Quietly answering this year's questionnaire with last year's policy

Nothing in a questionnaire asks how old your evidence is. That is exactly why stale citations survive all the way to the reviewer.

The quiet failure

You keep a folder of answers from the last questionnaire. It saves hours, and most of it is still true. Somewhere in it is a policy excerpt from a document superseded fourteen months ago, and nothing on the form will ever ask about that.

This is a derived-artifact problem: an answer is a copy of a source, and the copy has no mechanism tying it to the original. Copies do not notice when their source changes. People do not notice either, because a stale answer looks exactly like a fresh one.

Why it survives review — until it doesn't

Stale answers usually pass. They describe controls that mostly still exist, in language that reads fine. The failure surfaces later and worse: during a renewal, an incident review, or the reviewer's own audit, when someone finally compares the answer against the report attached to the same submission and finds the dates do not line up.

At that point the problem is no longer a wrong control description. It is a documented instance of your organisation asserting something it could not support, in writing, to a customer.

The check that is worth automating

Every cited source has a date. Every questionnaire references a specific SOC 2 period. If a citation predates the report the form is about, that answer needs a human to look at it — regardless of how confident the wording is. Confidence is not correlated with freshness, and high-confidence stale answers are the ones that slip through.

Our pipeline flags these unconditionally for this reason. A confidence score describes how well text matched, not whether it is still true.

Doing it without a tool

Put an effective date next to every reusable answer in your library, and record which document it came from. When you reuse the answer, compare that date against the report you are submitting. It takes seconds per row and it is the single highest-value hygiene habit in questionnaire work.

If a date is missing, treat the answer as unusable rather than as probably-fine. An undated claim is the one you cannot defend later.