The delays come from unowned questions, not hard ones
Where is client data, how is access revoked, what happens at engagement end, do you use subcontractors. None is technically difficult; each lacks an owner.
Microsoft Purview · Professional Services
Client confidentiality at scale
Professional services firms are increasingly losing time at procurement rather than at pitch, and the reason is a document nobody owns internally.
Abstract
Client confidentiality at scale
Summary
A firm wins the pitch, agrees the commercials, and then receives a forty-page security questionnaire from the client's procurement team. Three weeks later the engagement is still not signed.
This paper argues that questionnaire turnaround has become a genuine competitive factor for firms handling client data, that the delays come from questions with no internal owner rather than from technically difficult ones, and that most of the underlying capability is already licensed.
Key findings
Four things this paper argues
If you read nothing else, read these. The analysis that follows sets out the evidence for each.
A standing answer set converts three weeks into two days
Maintained quarterly and owned by one person, rather than reconstructed per engagement by whoever is available.
Closing a gap beats writing carefully around it
An evasive answer will be probed. A closed gap is one sentence and does not recur.
Most of the required capability is already inside existing licensing
Conditional access, device compliance, classification, retention and audit logging are commonly held and not deployed.
Analysis
The argument in full
What changed
Clients have been through their own supply chain incidents. Their insurers now ask about third-party risk. Regulated clients have obligations that flow down to their advisers.
The questionnaire is not procurement being difficult; it is procurement discharging a duty, and it is now routine rather than exceptional for any firm handling client data.
The firms that handle it well treat it as a standing capability rather than a per-deal scramble, and a meaningful number report closing faster as a direct result.
The questions that cause delay
Not the technically difficult ones. The ones nobody has an owner for.
Where is client data stored, in which country, and can that be evidenced. How is access to client data granted, reviewed and revoked. What happens to client data at the end of an engagement. Do you use subcontractors and are they bound by the same terms. Have you tested your incident response plan, and when. What certifications do you hold and are they current.
Each is answerable in a day by a firm that maintains a current answer set, and in three weeks by one that reconstructs it per engagement from several people who each hold part of the answer.
- Client data location, per engagement and per data type, evidenced not asserted
- Access grant, review and revocation with recorded outcomes
- End-of-engagement data return and deletion, with a stated timescale
- Subcontractor use, disclosed and bound by equivalent terms
- Incident response plan tested, with a date
The three habits that work
Maintain a current answer set reviewed quarterly rather than reconstructed per deal. Make one person accountable for it. And close the gaps rather than writing careful answers around them.
The third is the one that pays. A gap answered evasively will be probed by a competent procurement team, and the probing costs more time than the remediation would have. A gap closed is a sentence and it does not recur.
The frequent finding when we run this exercise is not that the firm needs to buy something. It is that capability inside an existing subscription was never deployed, and the questionnaire is the first time anybody has been asked to demonstrate it.
Framework
Something you can apply without us
Every paper in this series ends with a framework you can run internally. We would rather you used it and reached your own conclusion than took ours on trust.
Framework
Turning a liability into a differentiator
Five steps to a two-day turnaround.
1
Collect
Gather the last five questionnaires you completed. The recurring questions are your scope.
2
Own
One named person accountable for the answer set, reviewed quarterly.
3
Audit
Establish which answers your existing licensing can already evidence. Usually more than expected.
4
Close
Remediate gaps rather than writing around them. An evasive answer will be probed.
5
Evidence
Attach the demonstration to each answer, so the response is a document rather than an assertion.
Implications
What this means, depending on your seat
The same argument lands differently across an executive team. These are the three versions worth separating.
References
Where to check this for yourself
Microsoft's own documentation for the product behaviour described above. We would rather you verified the basis than accepted our summary of it.
01
Microsoft Purview Information Protection
02
Microsoft Purview Audit
03
Microsoft Entra access reviews
04
Microsoft Purview Data Lifecycle Management
05
Microsoft Service Trust Portal
On these references: each entry names a Microsoft Learn article or documentation area by title, because deep links change while titles are stable. Searching the title on learn.microsoft.com will reach the current version. Where we have cited a figure or a product behaviour, it is Microsoft's statement rather than ours; where we have given a number of our own it is labelled as such in the text.
Recognise the situation?
Send us a questionnaire you have recently been asked to complete. We will map which answers your current environment can already evidence and what the remainder would take.
Discuss this paper Run the related checklist We reply to every message within one business day.
Keep reading
Related papers
Pipeline as a resourcing instrument
In a services firm, pipeline is a resource demand forecast. Treating it only as a revenue forecast is why delivery cannot meet the dates sales commits to.
June 21, 2026 · 13 pages · 14 min readRead
The economics of one point of utilization
Before evaluating any system, do this calculation. It usually settles the investment question faster than a vendor business case.
June 7, 2026 · 10 pages · 11 min readRead