The effectiveness review under § 8 (5) LkSG: the annual clock and the event trigger

Key takeaways

• § 8 (5) sentence 1 LkSG requires a review at least once a year and, in addition, on an ad hoc basis where the risk situation has changed or expanded materially.
• The Act names three examples of such an occasion: the introduction of new products, new projects or a new field of business.
• § 8 (5) sentence 2 LkSG requires the measures to be repeated without undue delay where needed. The review does not end with its finding.
• The benchmark is the criteria in paragraphs 2 to 4, not the company's own view of what effective means.
• Failing to carry out the review under § 8 (5) sentence 1 LkSG, or not doing so in time, is an administrative offence under § 24 (1) no. 4 LkSG, punishable by a fine of up to five hundred thousand euros under § 24 (2) sentence 1 no. 2 LkSG.

The wording, and why it contains two duties

§ 8 (5) sentence 1 LkSG reads: Die Wirksamkeit des Beschwerdeverfahrens ist mindestens einmal im Jahr sowie anlassbezogen zu überprüfen, wenn das Unternehmen mit einer wesentlich veränderten oder wesentlich erweiterten Risikolage im eigenen Geschäftsbereich oder beim unmittelbaren Zulieferer rechnen muss, etwa durch die Einführung neuer Produkte, Projekte oder eines neuen Geschäftsfeldes. Sentence 2 reads: Die Maßnahmen sind bei Bedarf unverzüglich zu wiederholen.

In practice this is routinely collapsed into a single duty, namely one review date in the annual calendar. The word that defeats that reading is sowie, meaning as well as. It joins two triggers that operate independently. The first is the passage of time and does not ask whether anything has happened. The second is an event and does not ask when the last review took place.

For the organisation this means that a company which reviewed in March and opens a new sourcing country in June has to review again in June. The fact that the annual review is already done changes nothing.

The event trigger: what counts as a materially changed risk situation

The Act describes the occasion in two steps. The precondition is that the company must reckon with a materially changed or materially expanded risk situation, either in its own business area or at a direct supplier. What follows, introduced by the word etwa, meaning for instance, is a list of examples rather than a closed definition: the introduction of new products, new projects or a new field of business.

Two features of the wording matter in practice. First, having to reckon with the change is enough; no breach need have occurred. Second, the list is open, because it is introduced by for instance, so the three named cases are illustrations and not conditions.

It follows that the trigger cannot be observed by the compliance function alone. Decisions about new products, new projects and new fields of business are usually taken in product development, in sales, in procurement and at board level. A procedure that reliably catches the trigger therefore hangs off the bodies where those decisions are made, not off an inbox.

• Release of a new product or product line with its own sourcing structure.
• Adding a new sourcing country or a new direct supplier in a raw material or manufacturing area assessed as critical.
• Start of a project that changes vertical integration, for example moving a production step to a supplier.
• Opening a new field of business, including through acquisition or the integration of an acquired company.
• A material change in the company's own business area, such as a new site with its own workforce structure.

What the review is measured against

The review is not a satisfaction survey. Its benchmark follows from its subject: the complaints procedure as paragraphs 2 to 4 of § 8 LkSG require it to be. What is examined is therefore whether the properties set out there were actually present during the period under review, not whether they were once set up.

That separates the effectiveness review from the set-up. Setting up means writing rules of procedure and naming an office. Reviewing effectiveness means asking whether the rules of procedure were publicly accessible during the reporting period, whether the entrusted people in fact worked free of instructions, whether the information on reachability and responsibility actually reached potential participants, and whether confidentiality of identity and protection against disadvantage held. A review that does not ask those questions is reviewing existence, not effectiveness.

A workable distinction here is between evidence the procedure produces itself and evidence that comes from outside. The first includes intake and handling times, the number of reports per access route, and the question of which language and which channel reports actually arrived through. The second includes feedback from suppliers, from employee representatives and from local organisations. A procedure that received not a single report in a year is therefore not proven effective; it is, first of all, in need of explanation.

Sentence 2: the review does not end with the finding

§ 8 (5) sentence 2 LkSG reads: Die Maßnahmen sind bei Bedarf unverzüglich zu wiederholen. The sentence closes the gap that would otherwise open between finding and consequence. A company that reviews and establishes that accessibility in one sourcing market was not given has not thereby discharged the duty; it has triggered the need.

The word unverzüglich, without undue delay, ties the consequence to the finding rather than to the next annual cycle. A review whose defects migrate into next year's planning misses the sentence. For the documentation this means that every review carries not only a finding but also a decision about repetition, and that this decision is dated.

The evidence, and what makes it examinable

Compliance with the due diligence obligations under § 3 LkSG must be documented continuously within the company under § 10 (1) sentence 1 LkSG, and that documentation must be kept for at least seven years from its creation under § 10 (1) sentence 2 LkSG. The effectiveness review of the complaints procedure belongs to this, because the complaints procedure is one of those due diligence obligations under § 3 (1) no. 7 LkSG.

The reporting duty comes on top. § 10 (2) sentence 2 no. 3 LkSG requires the annual report to set out comprehensibly how the company assesses the effects and the effectiveness of its measures, and no. 4 requires it to set out what conclusions it draws from that assessment for future measures. A company that does not document the effectiveness review has no basis for either.

• A scheduled review in the annual calendar with a named owner and a date.
• A defined event trigger wired into the bodies that decide on products, projects and fields of business.
• A review record per cycle addressing the criteria of paragraphs 2 to 4 individually.
• A dated decision on repetition under § 8 (5) sentence 2 LkSG, including where that decision is that no need exists.
• A filing arrangement built for the minimum seven year retention under § 10 (1) sentence 2 LkSG.

What an omitted review costs

A company that, contrary to § 8 (5) sentence 1 LkSG, fails to carry out a review or does not do so in time commits an administrative offence under § 24 (1) no. 4 LkSG; one that, contrary to § 8 (5) sentence 2 LkSG, fails to update a measure or does not do so in time commits one under § 24 (1) no. 5 LkSG. Both can be punished with a fine of up to five hundred thousand euros under § 24 (2) sentence 1 no. 2 LkSG.

The allocation is worth a second look, because a single figure is often quoted for the Act as a whole. A missing complaints procedure is a different case, § 24 (1) no. 8 LkSG, and carries up to eight hundred thousand euros under § 24 (2) sentence 1 no. 1 lit. a. The two per cent of average annual turnover appears in § 24 (3) LkSG and applies only to the cases in (1) no. 6 and no. 7 lit. a, that is, omitted remedial measures and the missing remediation concept, and there only above an average annual turnover of more than 400 million euros.

In context

The effectiveness review is the point at which a complaints procedure stops being a document and starts being a procedure. It is a scheduled, recurring task with a second, event-driven trigger and a record that must be kept for at least seven years under § 10 (1) sentence 2 LkSG. In exactly that form it can be run as a task: with a deadline, an owner, a record and a dated decision on repetition.

CIVAC is not a law firm and provides no legal services within the meaning of the German Legal Services Act (Rechtsdienstleistungsgesetz). This article sets out the wording and describes how the duty can be organised. The legal assessment of your individual case belongs to your legal department or your external counsel.

FAQ

How often must the LkSG complaints procedure be reviewed?

At least once a year, and additionally on an ad hoc basis. § 8 (5) sentence 1 LkSG joins both triggers with the word sowie: effectiveness is to be reviewed at least once a year as well as on an ad hoc basis where the company must reckon with a materially changed or materially expanded risk situation in its own business area or at a direct supplier. The annual cycle does not replace the ad hoc review, and a recently completed annual review does not excuse it.

What counts as an occasion for an unscheduled review?

The occasion is a materially changed or materially expanded risk situation in the company's own business area or at a direct supplier. § 8 (5) sentence 1 LkSG gives examples introduced by the word etwa, for instance: the introduction of new products, projects or a new field of business. The list is therefore open. It also matters that the company must reckon with the changed risk situation; the wording does not require a breach to have occurred.

What is examined in the effectiveness review?

The complaints procedure is examined against the requirements § 8 (5) LkSG refers to, that is, against paragraphs 2 to 4 of § 8 LkSG. In substance those are the publicly accessible rules of procedure in text form, the independence, freedom from instructions and confidentiality of the entrusted people, and the accessibility of the procedure together with confidentiality of identity and protection against disadvantage or punishment. The question is not whether those features were set up, but whether they held during the period reviewed.

What happens if the review finds defects?

§ 8 (5) sentence 2 LkSG reads: Die Maßnahmen sind bei Bedarf unverzüglich zu wiederholen. The finding therefore triggers a consequence, and the words without undue delay tie it to the finding rather than to the next annual cycle. A company that, contrary to § 8 (5) sentence 2 LkSG, fails to update a measure or does not do so in time commits an administrative offence under § 24 (1) no. 5 LkSG, punishable by up to five hundred thousand euros under § 24 (2) sentence 1 no. 2 LkSG.

Does the review have to be documented?

Yes. Compliance with the due diligence obligations under § 3 LkSG must be documented continuously within the company under § 10 (1) sentence 1 LkSG, and the complaints procedure is one of those obligations under § 3 (1) no. 7 LkSG. The documentation must be kept for at least seven years from its creation under § 10 (1) sentence 2 LkSG. The report comes on top: § 10 (2) sentence 2 no. 3 LkSG requires the company to set out how it assesses the effects and effectiveness of its measures, and no. 4 the conclusions it draws.