questionnaire asks if we have a risk management system, what counts as an answer to that

Formal system or risk assessment only

This varies depending on the questionnaire, but in most cases you are not asked whether you have ever assessed risks — you are asked whether this happens in a structured, repeatable manner. A system in this sense means: risks have been identified, there is a way to assess them (likelihood and impact), measures are linked to them, and there is periodic review. Identifying a risk once in response to this questionnaire usually does not count as a "system"; an established part of business operations — even if only an annual update of an Excel overview with ownership per risk — usually does count.

In CSRD-like questionnaires (derived from the EFRAG VSME baseline module) risk management is often specifically requested for sustainability topics: climate, human rights in the supply chain, governance. If you have only set up this process for financial or operational risk and not for sustainability, then "no" is often the honest answer to that specific part, even if you do conduct risk management elsewhere. Some customers ask this as a separate question, others as part of a broader block on who sits on the board and how it is composed — governance and risk management are regularly combined in questionnaires because the supervisory structure often also oversees risk management.

What the VSME baseline module and the anti-money laundering law request as evidence

The EFRAG VSME baseline module asks for a description of policies and practices, not for a certified system such as ISO 31000 — a brief, factual description of how risks are identified and managed is sufficient in most cases. If the question comes from a bank or insurer, the link is often to the Law on the prevention of money laundering and financing of terrorism: this requires the customer themselves to conduct customer due diligence, and the customer therefore often wants to know whether your own organisation holds risks — including integrity risks — manageable. If you do not have a separate risk management system but do have individual components such as a sanctions policy or a reporting channel, it is often more accurate to name those individual components than to suggest a system that does not exist.