does my company have risk management for sustainability and ESG

Risk management for ESG stands or falls with a concrete process

Most customer questionnaires want to know whether there is a structured process: which sustainability risks have been identified, how often are they reviewed, and who is responsible. A loose paragraph in the annual report about "sustainability is important to us" is usually not enough as an answer. What counts is a recognizable process: a risk inventory, an owner per risk, and a documented schedule for updates — even if that process is simple.

For an SME that does not fall under the CSRD reporting obligation, the basic module of the VSME standard is a good benchmark: it does not ask for an extensive risk management system, but for minimal, factual information about the main ESG topics relevant to the company. If you do not have that, then "no, not yet established" is a more honest answer than a vague "yes" — especially because customers are increasingly linking this item to follow-up questions about the composition of the board of directors and to a anti-bribery policy, where overlapping evidence is required.

Where this comes from: CSRD scope and VSME basic module

Directive (EU) 2022/2464, the CSRD, obliges large and listed undertakings to report comprehensively on sustainability risks, including governance and risk management processes. If you do not fall under that — most SME suppliers do not — then that obligation does not apply, but customers often ask for the underlying information anyway, because they themselves are subject to reporting obligations and must include the supply chain. The VSME basic module of EFRAG was specifically developed for that situation: a voluntary, reduced set of questions that allows a non-reporting undertaking to still provide structured answers without the full weight of the CSRD. If a concrete risk process is missing, then that is a factual matter that you can simply report — filling in an assumption or promise adds no evidence and only creates a contradiction upon later verification.