each customer has a different questionnaire, how do I avoid duplicate work

The same question comes back in four different guises

The bank calls it "vendor risk", the customer in the automotive industry calls it "supply chain due diligence", the insurer calls it "subcontractor policy" — and yet all three are asking the same thing: does the enterprise have liability insurance, and who is the statutory director. The questionnaires differ in wording, order and sometimes language, but the underlying set of facts is small. Whoever starts fresh with each list is in reality doing the same investigative work over and over on: the legal name of the company looking up, the registration number getting it out, checking whether the ISO 9001 certificate is still valid.

Clarity does not arise from a better spreadsheet per customer, but from one source file per fact, regardless of which customer is asking for it. A change — a new office location, a renewed certificate, different turnover after the fiscal year — then automatically feeds through into every list that uses that fact, instead of someone manually checking which of the thirty documents still contain the old address. Supplia works on that principle: one supply chain file with the facts, and for each incoming list a proposal of which answer goes with which question. The entrepreneur confirms, amends or rejects — nothing is automatically sent and nothing is automatically declared "true".

Why the question keeps touching on the same fact

That different frameworks ask for the same underlying data follows from how they are structured: the EFRAG VSME basic module for unlisted SME enterprises and the annex to Directive (EU) 2022/2464 (CSRD) work with comparable categories — identity, size, locations — that also appear in bank questionnaires and purchasing terms. The same is equally visible in cyber questionnaires: both the Annex A measures of ISO/IEC 27001 and the ten measures of article 21(2) of Directive (EU) 2022/2555 (NIS2) address topics such as access control and incident response, each in its own wording but covering the same set of facts. Once you have documented one fact and where it stands, you do not need to recognise that connection every time again.