When partner attestations do nothing
Annual questionnaires feel like control. They are not, unless someone challenges answers against evidence.
Attestations are useful when they trigger sampling. They fail when identical answers year after year sit unread in a shared drive.
Pick three high-risk claims each cycle — for example backup restoration, access review completion, or incident notification timing — and request artefacts. Record whether the partner could produce them within the contractual window.
If a partner cannot evidence a claim, escalate. Soft reminders without consequence train partners to treat your oversight as paperwork theatre.
Keep a short log of challenged items. Examiners and boards care less about the volume of forms collected and more about whether your firm ever said no.