The Short Answer
If you are buying online sample, the standard due-diligence instrument is the ESOMAR 37 — 37 Questions to Help Buyers of Online Samples, which updates and replaces the 2012 publication 28 Questions to Help Buyers of Online Samples.
That matters more than it sounds. Half the industry still asks vendors for "your ESOMAR 28," and a provider who answers with a 2012-era document is telling you something about how current their quality programme is. The 37 exists precisely because sample sourcing changed — programmatic exchanges, blended supply, and fraud that did not exist when the 28 was written.
You do not need all 37 answers to make a decision. Six of them predict most of the quality outcome. This guide covers those six, the red flags in the answers, and the structural question underneath all of it: whether you need a panel at all.
Why Sample Due Diligence Got Harder
The old model was simple: a provider owned a panel, recruited its members, and knew who they were. That model is largely gone. Modern sample is blended — assembled in real time from owned panels, partner panels, exchanges, and river traffic, often several layers deep.
Blending is not inherently bad; it is how the industry delivers feasibility at speed. But it means the question "where do your respondents come from?" frequently has no single answer, and the provider you contract with may not control — or fully know — the fourth-tier supplier in the chain.
That is the context the ESOMAR 37 was written for, and why its questions about sourcing, deduplication, and validation carry the most weight.
The Six Questions That Matter Most
1. Where do your respondents actually come from?
Ask for the sample composition by source for your specific project, not the corporate boilerplate. Owned panel versus partner supply versus exchange versus river changes the profile of who you reach.
Red flag: an answer that describes the company's recruitment philosophy but never states what share of your completes will come from third parties.
2. How do you validate that participants are real, unique, and who they claim to be?
The 37 added explicit questions here — including what a provider does to prevent fraud at the sign-up stage. You want to hear about digital fingerprinting, duplication checks across suppliers, identity verification, and bot detection — as layered, named systems.
Red flag: "we use industry-standard fraud prevention." That is not an answer.
3. How do you deduplicate across sources?
Blended supply makes the same person reachable through several paths. Cross-supplier deduplication is genuinely hard and genuinely important, especially for trackers where a repeat respondent corrupts wave-over-wave comparisons.
4. What are your quality-removal rates, and who pays for replacements?
Ask what percentage of completes the provider itself removes for quality, and what happens when you scrub responses. If replacements are not free, your effective CPI is higher than quoted — see how sample pricing actually works.
5. How many surveys can one person take, and how often?
This is the panel conditioning question. Vendors that limit how many surveys any one respondent can take are more likely to protect data quality — and the answer tells you how much of the panel is composed of frequent takers. More on why that matters in our piece on professional respondents and panel conditioning.
6. Can you evidence feasibility for my specific audience?
Not "we have 100 million panelists" — that number is close to meaningless. Ask for completes delivered in the last 90 days for an audience like yours, at your incidence rate, in your geography.
Red flag: panel size quoted as the primary credential. Reach for your audience is what you are buying.
Red Flags Checklist
- Answers the ESOMAR 28 rather than the 37, or supplies an undated document
- Quotes total panel size instead of feasibility for your audience
- Cannot state source composition for your project
- No stated policy on cross-supplier deduplication
- Charges for replacement completes you rejected for quality
- Vague on incentive structure (over-incentivised panels attract professional respondents)
- No named person accountable for quality escalations during field
What Good Looks Like
A strong provider will volunteer their removal rates, name their validation vendors, tell you when your audience is not feasible rather than taking the order, and push back on your questionnaire when the LOI will damage completion. Willingness to decline business is the single most reliable quality signal in this category.
Also verify the fundamentals independently: data protection terms, sub-processor disclosure, and where respondent data is stored. If you are recruiting in regulated contexts, confirm consent handling against your own obligations — our guides to interview recording consent laws and research data retention cover the ground buyers most often miss.
The Structural Question: Do You Need a Panel?
Every question above exists to manage one risk — you are renting access to strangers and hoping they are who they say they are. Validation, deduplication, and conditioning are all downstream of that single fact.
For a large share of the research product and marketing teams actually run, the risk is avoidable, because the right respondents are already yours. Churn reasons, onboarding friction, pricing sensitivity, feature demand, win/loss: those questions are best answered by your own customers, whose identity you already know.
Koji is built for exactly that:
- AI-moderated voice and text interviews with your own users — no panel intermediary, no identity ambiguity, no deduplication problem, because you invited each person.
- Import participants from CSV or your CRM, and send personalized interview links so every response is attributable to a known customer.
- Six structured question types — open_ended, scale, single_choice, multiple_choice, ranking, yes_no — so a single study delivers quantifiable answers and the reasoning behind them, with AI follow-up probing where a survey would simply record the number.
- Automatic thematic analysis and one-click reports, so quality control is about listening to real conversations rather than scrubbing suspect rows.
- Published pricing — €29/month Insights, €79/month Interviews, credits included, no minimum contract.
External sample still has a legitimate job: category entry, competitor customers, general population norming. For everything else, the most reliable way to know your respondent is real is to already have their account ID.
Start free at koji.so — from question to insight in hours, not weeks. If you are comparing external options too, see our recruitment platform buyer's guide.
Frequently Asked Questions
What is the ESOMAR 37? It is ESOMAR's current due-diligence framework — 37 questions to help buyers of online samples evaluate providers on sourcing, validation, deduplication, and quality control. It updates and replaces the 2012 "28 Questions" document.
Is the ESOMAR 28 still valid? It has been superseded by the 37. A provider who answers only the 28, or supplies an undated version, is a signal worth probing — the newer questions exist specifically to cover blended supply and modern fraud prevention.
What should I ask a sample provider first? Source composition for your specific project, participant validation methods, cross-supplier deduplication, quality-removal rates and who pays for replacements, survey frequency limits, and evidenced feasibility for your audience at your incidence rate.
Is a bigger panel a better panel? No. Total panel size is a weak credential. What matters is verified reach for your specific audience and geography, which is why you should ask for completes delivered in the last 90 days for a comparable profile.
What is blended sample and should I worry about it? Blended sample is assembled in real time from multiple sources — owned panel, partners, exchanges, river traffic. It is standard practice and delivers feasibility, but it makes deduplication and validation harder, so ask how the provider handles both.
How can I avoid sample quality risk altogether? Interview your own customers. When you invite known users by personalized link, identity verification, deduplication, and panel conditioning stop being risks. External sample remains necessary for category entry, competitor research, and population benchmarks.
