Compliance Officer as a Service in medium-sized companies: prices, models, hourly rates

§ 130 OWiG obliges owners of businesses and companies to properly supervise compliance with legal obligations in their area of ​​responsibility. Violations can result in fines of up to 1 million euros for individuals and up to 10 million euros according to Section 30 OWiG for legal entities. Medium-sized companies with 50 to 500 employees face the same duty of care as large corporations without being able to support their large compliance department. An internal compliance officer, including social security contributions, mandatory training and the necessary tools, quickly costs 110,000 to 160,000 euros per year and requires three to six months' notice to fill the position with qualified personnel.

Compliance Officer as a Service solves this area of ​​tension. Instead of a full-time position, medium-sized companies receive the function as a service with a clearly defined scope of services, a documented reporting line to management and audit-proof evidence in the workspace. This article clarifies the price ranges for 2026, the standard market models, what must be included in the monthly price, when it is worthwhile to switch from internal hiring and how CIVAC, as a compliance platform and officer-as-a-service, supplies medium-sized businesses with an SLA of two working days. You will also learn how an audit-proof provider differs from a pure consultant and which eight contract components must be documented in an audit-proof manner.

§ 130 OWiG punishes failure to supervise. Anyone who, as the owner of a business or company, intentionally or negligently fails to take supervisory measures that would have prevented or made a violation committed in the business significantly more difficult is acting unlawfully. According to Section 130 Paragraph 3 OWiG, the fine can amount to up to 1 million euros, in conjunction with Section 30 OWiG for legal entities up to 10 million euros. The standard applies regardless of the size of the company and makes medium-sized businesses the main target group for investigative authorities and supervisory authorities, because there the supervisory organisation is often only documented incompletely in writing and evidence is missing in the proceedings.

The Federal Court of Justice further specified the personal liability of management for compliance failures in its Neubürger decision (Az. II ZR 219/13) from 2017. Managing directors are liable for damages resulting from a lack of supervisory organisation with their private assets, unless relief applies. A documented compliance function is therefore central not only in terms of regulatory law, but also in terms of corporate law and insurance law, for example in D&O underwriting.

Small and medium-sized companies regularly lack the human resources to properly map this function internally. Managing directors take on the role on the side, HR managers also manage data protection and occupational safety, and IT management also takes care of information security. Each of these double assignments creates a documented conflict of interest, which the examiner specifically asks about in the first appointment. Compliance Officer as a Service replaces this emergency solution with a properly appointed, qualified function with its own reporting line to management. CIVAC bundles the order via the Compliance Representative in a signed appointment certificate and stores it in the workspace in an audit-proof manner. Others run compliance like a filing cabinet. We run it like software.

The function includes six core services that must be included in every mandate. Firstly, the order itself, documented by an appointment certificate in accordance with the requirements of the German Corporate Governance Code and the relevant compliance standards such as IDW PS 980 or ISO 37301:2021. The certificate fully describes the scope of tasks, reporting line, representation and appointment period. Secondly, the risk analysis, which identifies the company's typical compliance risks: corruption according to §§ 299 ff. StGB, money laundering according to the AMLA, antitrust law according to the GWB and Art. 101 TFEU, sanctions according to EU regulations, data protection according to the GDPR, occupational safety according to the ArbSchG as well as industry-specific obligations.

Thirdly, the written regulations: Code of Conduct, anti-corruption guidelines, gifts and Invitation regulations, business partner onboarding with sanctions screening, whistleblowing process according to HinSchG and additional topic policies. Fourth, the training program with documented proof of participation per functional group and a refresher at least every 24 months. Fifth, the whistleblower system according to the HinSchG, which has been mandatory for companies with 50 or more employees since December 17, 2023 and is at risk of fines under the supervision of the Federal Office of Justice. Sixth, ongoing monitoring with quarterly reports to management and a documented escalation chain.

Compliance Officer as a Service means that all six components are delivered contractually bundled, in one contract and with one monthly invoice. Pure consulting only provides building blocks one to three, often as a one-off project, and leaves the operational assignment to the customer. This is exactly where the documented gaps arise that auditors uncover in the first thirty minutes. CIVAC integrates all six building blocks into a workspace in which every compliance activity is time-stamped, assigned to a person and exportable in one click. The appointment certificate, signed, filed, verifiable. Licence the workspace for your internal representatives, or have our representatives order it.

The market observation for 2026 shows clear ranges in the three most important segments of German medium-sized companies. For companies with 50 to 150 employees and a manageable risk profile, monthly flat rates range between 1,200 and 2,200 euros net. This range typically includes two to four officer hours per month, a quarterly report to management, training material for mandatory modules, a whistleblower channel in accordance with the HinSchG and documented emergency on-call service with clearly stated escalation levels.

In the segment with 150 to 350 employees or with an increased risk profile, for example due to international supply chains, sales via sales representatives and middlemen or regulated industries such as medical devices, the flat rates increase 2,200 to 3,500 euros net per month. This includes supplier onboarding workflows with sanctions screening, country-specific training and in-depth risk analyses for each business area. For complex medium-sized companies with 350 to 500 employees, several locations or subsidiaries and industries such as mechanical engineering, pharmaceutical supply or financial services, the monthly flat rates are between 3,500 and 4,500 euros net.

Hourly rates for project-related compliance consulting in Germany in 2026 were between 180 and 320 euros net, depending on seniority, industry expertise and specialist area such as antitrust law or anti-corruption investigations. For the ongoing officer function, hourly rate billing is usually the more expensive model because the real effort for risk analysis, training operations and documentation is 30 to 60 hours per quarter and cannot be subordinated to a fixed budget. The CIVAC flat rate replaces this uncertainty with a calculable monthly invoice with a defined service and an SLA of two working days for standard inquiries, instead of the classic two to six weeks of project-related advice. The fact page documents the SLA values ​​transparently and makes the price components comparable.

An audit-proof compliance officer contract contains eight positions that must be explicitly and individually named. Firstly, the appointment certificate with the order date, scope of tasks according to IDW PS 980 or ISO 37301:2021, reporting line to management, representation arrangements in the event of absence and the written declaration of acceptance by the appointed person. Secondly, the annual risk analysis with documented methodology, prioritised action plan and demonstrable tracking of the implementation status. Thirdly, the written Code of Conduct including anti-corruption, gifts, invitations and sponsorship regulations as well as additional industry policies.

Fourthly, the training concept with compulsory training per functional group, verifiable participation rates and a repetition logic every 24 months. Trained employees are the first thing the auditor specifically asks about in the audit, followed by the training documentation. Fifthly, the whistleblower system according to HinSchG with the three mandatory channels in writing, by telephone and in person, documented confidentiality, technical separation of the tips and deadline control of the seven day confirmation of receipt and three months of follow-up notification to the person who gave the whistleblower. Sixthly, the quarterly report to the management, which fully documents the identified risks, measures taken, reported incidents, training statuses and escalations.

Seventhly, the emergency on-call service with a clear escalation path in the event of suspected cases, raids, official requests for information or whistleblower receipts with a criminal law connection. Eighthly, audit export, i.e. the technical ability to produce complete, time-ordered evidence for auditors, public prosecutors, BaFin or supervisory authorities at any time. Audit-proof, documented, § 130 OWiG-proof. CIVAC delivers all eight positions via the workspace with 490 ready-to-use audit templates, an underlying ISO/IEC 27001:2022 ISMS with 93 controls and audit-proof versioning of each individual change. The auditor calls and the evidence is ready without the management having to look for a single document. Each of the eight contract positions is named in the CIVAC appointment certificate with reference to the associated workspace section, so that auditability exists from day one and is accepted by the auditor in the annual financial statements as proof of compliance.

An internal compliance officer in Germany as a senior profile will cost between 95,000 and 130,000 euros gross annual salary in 2026, depending on the industry, location and professional experience. In addition, there are employer contributions to social security of around 21 percent, i.e. a further 20,000 to 27,000 euros per year. Mandatory training, certification extensions, specialist literature, database subscriptions and conference participation cost between 4,000 and 7,000 euros per year. Tooling for risk analysis, training platform, whistleblower system, GRC software and documentation costs an additional 8,000 to 18,000 euros per year for medium-sized companies.

The total costs are 130,000 to 180,000 euros per year for a full-time position plus the associated tools. In addition, there is a non-monetary but strategically crucial effort: recruiting for a qualified compliance position in Germany takes three to six months, training takes another three months, and representation during vacation and illness is often not clearly mapped out in medium-sized companies. When the person changes, institutional knowledge is lost if the evidence does not live systematically in the workspace and therefore remains accessible regardless of the person.

Compliance Officer as a Service with an annual flat rate of 18,000 to 50,000 euros covers the same range of functions in medium-sized companies, with contractually guaranteed representation, a documented reporting line to management and audit export at the push of a button. The difference to the internal solution is between 80,000 and 130,000 euros per year and allows the freed-up funds to be invested in operational risk reduction instead of in structural costs. Even if the external officer only accounts for 60 percent of the internal working time, which is rarely the case when scaled correctly, there remains a clear cost advantage. The second effect is speed: two working days of onboarding instead of six months of recruiting means that the function is effective before the next review.

Four models characterize the market for Compliance Officer as a Service in German medium-sized businesses. Firstly, the pure monthly flat rate with a fixed scope of services, defined officer hours and clear escalation rules. It is the most transparent model for medium-sized businesses and enables secure budget planning throughout the entire financial year. Contracts are usually concluded with a term of 12 or 24 months, with an extension clause in the event of timely termination.

Secondly, the hybrid model, in which a basic flat rate covers the ongoing function and project-related expenses, such as M&A due diligence, internal investigations, training for newly acquired branches or special regulatory audits, are billed separately at an hourly rate. Hourly rates are between 180 and 320 euros net, depending on specialization and language. Thirdly, the pure hourly rate model, in which every officer activity is billed according to effort. It only makes sense in medium-sized companies if the compliance function already exists internally and external expertise is only required in specific areas, for example for special reports, regulatory statements or training on special topics such as EU sanctions. It is the most expensive model for the current mandate because risk analysis, training, whistleblower processing and quarterly reports constantly generate effort without any budget cap.

A fourth model is increasingly appearing in 2026: the pure workspace licence without external ordering. Here the company uses the compliance platform with all templates, workflows and audit exports, but keeps the officer function internally. Licence the workspace for your internal representatives, or have our representatives order it. Both paths lead to the same quality of evidence because the data lives in the same system and triggers the same audit export. The choice depends on the existing internal capacity, specialist knowledge, desired risk distribution and the company's growth rate.

The difference between an audit-proof provider and a pure consultant can be seen in five points that every management should check in writing before concluding a contract. First: The provider names a specific person with proof of qualifications and an appointment certificate, not an anonymous team with changing contacts and unclear responsibilities. The reporting line to the management is contractually fixed, their representation is regulated in writing and does not depend on the internal availability of the consulting firm. Second: The provider provides a technical platform in which risk analysis, action plans, training records, whistleblowing processes and quarterly reports live as connected data objects and not as isolated files. Excel lists, local Word documents and PDF attachments via email are not audit-proof documentation and fail the first auditor's question about traceability.

Third: The provider documents its own information security. Without ISO/IEC 27001:2022 certification from the platform operator, there is open third-party risk for the client, which will address every external audit and every reputable supplier onboarding of its customer. Fourth, the provider has a clear escalation path for emergencies, including prosecutorial raids, government information requests, antitrust searches, and criminal whistleblower filings. The emergency on-call service is part of the contract with a named body and telephone number, not goodwill.

Fifth: The provider exports audit packages in the format that the respective auditing body expects, be it the auditor according to IDW PS 980, the BaFin, the public prosecutor's office, the Federal Office of Justice or a supervisory authority audit at the state level. CIVAC meets all five criteria and complements them with EU data residency for all personal and company-related data, 25 agent roles on one platform and an audit export that takes minutes instead of weeks and is in the format that the respective audit authority expects. Others run compliance like a filing cabinet. We run it like software.

Four triggers dominate in practice and accelerate the decision of medium-sized companies for Officer-as-a-Service. First: An external audit is actually coming up. Auditors in annual financial statements, banks in the credit process or covenant reviews, insurers in D&O underwriting, M&A due diligence buyers or major customers in supplier qualification ask for compliance evidence in a structured and written manner. In this situation, anyone who can only present a Code of Conduct as a PDF and a few training photos will lose room for maneuver and, in the worst case, the contract. Officer-as-a-Service provides the required evidence within two working days, including appointment certificate, risk analysis, proof of training and HinSchG processes.

Secondly: A whistleblower receipt according to HinSchG has activated the whistleblower system, and it turns out that neither deadline control nor documented follow-up processes are clearly mapped in the company. Missed deadlines lead to fines of up to 50,000 euros according to Section 40 of the HinSchG; repeated violations can be significantly higher according to Section 41 of the HinSchG. The HinSchG supervision at the Federal Office of Justice has been increasingly active since 2024 and is publishing the first fine proceedings.

Third: The supply chain is coming under regulatory pressure. The LkSG has required companies with 1,000 or more employees to carry out due diligence in their own supply chain since 2024; smaller medium-sized companies are included in the obligation through their major customers in B2B business. Suppliers who cannot prove in writing that compliance structures work and are implemented will be rejected from tenders or lose framework contracts. CIVAC bundles LkSG requirements with the general compliance function in a workspace and delivers the supply chain order as an add-on to the compliance mandate.

The fourth, less visible trigger is the personnel change at the top of compliance. If the previous compliance officer leaves the company and does not leave a documented system behind, Officer-as-a-Service is the quicker solution than a new hire. The SLA of two working days replaces the six-month recruiting period and ensures the ongoing function without a supervisory gap in accordance with Section 130 OWiG.

CIVAC is a German compliance platform and officer-as-a-service with 25 live officer roles, 93 controls according to ISO/IEC 27001:2022, 490 ready-to-use audit templates and EU data residency for all stored data. The compliance officer is operated via the workspace, including an appointment document, reporting line to management, annual risk analysis, training program with evidence, HinSchG reporting point and quarterly report. The SLA for standard inquiries is two working days instead of the classic two to six weeks of external advice.

The pricing model follows the segment logic outlined above: 1,200 to 2,200 euros per month for companies with 50 to 150 employees, 2,200 to 3,500 euros for 150 to 350 employees, 3,500 to 4,500 euros for 350 to 500 employees with complex international or industry-specific risk profiles. The flat rate includes the officer function, the workspace licence, mandatory training, the HinSchG channel, quarterly reports, emergency on-call service and audit export. Additional services such as M&A due diligence, internal investigations, country-specific training or special antitrust reports are billed on a project-by-project basis at a fixed hourly rate.

Licence the workspace for your internal representatives, or have our representatives appoint you. Both paths lead to the same quality of evidence because the data lives in the same system and feeds the same audit export. Group structures with multiple companies are mapped in the workspace via a single group contract with company-specific evidence, which eliminates duplication of audit export and enables consolidated reports for the parent company.

Turn reading into a mandate. Medium-sized companies with specific needs can reach the CIVAC Delivery team at info@civac.de or via the contact form on civac.de. The initial discussion clarifies the number of employees, risk profile, regulatory scope and the migration path to the workspace. An indicative flat rate is determined within one working day, the appointment certificate within 48 hours of conclusion of the contract, the first quarterly report within 90 days.