthens vendor relationships.
