Why enterprise reviewers reject your “Yes” answers

A bare affirmative is not an answer to a control question. It is a claim with no evidence attached, and experienced reviewers treat it as a gap.

The pattern

Open any completed CAIQ that came back with follow-up questions and you will find the same shape repeated: a column of “Yes”, occasionally “Yes, we do this”, spread across two hundred rows. It is the fastest way to fill the form and the slowest way to close the deal.

The reviewer on the other side is not checking whether you typed the word yes. They are assembling a file that has to survive their own audit. A bare affirmative gives them nothing to put in it, so they send the row back — and every returned row costs days.

What a reviewer is actually doing

A vendor-security reviewer has a queue. They are not reading your answers for truth; they are reading them for evidence they can cite later. The question behind every question is: if my own auditor asks why I approved this vendor, what do I point at?

“Yes” points at nothing. “Yes — AES-256 at rest, per our SOC 2 Type II §CC6.1, report dated 2026-03-14” points at a document, a section, and a date. The second answer is not longer because it is padded. It is longer because it contains the three things that make it usable.

The three things every strong answer carries

A mechanism. Not that the control exists, but what it is. “Access is restricted” is a restatement of the question; “role-based access enforced through Okta groups, reviewed quarterly” is a mechanism.

A source. The document the claim comes from, named precisely enough that the reviewer can find it. A section reference beats a document title.

A date. Controls drift. An undated claim silently invites the reviewer to assume it describes today, which is exactly the assumption that turns into a finding later.

Where this bites hardest

The rows most likely to get a bare yes are the ones you are most confident about — encryption, MFA, backups. Confidence is why they get short answers, and shortness is why they get returned. The obscure rows get careful treatment precisely because nobody is sure.

Our own draft-grade audit flags any answer under twelve characters that ends in yes or no, because that single pattern accounts for a large share of returned rows and it is trivially detectable before the form ever leaves your hands.