One fact per entry, not one questionnaire per entry
The tempting way to build a library is to keep every completed questionnaire and search them when the next one arrives. It fails within a year: the same fact exists in a dozen wordings, some of them out of date, and the search finds the wrong one at the wrong moment. Build the library around facts instead. "Access rights are reviewed quarterly by the IT lead; the results are kept in the ticketing system" is one entry, and it answers the access review question in every questionnaire you will ever get.
Write each entry in a neutral voice that fits any questionnaire, then let the questionnaire's row be drafted from it in that row's own words.
An owner and a date on everything
Every entry has a person who can say whether it is still true, and a date it was last confirmed. This is the difference between a library and a folder. When the owner leaves, the entries move to someone. When the date passes, the entry is checked. Without the two, you will send a customer an answer that describes how things worked two reorganisations ago, and you will not know it until they ask.
Evidence lives next to the answer
Reviewers ask for the policy, the certificate, the test summary. Attach each to the entry it supports, and give it its own expiry: the ISO certificate expires on a date, the penetration test report is stale after a year, the insurance certificate renews annually. Then a questionnaire that asks for the certificate gets the current one, and an expired certificate is a warning in your library before it is a question from a customer.
Import what you already have, then prune
Most teams start with completed questionnaires and a folder of policies. Import them, and then spend an afternoon pruning: merge the thirty wordings of one fact into one entry, delete the ones nobody can vouch for, mark the ones that need an owner. A smaller library you trust beats a large one you search nervously.
A routine, on a calendar
The library stays true because someone looks at it on a schedule. A workable routine: every entry whose date has passed is reviewed within the month; every completed questionnaire is read back into the library the week it is sent, so the answers you improved under deadline pressure are the answers you keep; twice a year, the owner reads the whole library end to end and merges what has drifted apart.
What a tool should do for you here
The routine is where teams give up, because it is bookkeeping. Responsemate's knowledge base puts a date and an owner on every entry, file and link, flags what has expired, runs a nightly cleanup that finds duplicates and contradictions, reads approved questionnaires back in, and suggests what is missing based on the questions you keep getting. How the knowledge base works.
Questions people ask
How many entries should an answer library have?
Fewer than you think. A few hundred facts cover most of what any security questionnaire asks. A library with three thousand entries usually holds the same fact thirty times in thirty wordings, and nobody knows which one is current.
Who owns the answer library?
One person, usually whoever coordinates questionnaires, with the specialists as reviewers of their own areas. Shared ownership means no ownership, and the library goes stale within two quarters.
How often should answers be reviewed?
On a date, not on a feeling. Certificates and test reports on their expiry date; headcounts and tooling twice a year; policies when the policy changes. The library should tell you what is due, not the other way round.