FASI external: When an external occupational safety specialist is worthwhile

The Occupational Safety Act (ASiG) has required employers to appoint an occupational safety specialist (FASI) and a company doctor in writing since December 12, 1973. Since 2011, DGUV Regulation 2 (DGUV V2) has specified the required operating times and company medical and safety support. For many small and medium-sized companies, externally ordering FASI is the economically and technically convincing solution because their own qualified position would neither be fully utilised nor receive sufficient specialist training. The question is not whether, but how the external order is drawn up cleanly, with a clear reporting line to management and with documented proof of deployment time.

This article explains when FASI makes sense externally, which obligations must be specifically covered under ASiG and DGUV V2, what the appointment certificate should look like and which cost structures are common. CIVAC is a compliance platform and officer-as-a-service: Licence the workspace for your internal officers, or have our officers order it. With FASI, this means that an externally appointed specialist with documented qualifications and a verifiable record of working time can be productive within two working days. Anyone who only makes the order after an inspection risks a fine according to Section 209 SGB VII and, in the event of damage, personal liability consequences for the management, which become noticeable in ongoing business operations. A clean order not only protects the employee, but also the management itself.

The ASiG obliges every employer with at least one employee to appoint an occupational safety specialist (§ 5 ASiG) and a company doctor (§ 2 ASiG) in writing. The obligation applies regardless of the industry, legal form or company size. The tasks of FASI are listed conclusively in § 6 ASiG: advising management on all questions of occupational safety, safety-related inspection of operating systems and technical work equipment, investigation of accidents at work, and occasionally the safety-related inspection of new machines before they are put into operation.

The DGUV V2 has specified the minimum operating times depending on the industry and number of employees since 2011. It differentiates between companies with up to 10 employees (care group I, simplified model with basic care and event-related care) and larger companies (regular care with basic care and company-specific care). The basic care follows a fixed hourly schedule in Appendix 2 of the DGUV V2, staggered according to industry and number of employees.

The company-specific care is determined by the company together with FASI and the company doctor; it arises from specific reasons such as new activities, new facilities, risk assessments or accident hotspots. An external FASI covers both components and records the hours worked for each occasion. The FASI role overview at CIVAC describes this logic in detail. Others run compliance like a filing cabinet. We run it like software., and the timesheet is part of the software, not a report created after the fact. The ongoing updating of the DGUV V2 tables and the industry factors is automatically updated in the workspace, so that a change in the number of employees or a change in the tool code immediately leads to a new hourly invoice and does not require any manual readjustment.

The economic question of internal versus external FASI depends on three factors. The first variable is the number of employees. An internal FASI with fewer than 50 employees is usually underutilized. A mixed solution can make sense for between 50 and 250 employees. An internal FASI is often worthwhile for over 250 employees, provided the risk situation is sufficiently complex and constant.

The second variable is the risk complexity. Companies with hazardous substances, with activities in construction, with machines in risk classes B and C according to the Machinery Directive or with ATEX-relevant areas need continuous availability and in-depth technical expertise. An internal solution with external tip cover is often more economical here. The third factor is the need for specialist training. An internal FASI must undergo regular training (DGUV regulations, new ASR series, Machinery Ordinance 2027), the costs for this should not be underestimated.

External FASIs typically bring 4 to 8 clients with them, which ensures both their training and their breadth of practice. You are integrated into a security engineer network and are familiar with current government practice. CIVAC provides external specialists with documented qualifications in accordance with Section 7 ASiG and with industry experience. The dual model remains: Licence the workspace for your internal representatives, or have our representatives order it. Each company makes the decision based on its cost calculations, risk profile and availability requirements, and CIVAC supports both paths with the same platform and audit templates. With an external FASI, you avoid the personnel availability risks in the event of illness, vacation or termination, which often lead to bottlenecks in safety-related support for internally appointed positions. The loss of illness caused by an internal FASI is also often underestimated in practice; The external order acts as a robust security here.

The qualification of FASI is regulated by law in Section 7 ASiG. Safety engineers (engineering studies plus two years of practical work plus a safety-related course), safety technicians (technical training plus four years of practical work plus a course) and safety masters (master's examination plus four years of practical work plus a course) are permitted. The courses are offered by accredited educational institutions and conclude with an examination.

The requirement for further training does not arise directly from the ASiG, but is part of the DGUV principles for training and further education. Most professional associations expect FASI to provide continuous training for a defined number of hours per year, often based on a points system. In the case of an external FASI, this further training is organised and proven by the service provider, not by the contracting company.

CIVAC documents the formal qualifications, proof of further training, industry experience and the number of clients supported in parallel for each external FASI provided. The client can view this information in the workspace at any time, and the professional association auditor can receive it upon request. The auditor calls, the evidence is ready. This transparency is the prerequisite for the appointment of the external FASI to be recognised as sufficiently qualified by the supervisory authority, and it protects the management from later discussions about the professional suitability of the appointment in the event of an accident or an attack. The placement takes place with a clearly documented profile, including industry focus and years of experience, so that the fit with the company can be understood before the contract is concluded. The placement also includes a contractual arrangement for representation in the event of absence, so that safety-related support is guaranteed without interruption even during periods of vacation or illness.

A written order from FASI is mandatory according to Section 5 ASiG. It must specifically name the tasks, define the working time and regulate the reporting line. Simply placing an order via email or contract is not enough; the formal ordering act is required and will be specifically requested by the professional association in the event of an audit or accident.

The task description follows Section 6 ASiG. It includes advising the management, checking the safety of systems and work equipment, investigating accidents at work and occupational diseases, participating in risk assessments in accordance with Section 5 of the ArbSchG, training employees and participating in the occupational safety committee in accordance with Section 11 of the ASiG (20 or more employees). An external FASI fulfils all of these tasks regardless of the employment relationship.

The reporting line is legally clear: The FASI reports directly to the management (Section 8 ASiG). An intermediate level is not permitted because it would endanger the independence of the function. Discrimination because of the performance of tasks is prohibited by law. For each external FASI, CIVAC documents the appointment certificate, the task description, the reporting line and the hours worked for each occasion. The appointment certificate, signed, filed, verifiable. This documentation is available in the workspace and can be exported at any time as a verifiable package. You can find out more about the ordering process at civac.de/faq. If there is a change in personnel on the FASI side, the company's appointment certificate remains unchanged; Only the person acting is replaced and updated in the workspace, so that no contractual gaps arise. The appointment certificate is stored in the workspace with an electronic signature and can be found within seconds, which makes the crucial difference in the event of an unannounced inspection.

The DGUV V2 requires documented proof of the safety-related support provided. A fixed hourly schedule according to Appendix 2 applies to basic care; Event documentation is required for company-specific support. These occasions are listed in Appendix 4 of DGUV V2 as a non-exhaustive list: regular occasions (e.g. risk assessments, occupational safety committee), temporary occasions (e.g. new activities, new systems) and occasions without a fixed time reference (e.g. accidents, orders from authorities).

In practice this means: The FASI keeps an activity log in which every operation is documented with the date, reason, description of the activity, number of hours worked and result. The client confirms the protocol regularly, usually monthly. This protocol is checked during an inspection by the professional association or in the event of an accident.

CIVAC provides a digital record of working time in the workspace for external FASIs. FASI enters the activity immediately after each assignment, the client confirms with an electronic signature, and the professional association receives the filtered extract if necessary. Audit-proof, documented, § 5 ASiG-proof. The workspace links the deployment times with the associated reasons, such as specific risk assessments or accident reports, so that the technical relevance of each deployment remains comprehensible. This link is particularly crucial for later official requirements because it objectively proves the effectiveness of the safety-related support. In the event of an inspection, the extract can be handed over directly to the supervisor of the professional association, which shortens inspection times and reduces queries. The electronic signature by the management meets the written form requirements according to § 126a BGB, so that there is no need for an additional physical file folder and the documentation remains audit-proof. A later evaluation of the hourly structure also supports the planning of company-specific support in the following year.

The cost structure of an external FASI follows three components. The first component is the basic flat rate for the order, the appointment certificate, the initial risk assessment and the setup of the deployment time record. The second component is the hourly rate for the support provided, which varies depending on the region, industry and specialization.

The third component is special services: accident investigations, statements on new systems, attendance at official appointments or court proceedings, training courses with a higher level of preparation. These services are billed separately, usually at a daily rate or at an increased hourly rate. A serious contract structure contains a minimum quota for basic support and a pool for company-specific support with carryover provisions into the following year.

CIVAC offers the FASI order as an officer-as-a-service model with an order SLA of two working days, compared to the classic market of two to six weeks. The dual model remains: Licence the workspace for your internal representatives, or have our representatives order it. If there is an internal security engineer who handles the FASI function internally, the workspace is the appropriate solution because it automates timesheets and audit preparation. When no internal position exists or peak coverage is needed, external ordering is the efficient route. You can find a compact overview of facts about order models, SLAs and price structures at civac.de/facts. A later expansion to include additional representative roles or locations is contractually provided for as a modular increase and does not require a new contract, which makes scaling easier. As is customary in the industry, the contract terms are set at twelve months with the possibility of adjustments every six months in the event of significant changes. A transparent cost structure also significantly reduces the number of internal queries from controlling and purchasing during the contract term.

The FASI does not work in isolation. Four central interfaces are operationally relevant. The first interface is the company doctor according to Section 2 ASiG. FASI and the company doctor work together to provide safety-related and company medical care. They work together on the occupational safety committee, advise each other on risk assessments with health aspects and share responsibility for advising the management. An external FASI is often contractually linked to a company doctor who is also external.

The second interface is the fire protection officer. Fire protection according to DGUV-I 205-003 is closely linked to general occupational safety, especially for escape routes, fire protection measures during ongoing operations and during evacuation exercises. The third interface is the hazardous substances officer, if hazardous substances are used in the company in accordance with the Hazardous Substances Ordinance.

The fourth interface is the information security officer (ISB), especially when assessing cyber-physical risks. A compromised system control system can pose a security risk; The evaluation of this interface is classically shared between FASI and ISB. CIVAC brings these four interfaces together in the same workspace so that a risk assessment consolidates multiple perspectives and no data points need to be recorded twice. The Fire Protection Officer can be combined with FASI tasks as long as the qualification requirements for both roles are met and no role conflicts arise. This consolidation reduces the coordination effort between those responsible and significantly increases the effectiveness of preventative security work. Multiple recording of hazards is no longer necessary and the occupational safety committee works with a common database. The platform also manages the meeting dates of the Occupational Safety and Health Committee and the attendance documentation, which makes it easier to provide evidence in the event of later inquiries from the authorities. In practice, this common database is the quickest lever for eliminating recurring multiple documentation from occupational safety and information security.

FASI is involved in the investigation of work accidents and occupational diseases. The employer is responsible for the formal reporting obligation: report the accident to the responsible professional association within three days in accordance with Section 193 SGB VII in the case of accidents that result in incapacity for work for more than three days, report immediately in the case of deaths or serious accidents. Occupational diseases are reported by the doctor or employer as soon as there is reasonable suspicion. The FASI supports the safety-related assessment and the derivation of preventive measures.

For systems that require reporting, such as systems in accordance with Section 1 12 of the BImSchV (Major Incident Ordinance), a parallel reporting logic is added. Safety-related events with an impact on the environment are subject to the relevant deadlines, usually 24 hours for the initial report. In the case of KRITIS systems with cyber-physical integration, the BSI law applies in parallel with 24-hour early warning and 72-hour follow-up reporting.

CIVAC integrates the NIS 2-24/72 reporting path directly into the incident management in the workspace. If an event is recorded that triggers multiple reporting paths, the responsible officers (FASI, company doctor, incident officer, ISB) are informed at the same time and the relevant reports are prepared. Deadline begins as soon as we become aware of it. The reaction chain is documented in the workspace with time stamps, which in the event of a public prosecutor's investigation serves as proof of proper fulfilment of supervisory obligations to the employer in accordance with Section 130 OWiG and thus effectively protects the management. The close connection between accident management, incident management and reporting logic in the workspace prevents a report from being overlooked or being sent to the authorities late, which often leads to additional sanctions. The platform also supports the creation of the accident report and the transmission to the responsible professional association using preset forms, which is particularly valuable in the event of a first incident in the company.

If your company is currently operating without an ordered FASI or the existing order is not documented in a verifiable manner, the deadline is not abstract. Section 5 ASiG requires a written order from the first employee. As part of its inspection, the professional association checks the appointment certificate, proof of deployment time and the reporting line. If these documents are missing or incomplete, there is a risk of fines according to Section 209 SGB VII and, in the event of an accident, significant liability consequences for the management.

CIVAC is a compliance platform and officer-as-a-service based in Germany and with full EU data residency. The workspace includes 25 representative roles, 490 ready-to-use audit templates, 93 controls according to ISO/IEC 27001:2022 and an integrated NIS 2-24/72 reporting path for KRITIS systems. The dual model is the starting point: Licence the workspace for your internal representatives, or have our representatives order it and achieve a verifiable status with appointment certificate, task description and timesheet workflow within two working days.

Turn reading into a mandate. Write a short message to info@civac.de with your essential key data (number of employees, industry according to WZ code, existing orders, desired start date) or use the contact form on civac.de. Within one working day you will receive a tailored offer that specifically states the SLA, hourly quota, special services and workspace configuration. The offer is price and scope binding, so that a contract decision is possible without a second commercial round and the order date can be planned reliably. If desired, an initial review of the risk assessment will be carried out during onboarding and a prioritised action plan will be derived that structures the first 90 days of support. If desired, the FASI order can be linked to a fire protection officer order so that both ASiG-relevant roles are managed in a contractual relationship.