Our customer has amended the questionnaire, do we need to start over

No, only the new or modified questions are relevant

If a customer sends a new version of his questionnaire halfway through the year, you don't start over. The answers you already had — for example about the registration number or the number of employees — come from your supply chain file and don't change automatically just because the format changes. The system recognizes per question whether that has been answered before, even if the wording differs slightly. Only questions that are truly new, or that ask for a different type of evidence than before, need to be reviewed again.

Changes usually come from three directions. The customer can switch from his own question set to a standardized one, such as the basic module of the VSME — the voluntary EFRAG standard for non-listed SMEs. Or he implements a new legal obligation that rests on him, such as the ten measures of Article 21(2) of the NIS2 Directive, and then passes those on in his own questionnaire to suppliers. Or he simply asks for more detail, for example not just "do you have an information security policy" but a reference to specific control measures from Annex A of ISO/IEC 27001. In all three cases: the file remains the source, the questionnaire is only the format in which that source is displayed.

Why the file stands apart from the format

This follows from how the response side is set up: one supply chain file with facts, from which a selection is filled in per questionnaire. A changed format from the customer — whether that follows from the CSRD Directive (2022/2464) that tightens his own reporting obligations, or from an internal adjustment of his portal — changes nothing about the underlying facts, such as the sector or the countries where the enterprise has establishments. What changes is only which questions from that file are retrieved and in what form.