Security questionnaire RACI for sales, SE, security, legal, and compliance

Security questionnaires do not fail because people are lazy.

They fail because five functions share the risk and nobody shares the map. Sales feels the deadline. SE feels the architecture edge. Security feels residual risk. Legal feels contractual shadow. Compliance feels audit memory. Without a living RACI, every workbook becomes a political scavenger hunt under time pressure.

That pattern is familiar because it is rational under broken systems. People protect the deal in the moment and pay later in reconciliation. Leadership sees the later cost as a skills gap. The field sees the early pressure as survival. Both observations can be true while the object model stays wrong.

This guide stays in operator detail on purpose. You will not get a vague maturity model. You will get scenes, ownership splits, and weekly moves that change what people do when the next urgent message lands. If a recommendation cannot survive a real Friday, it does not belong here.

What does a useful RACI look like for questionnaires?

Useful means people can apply it at 4 p.m. on a deadline day without a workshop. Responsible does the draft. Accountable owns the final call for that class. Consulted is pulled for true edges. Informed sees outcomes that affect the deal.

Map by question class, not by vibes. Identity and access, data handling, subprocessors, incident response, availability, encryption, and AI feature behavior often need different accountable owners. If everything routes to “security,” security becomes a bottleneck and a blame sink.

Write the happy path and the exception path. Happy path is approved stem, light review, ship. Exception path is named approver, deal note, time box. If exception is undefined, every hard question becomes a group chat with twelve people and no decision.

RACI fails most when the primary is offline and the backup is not empowered. The slide still looks complete. The workbook still burns the weekend.

Buyers do not grade your internal effort. They grade continuity. Continuity comes from stable objects, named owners, and honest empty states. Everything else is decoration that falls off under pressure. Keep decoration out of the critical path.

What happens in this scenario: Friday workbook, Monday buyer call?

Friday at 2 p.m., a hundred-row workbook lands with a Monday noon buyer deadline. Sales forwards it to a shared inbox and pings three people. SE answers architecture rows from memory because the stem library is stale. Security is in all-day reviews. Legal sees the thread at 6 p.m. and asks for a freeze on anything contractual. Compliance wants evidence links that are not attached.

Saturday, sales stitches answers to keep the deal warm. Monday morning, security rejects three rows that already went to the buyer in draft form for “review.” The champion is embarrassed. Your internal postmortem blames “process adherence.” The real miss was no RACI with clocks: who drafts which class, who signs, what happens when accountable is offline, and which stems were supposed to prevent this scramble entirely.

A RACI that only exists in onboarding slides cannot survive Friday. It has to live next to the queue, the stems, and the escalation button.

The operational lesson is not “try harder.” It is to put ownership, objects, and clocks where the work already happens. Teams that only add training keep rediscovering the same failure under a new quarter’s logo. Teams that change the object model see fewer heroics and more boring reliability. Boring reliability is what buyers experience as trust.

When you pilot, write the failure story you are retiring in one paragraph and keep it visible to the pod. People need a shared enemy that is a systems gap, not a colleague. That framing keeps the pilot from turning into a blame exercise when someone slips. Slips will happen. The question is whether the system makes the next slip rarer and cheaper to repair.

### How should sales participate without becoming security? Sales is responsible for intake quality, deadline honesty, and not promising answers the company cannot defend. Sales is not accountable for residual security risk. When sales drafts commercial context and customer scope clearly, every other function moves faster. When sales dumps a bare file with “pls handle,” the system taxes everyone.

Train AEs to flag rows that touch live deal promises already made. Those rows are reconciliation work, not greenfield. Hiding prior promises to “get it through” creates Monday disasters.

### Where do SE, security, legal, and compliance actually differ? SE owns architecture truth and integration edges. Security owns control design residual risk. Legal owns contractual language and liability framing. Compliance owns evidence posture against frameworks and audit expectations. Overlap is normal. Unowned overlap is fatal.

Create a short conflict rule. If SE and security disagree on a control description, security is accountable for risk language and SE is consulted on feasibility. If legal and security disagree on external wording, legal is accountable for external form and security for underlying control facts. Write it down so Friday is not a personality contest.

### What tooling makes RACI real? Queue by class with visible owners. Stems with sources so responsible people are not rewriting from zero. SLA timers that page the accountable role, not the loudest AE. Audit of who changed what when a buyer challenges a row later. Chat that routes to the same owners instead of spawning a sixth dialect.

Tools without RACI become shared folders with anxiety. RACI without tools becomes a slide. You need both.

### How do you run a RACI fire drill before the bad Friday? Once a quarter, inject a sample workbook with known traps: offline accountable, conflicting stem, prior sales promise, missing evidence. Time the path. Fix the breaks you find. Drills feel artificial until they save a real deal. Teams that only learn on production pain pay in reputation.

### Where does Tribble Engage fit? We care that answers and owners show up in the same motion as the rest of the seller week. Questionnaires are not a separate planet. They are the written form of claims sales already speaks. If your RACI never connects to stems and field surfaces, you will keep paying for heroics. Engage is for teams who want the map to be executable, not decorative.

### What should you do this week? Publish a one-page RACI by question class with backup accountable names. Wire it into the intake form. Take last quarter’s worst workbook and mark where the map would have changed the path. Fix the top two breaks. Then run one drill with a real deadline simulation.

### How do backups and vacation coverage work without theater? Every accountable name needs a backup who is actually empowered. A backup who must “check with” the primary is not a backup. Publish coverage calendars for questionnaire season the same way you publish on-call. If security primary is offline Friday, the backup’s approval must stick Monday morning.

Hand off context, not just the title. The backup should see open exceptions and deal promises already made. Otherwise coverage becomes roulette.

### Multi-product and multi-entity complications RACI gets harder when the company sells multiple products or legal entities. Encode product scope on the question class map. A control true for product A may be false for product B. Entity differences matter for subprocessors and data processing terms. If the intake form does not capture product and entity, every later owner is guessing.

Acquisitions need an explicit freeze or dual-stack rule until integration of stems and owners is real. Pretending one RACI covers two unmerged stacks creates confident wrong rows.

### After-submit corrections and buyer trust When a row must be corrected after submit, RACI should define who tells the buyer and with what evidence. Silence while internal teams argue is how champions get blindsided. A clean correction path is part of professionalism. Track correction rate as a quality metric, not only as shame.

### Practice walkthrough: make Friday survivable for one workbook type Choose standard security questionnaires under one hundred fifty rows. Publish class RACI with backups. Require intake fields for product, entity, deadline, and prior promises. Pre-bind the top thirty rows to stems. Run a timed drill Friday afternoon with a real offline primary to test backups.

After the drill, fix the two slowest handoffs. The next real workbook should use the same path. Measure hours from intake to submit and count of after-submit corrections. Share the metrics with sales leadership so deadline honesty improves upstream.

If sales still drops bare files at 4 p.m., RACI cannot save you. Pair the map with intake standards and deal-stage expectations. Process without upstream discipline is cosplay.

### How SE load reveals a broken RACI When SEs answer settled identity questions daily, responsible and accountable are wrong or stems are missing. Reassign settled classes away from SE heroics. Keep SE on architecture edges. Track the mix monthly. A healthy mix is a RACI health metric disguised as staffing data.

How should you run the first questionnaire week under the new RACI?

This is the weekly operator move that makes the rest real. Pick one surface people actually open under pressure. Put the owned object there. Turn invent off for a narrow class. Sample results in public without blame. Expand only after the metric moves.

If you skip the weekly move, strategy decks accumulate and Friday still burns. The point of this section is not inspiration. It is a repeatable loop you can run without a task force. Keep the loop small enough that a manager can own it beside forecast.

When the loop works, write down what you will not do next: no new connectors, no encyclopedia sprint, no rebrand. Protect depth until belief exists. Belief is the scarce resource after a year of tool launches that did not change Tuesday.

What should you take to leadership?

If every workbook reinvents ownership, you do not have a questionnaire problem. You have a RACI problem wearing a deadline. Write the map where work happens.

### Why depth beats coverage in the first thirty days Coverage theater is comforting. Leadership likes big libraries and complete matrices. Operators like answers that work on the call in front of them. In the first thirty days, depth on a few painful classes beats shallow coverage across fifty. Depth creates belief. Belief creates adoption. Adoption creates the political capital to expand.

If you feel pressure to boil the ocean, publish the pilot scoreboard weekly. Show repair rate, escalate quality, and one qualitative deal story. Numbers without stories feel like ops trivia. Stories without numbers feel like anecdotes. Together they fund the next slice.

Resist the urge to rename the program every time you expand. Stable names help habits form. New branding every month is how teams conclude nothing is real yet.

FAQ