Four steps, about a minute of setup
- Open the link from your email. It goes straight to your engagement's questionnaire. There is nothing to find from this page.
- Enter your access code. It arrives separately, usually by Teams. A link and a code that travel apart mean neither is useful on its own if a message goes astray.
- Tell us who you are. Your name and work email are recorded with your answers, so every response can be traced to the person who gave it.
- Read the confidentiality notice, then answer. Most sections take ten to fifteen minutes.
Written against your controls, not a generic checklist
Every questionnaire here is generated from the client's own control baseline, so a question exists only because a control does.
Anchored to a control
Each question names the controls it tests and shows the standard text beside it, so you can see what is being asked and why without leaving the page.
Mapped to the audit
Answers carry through to the clause, criterion, regulation or article the auditor will actually sample, rather than being re-interpreted later.
Nothing we can already answer
Questions are filtered against the records 3HUE already holds. If the answer sits in a register, a scan or a prior assessment, it is not asked.
Only what applies to you
Sections are scoped by role and the questions branch as you answer, so nobody is asked about a function they do not run.
A gap you disclose becomes a managed risk with an owner, a plan and a date. The same gap found by an auditor becomes a finding.
What the questions are mapped to
Depending on the engagement, assessments hosted here reference some or all of the following. Control identifiers are used throughout; copyrighted standard text is never reproduced.
How your answers are handled
Nothing is transmitted
Answers stay in your own browser as you type. They leave your device only when you deliberately send them back.
No accounts, no cookies
Nothing to sign up for. The pages set no cookies, run no analytics and load nothing from any third party.
Sealed on the way back
Each submission carries a cryptographic digest and authentication code, so we can confirm on arrival that nothing was altered in transit.
"Don't know" is a real answer
These questionnaires exist to find gaps, not to catch people out. A guess is worse than an honest blank.
Can't find your link?
Contact the 3HUE consultant running your engagement, or write to grc-intake@3hue.net and we will reissue it. Please do not forward a link or an access code outside your organization.
Purpose and limitations. Questionnaires hosted here support audit readiness assessments. They are not audits, certification activities or assurance engagements, and nothing collected through them constitutes an opinion, certification decision or attestation. Responses are management representations and are corroborated against independent evidence before being relied upon. Regulatory references are included to scope the work and are not legal advice. Personal data collected through an assessment is processed under the engagement between 3HUE and the client organization; the full privacy notice sits inside each questionnaire, or write to privacy@3hue.net.