External human rights officer: Costs, effort and models at a glance

The German Supply Chain Due Diligence Act (LkSG) has required all companies with 3,000 employees or more since 2023, and 1,000 or more employees since 2024, to entrust a person with monitoring risk management for human rights and the environment. Section 4 Paragraph 3 LkSG names the human rights officer and prescribes a direct reporting line to the management. The order can be made internally or outsourced to an external agent. In practice, many companies choose the external option because expertise in supply chain compliance is difficult to build and the annual BAFA reporting requirement requires an experienced hand who knows the questionnaire with over 400 individual questions.

This article classifies the costs realistically and compares three models: hourly rate consulting, annual flat rate and officer-as-a-service with integrated workspace. He explains which tasks actually need to be done, how effort differs between small and medium-sized businesses and corporate supply chains, which hourly rates are standard in the market and which levers reduce overall costs. The interface to the EU Directive on due diligence in the area of ​​sustainability (CSDDD, Directive 2024/1760) is also examined because it tightens the expectations of the representative from 2026. CIVAC offers the role of compliance platform and officer-as-a-service. Licence the workspace for your internal representatives or have our representatives order it. Both paths lead to verifiable LkSG structures and a plannable cost side, without the management ending up in a black box of hourly rate invoices.

§ 4 LkSG requires appropriate and effective risk management that is anchored in all relevant business processes. The human rights officer monitors this risk management, reports to management at least once a year and informs them of identified risks and violations. The function is not a staff department for communication, but a technical supervisory role with a clearly regulated reporting line and a documented appointment certificate that must be presented at any time during the audit.

The specific tasks are listed in Section 3 LkSG: issuing a policy statement, carrying out annual risk analyses in the company's own business area and with direct suppliers, determining preventive measures, corrective measures in the event of identified violations, setting up a complaint procedure, documentation and reporting. The representative coordinates these duties without carrying them out alone. The operational work remains in purchasing, HR, the legal department and sustainability; the control is centrally located. This division of tasks is also relevant with regard to the personal liability of the representative.

When considering costs, this means that the role is more of a program management than a clerical one. Effort varies with supply chain complexity, number of Tier 1 suppliers, geographic distribution and industry. A German mechanical engineering company with 150 suppliers from Europe and a Chinese factory has a different risk profile than a textile buyer with 800 suppliers from Bangladesh and Vietnam. CIVAC provides a preconfigured workspace for the supply chain officer with audit templates, risk matrices and report formats that follow the LkSG logic. Anyone who only sees the function as a job description underestimates the control effort and comes under deadline pressure at the end of the financial year. The deadline runs from the end of the financial year, the BAFA report does not wait. A written task matrix between the representative, purchasing, HR and legal departments prevents gaps and duplication that would otherwise be noticed in an audit or complaint review.

Three models have established themselves on the market. Firstly, the classic hourly rate model: a law firm or consultancy is entrusted with the function, charges by the hour and carries out audits as required. Hourly rates for senior consultants are currently between 220 and 380 euros net. With an average effort of 70 to 140 hours per year, this results in a volume of 15,000 to 53,000 euros, but with a high degree of variation and poor planning because incidents and complaints can double the effort in the short term.

Secondly, the annual flat rate: The external representative guarantees a contractually defined scope of services at a fixed price, usually including an appointment certificate, annual risk analysis, draft BAFA report, training for relevant employees and a set number of incident response hours. Depending on the complexity, the flat rates range between 24,000 and 60,000 euros per year and offer the advantage of predictable costs. It is important to precisely define what is included in the fixed price and what is billed based on effort, otherwise the model will actually shift back towards an hourly rate.

Thirdly, Officer-as-a-Service with an integrated workspace: Here the external order is combined with a software platform that contains risk analysis, supplier surveys, complaints, reports and audit templates. This saves additional effort and integrates the representative into the operational data world. CIVAC offers this variant as a compliance platform and officer-as-a-service. Licence the workspace for your internal representatives or have our representatives order it. The auditor calls, the evidence is ready., without searching through Excel tables or distributed emails. The advantage of this model lies not only in the cost structure, but also in the reusability of the data across the reporting years and in the comprehensible versioning of the documents.

The range of offers often irritates management. It results from five drivers. Firstly, the number of direct suppliers: a risk analysis for 80 suppliers is completed faster than for 800. Secondly, the geographical distribution: suppliers in high-risk countries according to the BAFA list require deeper scrutiny and in some cases on-site audits that add travel costs and daily fees. Thirdly, the industry: textiles, mining, electronics and food have their own risk landscapes with established audit standards (e.g. SA8000, amfori BSCI, Rainforest Alliance) that the representative must classify.

Fourthly, the complaints situation: If a complaints procedure is actively used, assessment, investigation and remedial action costs arise that are rarely foreseeable in the first year. A single serious incident in a third country can trigger two to three weeks of additional commissioner work. Fifth, the maturity question: A company without existing supply chain compliance starts from scratch and needs to set up a risk matrix, supplier communication and training concept. A company with an established sustainability department can build on existing structures.

Realistic ranges: A company with 1,500 employees and 120 suppliers in Europe expects 22,000 to 38,000 euros per year for an external representative including a workspace. A group with 8,000 employees and 600 suppliers worldwide costs between 55,000 and 85,000 euros. There are also one-off setup costs in the first year, usually between 8,000 and 15,000 euros for materiality analysis, supplier communication and training, plus ongoing licence costs for the workspace in the range of 6,000 to 18,000 euros per year. When selecting a provider, it is worth looking at references from your own industry and whether the representative also works for direct competitors.

Workspaces do not reduce overall costs because the representative works more cheaply, but because there is less duplication of work. Three levers are effective in practice. First, supplier communication: A preconfigured questionnaire that is directly linked to the risk matrix saves three to six hours per supplier compared to Excel-based recording. With 300 suppliers, that's 900 to 1,800 hours that are not included in the daily rate of the representative or his team. In addition, the suppliers themselves produce fewer queries because the questionnaire is uniform and comprehensible.

Secondly, the reporting to BAFA and management: Anyone who pulls the data from a structured workspace needs two to three days for the annual report. Anyone who has to reconstruct from emails and Excel tables takes ten to fourteen days and produces inconsistencies that lead to queries in subsequent years. Audit-proof, documented, § 10-proof. Versioning the data also makes it possible to reconstruct a historical reporting status, which can save weeks in BAFA inquiries.

Third, the interface to CSRD and EU taxonomy: A workspace that connects LkSG and ESRS data points avoids the multiple recording of the same supplier and supply chain data. In the CIVAC workspace, the LkSG representative and the ESG representative share the same data status. This typically saves 25 to 40 person-days in the specialist departments and around 10 to 20 representative days per reporting year. Over three years, these savings add up to a volume that refinances the workspace licence several times. In addition, the data quality increases with each reporting year because the supplier information is validated and compared with market data, which in turn reduces the effort for risk analysis.

The EU Directive 2024/1760 (Corporate Sustainability Due Diligence Directive, CSDDD) was passed in July 2024 and must be implemented into German law by July 26, 2026. It does not replace the LkSG, but supplements it in terms of content and tightens the scope. Initially only companies with 5,000 employees and 1.5 billion euros in net sales are included, in a second stage from 3,000 employees and 900 million euros, and finally from 1,000 employees and 450 million euros. The German implementation is expected to adapt the LkSG or replace it with a new law.

In terms of content, the CSDDD extends the due diligence obligations to the entire value chain, including indirect suppliers and, to a limited extent, downstream business partners. It also calls for a climate transformation plan with a 1.5 degree target and tightens civil liability. For external representatives, this means: The risk analysis must be deeper and broader, the complaints procedure must be interpreted more comprehensively, and the report must be expanded to include climate aspects. Coordination with the climate representative and the ESG officer will also be regulated more formally.

In terms of costs, annual flat rates for CSDDD-compliant external representatives will probably be 15 to 25 percent higher than the current LkSG flat rates. Anyone who works with Workspace and Officer-as-a-Service today benefits from the integrated data model and can map CSDDD requirements with moderate additional effort. Anyone who works with Excel will have structural problems and will be forced to build a data architecture in parallel with ongoing implementation. The appointment certificate, signed, filed, verifiable. The selection of an external representative should also include CSDDD competence as early as 2026 because renegotiation in the current mandate is usually more expensive than direct integration into the initial contract and because the transition phase creates several overlapping reporting regimes.

The question of whether an internal or external agent is cheaper cannot be answered in general terms. An internal representative, usually at senior manager level, costs between 95,000 and 140,000 euros per year, including additional wage costs, if the function is filled to 50 to 80 percent. In addition, there are training courses, specialist literature, memberships in industry associations and, if necessary, travel costs for supplier audits. The training period for a new internal representative is six to nine months, during which the function is only effective to a limited extent.

In contrast, an external representative in the officer-as-a-service model costs between 28,000 and 70,000 euros per year in full costs including workspace. The difference is explained by shared workload across multiple mandates, standardization of templates and integrated software. The trade-off is not in the quality, but in the loyalty: an internal representative is close to the business, an external representative brings comparative values ​​from other mandates and a fresh outside perspective. The risk of termination and the associated loss of knowledge is also lower with the external model.

In practice, we recommend a mixed form for companies with 3,000 or more employees: An internal senior employee with operational responsibility plus an external representative who takes on the function in accordance with Section 4 LkSG, represents them in audits and reports to BAFA. In the CIVAC workspace, this division is provided as a role configuration, with a clear separation of duties and a common database. Licence the workspace for your internal representatives or have our representatives order it. The mixed form reduces the risk of staff absence and makes it possible to flexibly add additional external capacity during peak times (BAFA report, audit, supplier crisis) without having to build up permanent staff.

The annual BAFA report in accordance with Section 10 Paragraph 2 LkSG has been mandatory since the 2023 reporting year. It follows a questionnaire with over 400 individual questions and must be submitted no later than four months after the end of the financial year. Experience shows an initial effort of 25 to 60 man-days, one third of which is for the representative and two thirds in the specialist departments. In the second year, the effort is halved when the data routes are in place and those responsible in purchasing, HR and the legal department are familiar with the questionnaire.

Hidden costs typically arise in three places. Firstly, with subsequent data corrections if supplier information does not match your own inventory. Secondly, for short-term complaint investigations, which BAFA expects as a follow-up report and which must be substantiatedly documented within four weeks. Thirdly, with training for purchasing and sales, which many companies underestimate, although Section 6 Paragraph 2 LkSG makes them mandatory and provides for fines for violations.

In the CIVAC workspace, the 400+ BAFA questions are linked to the internally collected data, so that the report is largely generated from the existing data. The FAQ section describes typical stumbling blocks. Audit templates for supplier audits, training certificates and complaint handling are available pre-configured, which reduces the effort required for audit preparation by around 30 percent and shortens the number of questions from the auditors. In addition, the reporting years are stored in version form so that a comparison of the risk analysis over three or five years is possible without additional effort and developments at individual suppliers or countries are directly visible, which BAFA sees as a positive indication of effective risk management and can be used in the audit as evidence of the effectiveness of the structures set up.

A robust external ordering contract includes seven elements. Firstly, the scope: which company, which subsidiaries, which locations, which joint ventures. Secondly, the catalogue of services: appointment certificate, annual risk analysis, BAFA report, complaint procedure, training concept, response obligations. Thirdly, the reporting line and frequency: typically quarterly reports to the management plus ad hoc in the case of acute incidents.

Fourthly, the hourly quotas for unplanned incidents, fifthly, the replacement regulations in the event of vacation or illness, sixthly, the liability limits and the contractor's insurance coverage, seventhly, the termination regulations with handover of the documentation. The handover of documentation is critical because without it a change of representative would mean the loss of the established evidence base, which leads to serious findings in the audit. Data protection clauses and confidentiality obligations are also included in the contract because the agent has access to sensitive supplier and employee data.

CIVAC contracts contain these elements in a standardised manner. The workspace remains the property of the client, the data remains in the German EU data residence, and the agent has logged access. If necessary, the data can be passed directly to a successor without a migration project. Others run compliance like a filing cabinet, we run it like software, with versioning, an audit trail and verifiable responsibilities. This architecture reduces the risk of a key person leaving the company and thereby breaking the compliance chain of records. The question of the insourcing option should also be regulated contractually if the company is setting up an internal position in the medium term and wants to transfer the external representative to an advisory role without losing the workspace or breaking the chain of receipts, which would be critical in the event of a dispute with BAFA. In the CIVAC model, the workspace remains with the client, regardless of whether the representative role is filled internally or externally, which significantly increases strategic flexibility.

CIVAC is a compliance platform and officer-as-a-service for 25 officer roles, including the Supply Chain Officer and the ESG Officer. Licence the workspace for your internal representatives or have our representatives order it. In the workspace you will find preconfigured LkSG risk matrices, supplier questionnaires, BAFA report templates, complaint workflows and training paths. By default, the EU data residency is active in Germany, which is relevant for both GDPR compliance and sensitive supplier data.

In the officer-as-a-service model, CIVAC provides you with an external supply chain representative, whose appointment certificate is signed after two working days. The quarterly reporting line to management is included in the model, as is the willingness to respond to acute incidents. The annual flat rates are transparent and plannable, which saves discussions about variable fees and hourly billing. In practice, depending on the complexity, we range between 28,000 and 70,000 euros per year, depending on the supplier structure and industry.

Turn reading into a mandate. If you would like to specifically estimate the costs for an external human rights officer or would like to outsource the order at short notice, write to info@civac.de or use the contact form on civac.de. A brief preliminary clarification typically includes number of employees, number of Tier 1 suppliers, geographical distribution and industry. We will contact you within one working day with a concrete proposal including an appointment for an onboarding discussion and a written fee overview. If you wish, you can also receive a comparison invoice against the hourly rate model and against your own order, so that management can make the decision on a reliable data basis. This comparative calculation can then be prepared for internal approval and budget processes without any additional effort. If necessary, we also coordinate the handover from an existing external representative and take over the migration of the historical data into the CIVAC workspace so that no chain of documents is lost.