ClamAV exists...

There already better alternatives like clamav but I guess that assumes the IT department is actually Linux proficient.

“does your organization have antivirus or anti malware protection on all desktops?”

Talk about suggestive question phrasing. Where better organisational security could often be accomplished by assuming every device attached to the network is a potential threat, and focusing on the network security, shielding devices against each other with only whitelisted protocols, plus locking down all devices that are configured by corporate IT.

Practical IT security in most orgs these days is "configure a big firewall with default settings from corporate provider, assuming everything is safe inside." then they get one compromised device (USB stick, cell phone transfer, exploit, whatever) and the whole ass network is fucked. and they have a "oh well, we did everything we can" excuse. fucking BS.

No IT Auditor ever tests this, the just ask and if you say yes they move on. To actually test this you would have to statically sample a random sample of devices and confirm the antivirus is installed.

Instead that auditors are going to ask for a list off devices enrolled in the antivirus and a list of all devices (if the company even has an asset inventory) and see if they look right. But, most like the asset list will come from the antivirus enrollment and it won't matter.