The risk nobody has named: a refusal you did not write down looks exactly like a question you never asked. Worst case, someone reads that file long after you have left the account, finds a questionnaire and no trace of what came back, and reads the programme as decoration.
Where I part ways with your framing: the questionnaire is not a control because the answer can be tested. It is a control because it dates what you asked, whom you asked, and what you did when nothing came back. Log the refusal, route it where a positive answer would go, and re-ask on a schedule. That would hold up.
Soo-jin, you have caught me grading the questionnaire against the wrong exam, and it is a distinction I teach. The real issue here is what the file proves, and a refusal nobody wrote down proves nothing, whichever document the question sat in.
Two things I would still keep apart. First, your dated log protects how the programme reads, because BIS weighs a programme's adequacy at the time of an apparent violation. It does not tell me who owns the distributor, and the rule itself says liability here is strict. The log mitigates. It does not cure.
Second, your middle sentence does the real work: route the refusal where a positive answer would go. As I read Red Flag 29, it starts from knowing, or having reason to know, that a listed party sits in the chain. A flat refusal is not obviously that, so the flag will not make the call. Our compliance manual has to, and you have persuaded me it should.
The exposure in your manual rule: the file that mitigates is the file that proves what you knew. The guidelines ask whether you had reason to know from all readily available information, and a dated refusal log is exactly that, in your own hand.
Calling a refusal a flag also pulls it under the guidance that says proceeding past an unresolved flag risks being treated as knowledge. So it has to run every time. Written and skipped is worse than never written, because the deviation is dated too.
I found no published rate for that mitigation. It is argued, not calculated.
