What I'm familiar with is that you would write into any business contracts signed with that vendor that all of the [insert scoping modifier here] representations the vendor has made are truthful or else the customer may cancel the contract and seek [consequences of contract violation]. Just make sure the scope includes that security questionnaire.