How attestation and questionnaires work

Attestation is the process of asking a supplier to confirm or provide information about themselves directly. Senserity combines public data (from Companies House, credit agencies, media feeds, and other sources) with self-declared data from the supplier to build a more complete risk picture.

Why attestation matters

Public records are valuable but incomplete. They tell you whether a company files its accounts on time and whether its directors are disqualified. They do not tell you whether the company has a business continuity plan, whether it holds specific insurance policies, whether it complies with your modern slavery requirements, or what its internal health and safety procedures look like.

These are the kinds of things that procurement and compliance teams routinely need to know, and the only reliable way to find out is to ask the supplier. Attestation formalises that process so it is consistent, auditable, and integrated with the rest of the risk assessment.

Templates, campaigns, and questionnaires

The attestation system has three layers: templates define what you ask, campaigns organise a batch of outreach, and questionnaires are the individual requests sent to each supplier.

Templates

A template is the reusable definition of a questionnaire. It contains sections (groupings of related questions), each with one or more questions. Questions can be yes/no, single or multiple choice, free text, numeric, date, scale, file upload, or a special type that asks the supplier to confirm or correct a prefilled value.

Templates are versioned. When you update a template, a new version is created. Campaigns that were sent using an earlier version retain the original question set, so changes do not retroactively alter what was sent to suppliers.

You can build your own templates from scratch, or browse the Marketplace for ready-made templates covering common compliance areas such as general due diligence, cyber and data protection, ESG and sustainability, governance, operational resilience, and financial health. Marketplace templates can be installed and customised to suit your requirements.

Campaigns

A campaign is a specific instance of outreach. You select a template, set a deadline, choose which companies to send to, and optionally configure reminder emails. The campaign captures a snapshot of the template at the point of creation, so if the template is later modified, the campaign retains its original question set.

Campaigns have a lifecycle: they start as a draft, become active when questionnaires are sent, and can be closed or allowed to expire after the deadline passes.

Questionnaires

A questionnaire is a single request sent to a specific supplier as part of a campaign. When you send a questionnaire, the supplier receives an email with a link to a secure form where they can respond. They do not need a Senserity account to complete it.

Each questionnaire tracks its own status through the workflow: pending, sent, opened, in progress, submitted, reviewed, approved, or rejected. You can see at a glance how many suppliers have responded and where follow-up is needed.

Prefill

When a supplier opens their questionnaire, Senserity automatically prefills answers where it already holds relevant data from public sources or the company's insight results. For example, if a question asks whether the company holds Cyber Essentials certification and Senserity has already verified this through its enrichment process, the answer is prefilled with the verified data and its source attribution.

Prefilled answers are clearly marked so the supplier can see what has been populated and where the data came from. The supplier can confirm the prefilled value or correct it if they believe it is inaccurate. This saves the supplier time and reduces the burden of filling in information that is already publicly available, while still giving them the opportunity to provide context or corrections.

Prefill covers a range of data types including company details, financial metrics, governance information, compliance statuses, and certification records. The depth of prefill depends on what enrichments have been run for the company and what data is available.

Scheduling

Attestation does not have to be a one-off exercise. Senserity supports recurring attestation schedules that automatically create new campaigns at regular intervals.

A schedule links a template to a frequency (annual, semi-annual, or quarterly) and a set of companies. You can scope it to your entire watchlist or to specific companies. When the next due date arrives, a new campaign is created from the template and questionnaires are sent to the configured suppliers. You can choose whether sending happens automatically or whether the campaign is created in draft for manual review before sending.

Scheduling is useful for ongoing compliance programmes where suppliers need to reconfirm their information periodically, such as annual modern slavery attestation or quarterly information security reviews.

What you can ask

Templates are flexible. You define the questions, the response format, and any guidance notes for the supplier. Common examples include:

Insurance and certifications. Does the supplier hold professional indemnity insurance, employers' liability insurance, or public liability insurance? Can they provide certificates?

Health and safety. Does the supplier have a health and safety policy? Have they had any reportable incidents in the past 12 months?

Environmental and sustainability. Does the supplier have an environmental management system? What is their carbon reporting approach?

Information security. Does the supplier hold Cyber Essentials, ISO 27001, or equivalent certifications? What are their data protection practices?

Modern slavery and ethics. Does the supplier have a modern slavery statement? Do they conduct due diligence on their own supply chain?

You can also create bespoke questions specific to your sector, contract requirements, or internal policies.

How responses are used

Attestation responses are stored within the attestation system and can be referenced at any time. They do not appear directly on the company's risk profile page. Instead, they form a separate body of evidence that complements the automated risk assessment.

This separation is deliberate. Self-declared data is inherently different from independently verified public data. A supplier can claim to hold insurance or certifications, and that claim is useful context, but it carries a different level of confidence than a record confirmed through a public register or a third-party verification service.

The intended workflow is to use both sources together. A company's risk and insight report provides the automated assessment based on public data and enrichments. An attestation completion report provides the supplier's own responses in a structured, documented format. Together, the two reports give procurement and compliance teams both sides of the picture: what the public record shows and what the supplier says about themselves.

Where Senserity can independently verify a claim (for example, by checking Cyber Essentials certification through its enrichment process), the verified result is what feeds into the automated score. The attestation response provides the supplier's own statement alongside it.

Attestation reports

Once a supplier has submitted their responses, you can generate an Attestation Completion Report as a downloadable PDF. This report captures the questions asked, the supplier's answers, any prefilled values that were confirmed or corrected, and file attachments. It is designed to be filed alongside the company's risk report as part of your due diligence documentation.

See What the PDF report contains for how attestation reports fit into the broader reporting system.

Managing attestation

See Creating an attestation campaign for step-by-step instructions on setting up a campaign, and Sending attestation questionnaires for how to send questionnaires to specific suppliers.

Attestation is available from the Starter tier upwards.

Last updated 29 April 2026.