customer asks if we have a reporting procedure for misconduct, how do I fill that in

Yes or no: internal reporting channel is a separate question

Most questionnaires ask this as a separate yes/no question, apart from the anti-corruption policy: does the company have an internal reporting channel where employees can report a misconduct, and is there protection against retaliation of the reporter. Enter "yes" only if there is a documented procedure — who reports, to whom, how confidentiality is arranged, and what protection against retaliation entails. An informal agreement that "everyone can go to the director" is not a whistleblower policy in the sense the questionnaire means. If there is no document, choose "no" or "under development" if that option is available — not "yes" because the subject sounds familiar.

Evidence is usually the policy itself, possibly with a reference to who manages it and how often it is reviewed. Some portals also ask for the number of reports in the past year; that figure should be in the file as an annex to the policy, not as an estimate when filling in. If you don't have a separate whistleblower policy but do have a general code of conduct with a reporting section, upload that code and mark in the explanation which article describes the reporting channel — that is more precise than ticking "yes" based on a partial answer. Also check if the client separately asks for a procedure for reporting conflicts of interest; that is often asked in the same section but is a different document.

Where that is stated in the VSME base module

The EFRAG VSME basic module for non-listed SMEs asks governance practices as separate information, apart from the general anti-bribery policy — which is why portals using questionnaires based on Directive (EU) 2022/2464 (CSRD) also request the internal reporting channel as a separate data point. This is the same logic as with is a policy against bribery and corruption: the client wants a standalone piece of evidence per governance practice, not one consolidated answer for the entire integrity domain.