External Compliance Officer for DACH SMEs: Mandate, Costs and Setup

§ 130 OWiG holds managing directors personally liable where they fail to fulfil the supervisory duties that would have prevented compliance breaches. Read together with IDW PS 980, which defines the principles of a proper Compliance Management System (CMS), this creates a clear set of requirements for SMEs: a compliance function is not optional but forms part of the minimum liability standard.

For companies with 50 to 2,000 employees operating in the DACH region — Germany, Austria, Switzerland — establishing a full-time internal Compliance Officer position is frequently not economically viable. The external Compliance Officer addresses this problem: the mandate is assumed on the basis of a service contract, immediately deployable expertise is brought in and activities are documented to a standard that holds up under scrutiny. This article sets out what the mandate covers, what it costs and how collaboration is structured for DACH SMEs.

The compliance obligation for companies under German law arises primarily from § 130 OWiG. Under this provision, anyone who, as the owner of a business or enterprise, intentionally or negligently fails to take supervisory measures necessary to prevent violations within that business or enterprise is acting unlawfully. The risk of fines extends to €10 million; for companies, an additional corporate fine may be imposed under § 30 OWiG.

In addition, IDW PS 980, as a recognised auditing standard, prescribes what a proper Compliance Management System (CMS) must encompass: compliance culture, compliance objectives, compliance risks, compliance programme, compliance organisation, compliance communication and compliance monitoring. This seven-element framework is the benchmark against which external auditors and courts assess the quality of a CMS.

In Austria, the Commercial Code (UGB) applies in conjunction with the GmbHG and criminal business law. In Switzerland, the Code of Obligations (OR) and the Administrative Criminal Law Act (VStrR) provide similar impetus. An external Compliance Officer operating in the DACH region must know these differences and take them into account in their work. Details of the tasks of the Compliance Officer are available on the corresponding CIVAC page.

The Compliance Officer is not an inspector but the architect and operator of the Compliance Management System. Core tasks include:

• Compliance risk analysis: Identification of the compliance risks relevant to the company — by sector, geography and internal control status. The basis is a structured inventory of applicable laws, regulations and standards.
• Compliance programme: Policies, Code of Conduct, approval procedures for critical transactions (donations, sponsorship, consultancy agreements), four-eyes principle arrangements.
• Training and communication: Employee training on anti-corruption, competition law, anti-money laundering, supply chain requirements under the Supply Chain Due Diligence Act (LkSG). Documentation with certificate and record.
• Whistleblower system: Establishment and operation of the Internal Reporting Office under the Whistleblower Protection Act (HinSchG) (in Germany from 50 employees) and the EU Whistleblower Directive.
• Compliance reporting: Regular report to management in accordance with IDW PS 980. Documentation of compliance incidents, risk measures and system improvements.
• Regulatory authority communication: Support during investigations, searches or inquiries from the public prosecutor's office, BAFA (LkSG) or other authorities.

An external Compliance Officer working for companies in the DACH region must master more than German law. The relevant differences in Austria and Switzerland are not trivial:

Austria: The Money Laundering Act (FM-GwG) and the Register of Beneficial Owners Act (WiEReG) have their own requirements that differ from the German GwG. The appointment of a Compliance Officer is expressly provided for in the Austrian Banking Act (BWG) and the Securities Supervision Act (WAG) for regulated companies. For unregulated SMEs, the general corporate law duties of care apply.

Switzerland: The Code of Obligations (OR) requires joint-stock companies above certain thresholds to have internal audit and an internal control system (ICS). The VStrR is relevant in cases of business offences. Swiss companies operating in the EU must nonetheless comply with GDPR and the LkSG if they exceed certain thresholds.

A professional external CO for the DACH SME sector has networks in all three countries and coordinates with local specialists on cross-border matters. Superficial knowledge is insufficient here. In addition to the CO function, further officers are frequently relevant, such as the Data Protection Officer and the Internal Reporting Office Officer.

The costs for an external Compliance Officer vary depending on company class, sector and scope of mandate. As a guide for the DACH SME sector:

By comparison: an internal Compliance Officer in the SME sector on a full-time salary, including employer costs, continuing education and infrastructure, costs at least €90,000 to €130,000 annually. The external solution is considerably less expensive in virtually all SME classes — and brings immediate operational readiness without a ramp-up period.

For sector-regulated companies (financial services, pharmaceuticals, critical infrastructure operators), surcharges of 30 to 60 per cent are realistic, as the scope of the mandate and the required specialisation increase significantly.

A professional compliance mandate does not begin with general recommendations but with a structured inventory. The first three months typically follow a clear sequence:

1. Month 1 — Compliance risk analysis: Identification of the applicable laws and regulations for the respective company (sector, size, markets). Assessment of existing measures against IDW PS 980. Identification of gaps.
2. Month 2 — Programme design: Drafting of policies, Code of Conduct, approval procedures. Defining reporting lines. Designing the training programme for employees and management.
3. Month 3 — Implementation and training: Roll-out of the compliance programme, first training round with documentation. Establishment or review of the whistleblower system under the Whistleblower Protection Act (HinSchG). First compliance report to management.

After this initial setup phase, regular operations follow: quarterly or bi-annual reports, ongoing monitoring of legal changes, repeat training sessions, accompanying special projects and regulatory inquiries.

The quality of these first three months is decisive — both for the subsequent audit readiness of the system and for ensuring that management experiences the mandate as useful rather than bureaucratic. Audit-ready, documented, § 130 OWiG-compliant.

In practice, the Compliance Officer is rarely the only officer function that an SME needs to fill. § 130 OWiG and IDW PS 980 concern the overarching compliance function; alongside this, numerous specific appointment obligations exist depending on sector and company size:

• Data Protection Officer under Art. 37 GDPR and § 38 of the Federal Data Protection Act (BDSG)
• Information Security Officer under §§ 30, 38 BSIG (NIS-2)
• Anti-Money Laundering Officer under § 7 GwG for regulated companies
• Supply Chain Officer under § 4 LkSG for companies with more than 1,000 employees from 2024
• Internal Reporting Office Officer under the Whistleblower Protection Act (HinSchG) for companies with 50 or more employees

Coordinating between these roles is operationally demanding. A Compliance Officer working on a platform that integrates all officer roles avoids duplicate documentation and creates consistent evidence across all functions. CIVAC offers precisely this integration: all 25 officer roles in one workspace, one audit log, one documentation structure.

The contract with the external Compliance Officer differs from a standard consulting contract in several material respects. It must govern:

• Scope of mandate: Explicit service catalogue — which of the IDW PS 980 elements are covered, and which remain the company's own responsibility?
• Reporting obligation: To whom and at what frequency does the CO report? A direct reporting line to management is standard. Weekly email exchanges do not replace a formalised compliance report.
• Confidentiality: The CO gains access to sensitive company and personnel data. A clear confidentiality agreement is indispensable, particularly where the CO simultaneously holds other mandates.
• Liability arrangement: To what extent is the external CO liable for incorrect advice? The professional indemnity insurance should clearly state the coverage amount.
• Notice periods and handover: How is it ensured at the end of the mandate that documentation is handed over in full and no gap arises?
• Conflict of interest provision: Disclosure obligation for new mandates that could give rise to conflicts of interest.

Letter of appointment, signed, filed, evidenced. For the CO as well: formal documentation of the mandate is the starting point for any evidence vis-à-vis authorities and courts.

The market for external Compliance Officers is less regulated than that for external Data Protection Officers — there is no statutory qualification requirement comparable to Art. 37(5) GDPR. This makes quality assessment more important, not easier.

The following signals are meaningful:

• Certifications: Certified Compliance Professional (CCP) of the Compliance Academy, CCEP (Certified Compliance and Ethics Professional) of the SCCE, specialist lawyer in criminal law or commercial and corporate law with CMS focus.
• Sector experience: A CO for the pharmaceutical industry must know AMG and AMVV compliance; a CO for financial services must know MaRisk and BAIT. Generalist COs without sector knowledge quickly reach their limits with regulated companies.
• Demonstrable CMS implementations: Has the provider built and successfully audited a CMS in accordance with IDW PS 980 for comparable companies?
• Sample reports: A reputable CO can present sample compliance reports (anonymised). Anyone unfamiliar with structured reports is not working to IDW standards.
• Professional indemnity insurance: Coverage amounts below €500,000 are insufficient for mandates with significant liability exposure.

CIVAC is a compliance platform and Officer-as-a-Service for the German, Austrian and Swiss SME sector. The CIVAC model combines the external Compliance Officer with a structured workspace: task management, project module for audits and assessments in accordance with IDW PS 980, training module with certificate, documentation module and AI assistant with confidence score and source references.

Appointment is completed within two working days: contract, letter of appointment, initial reporting line. The CIVAC network covers all relevant DACH markets and coordinates between German, Austrian and Swiss specialists on cross-border compliance requirements.

License the workspace for your internal officers — or have our officers appointed. Both are documentable on the same platform, with a unified audit log and coordinated reporting lines for all officer roles your company requires.

If you wish to clarify your specific compliance needs in the DACH region, speak with us. Turn reading into action: info@civac.de or via the contact form at civac.de.