the questionnaire asks if we have a whistleblower scheme what do I fill in
A whistleblower scheme is usually the internal reporting channel
This is usually the same question as do you have an internal reporting channel for whistleblowers: a procedure by which an employee can report misconduct, with protection against retaliation and usually also an anonymous option. Some customers use the term "whistleblower scheme", others "misconduct reporting procedure" or "speak-up channel" — ask the same thing. Answer "yes" only if there is a documented procedure in place, not if there is only "an open culture" in which people can speak up.
Two scenarios are common. If you have the scheme as a legal requirement because you are above the threshold of 50 employees, the evidence is the document itself: the policy, the whistleblower scheme as published on the intranet or in the employment terms. If you are below the threshold and have no formal scheme, then "no" is the correct answer — an informal arrangement that people "can simply report it to the director" is not a whistleblower scheme in the sense the questionnaire means. This often overlaps with questions about conflict of interest, which are in the same section "governance" or "integrity" and can be answered with the same source document.
Where this recurs in VSME and the CSRD chain
The EFRAG VSME standard asks in the basic module for governance information, including the existence of a reporting channel for misconduct — this is the question that larger customers, themselves subject to reporting obligations under the CSRD (Directive (EU) 2022/2464), pass on to their SME suppliers to complete their own supply chain reporting. It is not a standalone legal obligation for every supplier, but an information question that flows down through the chain. If you have no scheme in place, you enter that as a factual answer; there is no obligation to set one up specifically for this questionnaire.
This answer applies to every type of questionnaire, not only to the cyber questions from your customer, answer it. The full explanation — with the sources, country-specific details and related topics — is on the hub.
This is not legal advice. This page provides general information on the regulations this platform covers. We do not know your situation. If in doubt about your own case, consult a lawyer or the competent supervisory authority.
Written with AI based on the sources above, checked by a human on 2026-09-05. Is something incorrect? Let us know — corrections receive priority.