how do I answer questions about working conditions further in my supply chain

Supply chain question goes beyond your own company

This question concerns not your own employees, but the people who work at your suppliers and subcontractors. The customer wants to know whether you have visibility into that chain and whether you do anything about it. That is a different subject from the classic occupational health and safety policy of your own personnel, and it also requires different supporting documents. Do not confuse it with the question about health and safety policy, which concerns your own workplace — here it is about your suppliers.

In practice, this question comes in two forms: whether you have a code of conduct that you impose on suppliers, and whether you know how working conditions are further down the chain. If you have no code of conduct and no visibility into the chain, then an honest "no" is a valid answer — do not invent policies that do not exist. If you do have a supplier code or conduct supplier assessments, that is the supporting document that goes with this answer. How you draw up and establish such a code is separate from this question; you can read about that in the section on establishing a supplier code of conduct. See also the broader explanation at the question about working conditions at your own suppliers for the variants that customers typically ask here.

Basis in VSME, modules C2 and C3

The VSME standard by EFRAG covers supply chain subjects in the base module under social indicators, including human rights policy and dealing with suppliers. Directive (EU) 2022/2464 (CSRD) is the reason why larger buyers need to collect this type of information from their own supply chain, even though you yourself are not subject to the reporting obligation. This explains why the question reaches you as a smaller supplier: your customer needs the answer for their own reporting, not because you yourself are subject to a reporting obligation.