Ask a security team where their wrong questionnaire answers come from and you rarely hear about someone making something up. You hear about answers that were true when they were written. The backup policy changed from daily snapshots to continuous backups. The penetration test vendor changed. The company moved its primary region. The answer in last year's spreadsheet did not move with it, and it was copied into this year's spreadsheet because it looked finished.
We call this answer drift: the slow divergence between what your security program does and what your questionnaire answers say it does. It is the most common accuracy problem we see, and it is almost invisible until a customer's auditor asks for evidence and the evidence says something different.
How drift starts
Drift starts with a reasonable shortcut. A team answers a 250-question SIG Lite, gets it accepted, and saves the file. Three months later a new customer sends a CAIQ. Half the questions are the same idea in different words, so someone opens the old spreadsheet and copies answers across. The copy is faster than reading the policy again, and it is usually right.
Usually is the problem. Each copy carries the answer forward without carrying its source. After two or three hops, nobody can say which policy paragraph an answer came from, or whether that paragraph still exists. The spreadsheet has become the source of truth, and the spreadsheet has no owner and no review date.
Four signs you have drift today
- Two answers to the same question in different questionnaires disagree, and both were approved.
- An answer mentions a tool, vendor, or region your team stopped using.
- Nobody can name the document behind an answer without searching for it.
- Your policies were revised this year, but your answer library was not.
If any of these sound familiar, the fix is not a better spreadsheet. It is changing what an answer is attached to.
Habit one: every answer points at evidence
An answer without a source is an opinion with good formatting. The single most effective change a team can make is to require that every approved answer cite the specific passage that supports it: not the policy, the paragraph. When the paragraph changes, you can find every answer that depended on it. When a reviewer approves an answer, they are confirming that the text and the evidence agree, which is a much faster and more reliable check than recalling whether something is still true.
This is the rule Attestloom is built around. A drafted answer that cannot be tied to a verbatim passage is withheld, and a question with no supporting passage is left as Needs owner with the reason. That sounds strict, and it is. It is also what makes approval fast: the reviewer reads one highlighted sentence instead of investigating.
Habit two: evidence has owners and review dates
Policies drift too, just more slowly. A source that nobody owns is a source nobody updates. Give each document in your evidence set a named owner and a review date, usually twelve months out, and look at the list of overdue sources before you start a large questionnaire. Five minutes of triage there prevents a day of corrections later.
This also changes conversations with engineering. Instead of asking an architect to re-answer forty questions about hosting, you ask them to confirm one architecture note is still accurate. Every answer that cites it inherits the confirmation.
Habit three: approvals feed a reviewed library
The old spreadsheet was a library of sorts, just an unreviewed one. Replace it with a library of approved answers that keep their citations and a last-reviewed date. When a new questionnaire asks a familiar question, the library answer is a starting point that can be checked against its sources in seconds, rather than a block of text copied on faith.
Libraries drift as well if nobody looks at them, so treat library entries like sources: when the underlying passage changes or is deleted, the entry should be reviewed before it is reused.
What this costs, and what it saves
Teams worry that citing everything will slow them down. In practice the opposite happens after the first two or three questionnaires. Drafting from cited evidence removes most of the writing, and approval becomes a reading task. Our design partners spend their time on the handful of questions that genuinely need judgment, such as contractual commitments or roadmap items, instead of retyping encryption answers.
Drift is not a people problem. It is what happens when answers are stored without their evidence. Attach the evidence, give it an owner, and review what you approve. The answers stay true because they are checked against something that is.
Keep reading
See it work on a sample questionnaire in the live demo.