Fundamentals

RFP, RFI, RFQ & DDQ: the procurement documents explained

By Gavin McFadyen7 min read

If you sell to enterprises or the public sector, four acronyms govern your pipeline: RFI, RFP, RFQ and DDQ. They arrive in a rough order, they ask for different things, and answering one as if it were another is a reliable way to lose. Here is what each one actually is.

RFI — Request for Information

An RFI is a buyer gathering their bearings. They know they have a problem; they are not yet sure what the market offers or who the credible players are. RFIs come early, they are usually short, and they are rarely scored to award a contract on their own.

Your job in an RFI is to get onto the shortlist, not to win the deal. Be clear about your capabilities, honest about fit, and easy to compare. A common mistake is treating an RFI as a full pitch — burning days on a document whose only purpose is to decide who gets the real invitation.

RFP — Request for Proposal

The RFP is the main event. The buyer has defined requirements and wants proposals they can evaluate side by side — on approach, capability, delivery, references and price. RFPs are long, often structured as hundreds of numbered requirements, and almost always scored against published criteria.

Winning an RFP is about compliance plus differentiation. First, answer every requirement in the format asked — evaluators cannot award points for an answer they cannot find. Then, within that structure, show why you specifically are the lower-risk, higher-value choice. Generic answers assembled from old bids are where most responses quietly lose their marks.

RFQ — Request for Quotation

An RFQ is about price for a well-defined scope. The buyer knows exactly what they want and is asking what it costs. RFQs dominate where the deliverable is a commodity or the specification is already fixed — hardware, licences, defined services.

Here the discipline is precision: quote exactly what was asked, make your assumptions explicit, and separate optional line items clearly so a procurement team can compare like for like. Ambiguity in an RFQ reads as risk, and risk loses on price-led buys.

DDQ — Due Diligence Questionnaire

A DDQ is the buyer's risk function checking whether you are safe to work with. It focuses on security, data protection, financial stability, compliance and operational resilience. DDQs are common in financial services, healthcare and government, and they increasingly arrive as a condition of continuing a relationship, not just starting one.

The defining feature of DDQs is that they repeat. The same questions — how you encrypt data, where it is hosted, your incident-response process — come back from every customer, in every renewal, in slightly different words. This is why a good, reusable answer library pays for itself faster on DDQs than anywhere else.

The security questionnaire: a DDQ that grew up

The most common DDQ today is the security questionnaire — standardised frameworks like the SIG or the Cloud Security Alliance's CAIQ, or a customer's own spreadsheet of a few hundred questions. They are technically a subset of due diligence, but they have become a category of their own because of sheer volume: a mid-market vendor can receive dozens a year, each one a multi-day exercise if answered from scratch.

How to respond well to all four

Match the effort to the document. An RFI deserves a crisp shortlist pitch; an RFP deserves your best work; an RFQ deserves precision; a DDQ deserves accuracy and consistency.
Answer in the format asked. Evaluators score against their own structure. Re-order, and you lose points you actually earned.
Build an answer library once. Most of what you write, you have written before. The teams that win consistently are not faster typists — they retrieve their best previous answer and adapt it.
Keep it current. A reused answer is only an asset if it is still true. Stale certifications and old architecture diagrams are how a reused library turns into a liability.

That last point — reuse without staleness — is exactly the problem modern retrieval-based AI is good at, and it is where a tool like RFPlex earns its place: finding your best, most current answer for each new question, from your own documents, without anything leaving your control.