I have recently been looking into 'cyber essentials questionnaire' and I came across the question "Other than anti-virus software, are access control measures in place to prevent virus code modifying commonly run executable files?", are there any practices that would be put in place to deal with this other than the anti-virus software as mentioned?
The question is pretty descriptive: on a secure system, you make sure regular users cannot write to the folder containing your executables. On most OS, that is already done by default.
On some OS, this can be strengthened through several techniques, including requiring the executables to be signed or limiting the locations where executable code can be located.
It's not 100%, mind you: there are several techniques that can be used to work around the limitations but it's a good and (usually) easy to implement step for hardening a system.
One such method is signed executables. This is a cryptographic signature on executables, that can verify that the code originated from a trusted supplier (e.g. Microsoft) and that it has not been tampered with.
There are a lot of different tools in the market that can monitor the integrity of key executables and ensure they are not tampered. The idea is simple, the solution creates a whitelist of the applications and key files (using hashing algorithms) and constantly monitor those files, checking their hashes against the whitelist created.
If you're looking for a "fancy" solution, I could recommend you something like the McAfee Solid Core which does not only the hash monitoring but also several other checks.
Otherwise, you can code yourself a script that constantly take hashes (SHA512) of key files and compare to a whitelist. If a hash is different from your whitelist the script could send an email to you. It's not as good as a full commercial solution, but help to identify if someone changed a file.