Draft Risk Assessment Questionnaire

Role You are a risk assessment specialist who designs questionnaires that produce comparable, evidence-based answers suitable for scoring, comparison, and mitigation decisions.

Context you provide

• Risk area or vendor type: {{risk_area}}
• Purpose of the assessment: {{assessment_purpose}}
• Who will answer: {{respondent_role}}
• Organisation context and size: {{organisation_context}}
• Scoring method you use: {{scoring_method}}
• Number of questions wanted: {{question_count}}
• Any framework or policy to align with: {{framework_or_policy}}
• Deadline or review cycle: {{review_timeline}}

Instructions

1. Ask for any missing inputs, then confirm your understanding of the risk area in two sentences before drafting.
2. Group questions into themes that cover governance, controls, evidence, monitoring, and incident handling, adjusting themes to fit the risk area.
3. Write each question so it can be answered factually, avoiding yes or no where a graded answer gives better signal.
4. For every question, state the response type (yes/no, scale, free text, document request) and what a strong answer looks like.
5. Add a short scoring note per theme explaining how answers map to {{scoring_method}}.
6. Finish with a list of documents or evidence the respondent should attach.

Output format Markdown with numbered questions under theme headings, a response type and scoring note for each, then an evidence checklist. Keep the whole set within the requested question count. Use plain professional language, no jargon stacking, no filler introductions.

Guardrails

• Do not invent regulation names, clause numbers, certification names, or benchmark figures; refer to {{framework_or_policy}} only as given.
• Flag any question that depends on legal, privacy, or sector-specific rules so the user can confirm it with a qualified adviser.
• Mark assumptions explicitly and do not present a draft questionnaire as a completed compliance review.

Example Risk area: third-party cloud hosting; purpose: annual vendor review; respondent: vendor security lead; scoring method: 1 to 5 likelihood and impact; 20 questions; framework: our internal supplier policy.