Find an Evidence Owner When an RFP Requests an Unlisted Attestation

An RFP due in three days asks you to attest to a control your firm has never certified in writing, something like continuous monitoring of a named vendor risk tier or a specific encryption standard for data at rest. Nothing in the response library covers it. The deadline is close, the coordinator wants a checkbox filled, and someone on your team will offer to write two sentences that sound plausible and let security clean them up later. That is the moment your real job starts. You are not there to answer the question yourself. You are there to find out who can answer it, and to say plainly what you know today and what you do not.

Why this conversation goes wrong

Most RFP teams are built to produce words, not to stop and ask who owns a claim. Under deadline pressure, a writer sees a gap and treats it like a drafting problem. They pull language from an adjacent policy, soften a sentence until it technically avoids a lie, and move on to the next question. Nobody signed off on it, but it reads fine, and reading fine is often mistaken for being true.

The deeper issue is that silence gets treated as agreement. If a field goes unanswered until the night before submission, someone will fill it rather than flag it, because an empty cell looks like a failure and a filled one looks like progress. A coordinator asking for two quick sentences is not being unreasonable. They are doing their job, which is to get the document finished. Your job is different. You are the person who has to be able to explain, months later, where every attestation in that RFP came from and who approved it. That difference in job description is exactly why this conversation feels tense. You are the one person in the room whose incentive is not to finish the sentence.

Get the facts before you talk to anyone

Before you respond to the coordinator or the writer, get specific about what was actually asked. Write down the exact wording of the question, the format the prospect wants the answer in, the submission deadline, and any definition the prospect supplied for terms like continuous monitoring or encryption at rest. Prospects often define these terms narrowly, and a generic answer can miss their definition entirely.

Then search the approved response library for anything related. You may find a policy that covers a similar control at a different scope, or a past answer to a similar but not identical question. Note what you find, but do not stretch it. A data retention policy is not a data destruction attestation. A vendor onboarding checklist is not a vendor monitoring attestation. If you catch yourself thinking this is close enough, stop and treat that as the gap you need to escalate, not the gap you just closed.

Identify who actually owns the control in question, usually someone in information security, compliance, or operations, and send them the exact question along with the deadline. Ask two things. Does approved language already exist somewhere outside the response library. If not, can they produce a short attestation before your deadline, or do you need to raise a clarification question with the prospect instead. This same discipline, separating what a policy covers from what an RFP question is actually asking, comes up constantly in adjacent situations, including how you handle a request about an operational exception, which is covered in Set the Right Boundary for an RFP Question About an Operational Exception.

What to say when someone pushes for a fast answer

The coordinator says, "Can you just draft two sentences now. Security can fix the wording tomorrow if it needs it."

You say, "I cannot put a control statement into the response without an approved source behind it. I have pulled everything related from the library, and none of it actually answers this question. I have already sent it to the security owner with the deadline attached. I will know by tomorrow morning whether approved language exists or whether we need to submit a clarification question instead."

The coordinator says, "We do not have room for a clarification question on this one. The prospect wants a direct answer in the table."

You say, "Understood. If the owner cannot confirm approved wording by tomorrow morning, I will mark the field as pending review rather than leave it blank or guess at it, and I will flag it to you and to the account lead before submission so nobody is surprised by it."

Notice what did not happen in that exchange. You did not argue about whether the coordinator's request was reasonable. You did not promise language you had not seen approved. You gave a specific next step and a specific time it would happen by, which is usually enough to get a coordinator to back off, because now they have something concrete to work with instead of a flat no.

Mistakes that turn a gap into a bigger problem

The most common mistake is letting a blank field or a vague status note imply an answer that was never confirmed. If your status tracker just says pending, someone assembling the final document may read that as low risk and submit around it without checking back. Write the status so it cannot be misread, naming the exact question, the evidence owner, the deadline you gave them, and what happens if that deadline passes.

A second mistake is treating a related policy as if it were the attestation itself, because it saves you from an uncomfortable conversation with the security owner. This is the same trap covered from a different angle in the discussion of building a nonstandard exhibit, where a document that looks close enough to what was requested still needs its own sign off, as described in Building a Nonstandard Performance Exhibit for an RFP.

A third mistake is escalating too late, after the writer has already drafted something and the deadline is hours away. At that point, the owner you ask for approval will feel rushed into a yes, which defeats the purpose of asking them at all. Escalate the moment you spot the gap, not after someone has already filled it with guesswork.

Practice this before the real deadline hits

The best way to build this skill is to rehearse it before a real deadline forces the issue. Give a writer a tempting partial policy document, one that covers something close to the requested attestation but not the same thing, and a coordinator character pushing for speed. The writer succeeds by naming exactly why the document does not answer the question, identifying the right owner to ask, and keeping a written trail that shows the gap was flagged rather than papered over.

A manager scoring this should reject any answer that sounds confident but has no approved source behind it, even if the wording is smooth. The goal is not a polished sentence. The goal is an accurate one, tied to someone who can stand behind it.

DealSpeak's Asset Management practice conversations include this exact scenario, so an RFP lead can run it against an AI coordinator before facing the real deadline, and a manager can review the transcript to see whether the boundary held under pressure. Run it a few times with different levels of pushback, since the coordinator's tone in a real deal rarely matches the calm version you rehearse first.

Handled this way, a missing attestation stops being a crisis and becomes a routine part of the process, one clarification question or one confirmed owner at a time. The prospect gets an honest answer on a clear timeline instead of a guess dressed up as fact. That is a better outcome for everyone still in the room after the RFP is won.