LkSG audit and BAFA report form: How to fill out the mandatory 2026 report in an audit-proof manner

According to Section 10 LkSG, obligated companies are required to report annually to the Federal Office of Economics and Export Control by June 1st at the latest. The BAFA report form includes over 400 questions, spread over nine thematic blocks, from the declaration of principles to the effectiveness control. According to Section 24 LkSG, anyone who does not submit on time or submits incomplete risk fines of up to 8 million euros or 2% of global group sales as well as exclusion from public contracts for up to three years. In addition, since 2025, BAFA has been carrying out downstream checks more and more frequently, requesting concrete evidence and publishing fine decisions with an impact on its reputation.

This article explains how to fill out the BAFA report form in an audit-proof manner, which documents must be kept for each question block and how the LkSG audit as an internal preliminary check secures the report. You will find out which answers BAFA considers to be sufficient, which formulations generate queries and how supplier and risk data can be managed in a platform so that the report becomes a routine process. The compliance platform and officer-as-a-service CIVAC provides workspace, templates and officers in two working days so that reading becomes a concrete draft report. Once you have built an architecture that keeps supplier, risk, complaint and training data in one file, you can turn the annual report into a routine process without any special effort and at the same time protect the management from § 130 OWiG risks.

The Supply Chain Due Diligence Act has been in effect since January 1, 2024 for companies with 1,000 or more employees with headquarters or statutory headquarters in Germany. This means that around 3,500 companies are covered directly, and significantly more indirectly via supplier cascades. The reporting obligation according to Section 10 LkSG requires an annual report to be submitted in electronic form via the BAFA portal by June 1st of the following year at the latest. There is no extension, the deadline is strict and is consistently monitored.

The reporting obligation is linked to the previous financial year. Reports for the 2025 financial year must therefore be reported by June 1, 2026. The report must be filled out in the BAFA portal using a form that automatically controls mandatory and conditional fields. Answers can be saved, but must be approved before submission. After submission, only limited corrections are possible, which is why internal approval processes are necessary before submission.

Anyone who conducts the LkSG audit as an internal preliminary audit gains two weeks' notice for readjustment. The LkSG representative is responsible for the procedure, acts with professional freedom of instruction and reports directly to the management. According to Section 4 LkSG, this reporting line must be documented and should be included in every appointment certificate. Deadline begins as soon as we become aware of it. The appointment certificate, signed, filed, verifiable. Anyone filling out the report form for the first time should plan at least four weeks' lead time; with a platform solution with Officer-as-a-Service, the lead time is significantly shorter. Experience has shown that internal teams without a platform need twelve to twenty person-days for the initial report; for the follow-up report, the effort is halved if the data architecture is clean. A preliminary LkSG audit identifies the largest gaps. This allows for a clear roadmap. Platform and officer together form the acceleration.

The report form is divided into nine thematic blocks. Firstly, general information about the company, number of employees, group of companies and subsidiaries. Secondly, the declaration of principles according to Section 6 Paragraph 2 LkSG with the definition of human rights and environmental goals. Third, the risk management system with risk analysis, preventive measures and remedial processes. Fourth, the complaint procedures according to Section 8 LkSG with accessibility, confidentiality and procedural path. Fifthly, the documentation of the risk analysis with identified risks in your own business area and with direct suppliers.

Sixthly, preventive measures with effectiveness tests and concrete evidence such as supplier training, contractual clauses and audits. Seventh, corrective actions after identified violations with escalation examples, termination decisions and consequences of actions. Eighth, the documentation of the effectiveness checks with frequency, methodology and results. Ninth, reporting with internal escalation, management report and supervisory bodies. Every block expects concrete, verifiable statements.

Anyone who answers in general terms or uses wording as usual or regularly will generate questions from BAFA. Specific numbers, dates and document references are mandatory. In the CIVAC workspace, the nine blocks are displayed as a questionnaire with answer templates, evidence fields and escalation paths. The 490 audit templates include supplier questionnaires, training records and audit reports. Audit-proof, documented, paragraph-proof. Others run compliance like a filing cabinet. We run it like software. Switching between the topic blocks requires a chronological and logical order in the form, which quickly leads to disruptions without platform control. If you work on several blocks in parallel, you lose track of consistencies that will later be noticed during BAFA checks. A central platform with configured response modules prevents this risk and makes the report verifiable and reproducible. Even if there is a later change of auditor, the methodology remains comprehensible. This is exactly where the practical added value lies. The control in the workspace follows a clear logic.

The declaration of principles according to Section 6 Paragraph 2 LkSG is the heart of the due diligence concept. It must be concrete, company-specific and approved by management. BAFA considers generic statements from templates without reference to the industry, supplier structure and identified risks to be inadequate. In particular, the declaration must identify the human rights and environmental-related expectations of employees and suppliers, define responsibilities and describe how to proceed in the event of risks.

The risk analysis in accordance with Section 5 LkSG must be carried out annually and on an ad hoc basis. It covers own business areas and direct suppliers, and in exceptional cases also indirect suppliers if there is substantiated knowledge. The methodology must be documented in a reproducible manner, for example using risk indicators such as country, industry, procurement volume and supplier history. The BAFA form explicitly asks about the methodology and concrete examples of identified risks as well as prioritization.

Anyone who identifies risks must initiate preventative and, if necessary, remedial measures and check their effectiveness. The report must present this chain of effects in a comprehensible manner. In the LkSG representative profile at CIVAC, these steps are shown in workflows. The EU data residency protects sensitive supplier data from third country transfers. The auditor calls, the evidence is ready. The appointment certificate, signed, filed, verifiable without having to search multiple systems in parallel. A consistent methodology with a comprehensible risk matrix, identified priority countries, sampling logic and impact paths is therefore essential. Anyone who reinvents risk analysis every year loses time and produces breaks in the report. A reusable methodology in the workspace with clear versions ensures consistency over the years and measurably reduces the effort required to create each subsequent report. The methodology documentation becomes the core. Methodology beats improvisation in every reporting year. This means that every new reporting phase begins on a solid basis.

Preventive measures according to Section 6 Paragraphs 3 to 5 LkSG include training, contractual clauses, supplier questionnaires, audits and continuous risk monitoring. BAFA requires concrete evidence: lists of training participants, supplier questionnaire templates, audit reports with dates and auditors, sample contract clauses and evaluations of risk monitoring. General references to internal processes without proof of documentation are considered inadequate and lead to review procedures that often take several months to process.

Remedial measures in accordance with Section 7 LkSG are required if a violation has been identified in your own business area or at a direct supplier. The law requires an action plan with a deadline that aims to stop or minimise the violation. In the case of direct suppliers, termination of the business relationship may ultimately become necessary. The report must provide concrete examples without violating confidentiality obligations towards suppliers.

In the CIVAC workspace, measures are linked to deadlines, responsible parties and effectiveness control. The training modules maintain lists of participants with receipts, supplier questionnaires are sent automatically and returns end up in the supplier file. Audit reports are linked to supplier data. The 490 audit templates cover standard cases, such as suspicion of forced labour, child labour, unacceptable working conditions or environmental damage. Turning reading into an assignment is the operational reality here, because every insight becomes a concrete task. Anyone who does not systematically document the progress of measures in the current year will be faced with an impossible burden of tasks on June 1st. The workspace prevents this risk through consistent, continuous documentation along defined event types, so that only aggregation takes place on the reporting day. This means that the report becomes a logical consequence of day-to-day business and not a special project with its own preliminary phase. The workspace connects all documents in the data model. External auditors can also find their way into the file more quickly.

§ 8 LkSG requires the establishment of a complaints procedure that is accessible to internal employees, external employees along the supply chain and indirect suppliers. The procedure must ensure confidentiality, ensure protection against reprisals and describe a clear procedural path. In the report form, BAFA checks how accessible the procedure is, how many complaints were received, how they were treated and what measures followed.

Dovetailing with the Whistleblower Protection Act according to the HinSchG makes sense because many companies have to run an internal reporting office anyway. Both procedures can be combined organizationally, provided that the specific LkSG requirements remain met, in particular the extension of the scope of application to external suppliers and those affected. The training of the reporting office must cover both regulatory regimes, and the documentation must be able to be kept separately.

In the CIVAC workspace, the complaint and whistleblower procedure is depicted as a common but categorised data room. The internal reporting office according to HinSchG can be managed by the same role as the LkSG representative or by a separate role. EU data residency ensures that sensitive information does not reach third countries, and multilingual templates facilitate accessibility for suppliers in different regions. In the report form, BAFA checks whether the procedural rules are clearly formulated, whether complaints can be submitted anonymously and how many complaints were received per reporting year. An empty procedure without any information received is critically examined because it can be an indication of a lack of accessibility or lack of publicity. Multilingual templates and low-threshold access are therefore mandatory. The LkSG officer actively controls the access channels. Language and accessibility determine credibility. The platform supports this with multilingual templates.

The effectiveness check according to Section 4 Paragraph 4 LkSG must be carried out annually and on an ad hoc basis. It checks whether the measures taken actually reduce the risks. The report must document frequency, methodology and results. General statements such as measures that have been tested and found to be effective are not sufficient. Specific KPIs are expected, such as the number of audits carried out, categories of findings, action rates and escalations with those responsible.

According to Section 10 Paragraph 1 LkSG, the documentation must be retained for at least seven years. BAFA can request receipts at any time, even outside the reporting period. A consolidated platform with versioning, audit trail and EU data residency is therefore de facto standard. Anyone who keeps documents distributed across multiple tools runs the risk of gaps, inconsistencies or misinterpretations when subsequent requests are made, which can be seen as evidence of insufficient care.

There are 490 audit templates ready for use in the CIVAC workspace that reflect effectiveness controls. Supplier scorecards, training rates, complaint handling rates and audit findings flow into standardised dashboards. The 25 officer roles are live, and the LkSG officer can collaborate with the compliance and ESG officer without creating parallel data silos. Audit-proof, documented, paragraph-proof. Others run compliance like a filing cabinet. We run it like software. Anyone who works with the platform also benefits from automated reminders for event-related effectiveness checks, for example after reported incidents, major changes in suppliers or geopolitical changes in procurement markets. This turns the effectiveness control from a reactive process into a proactive control instrument and at the same time provides a reliable track for the next BAFA audit. This means that the role of supervision is changing noticeably. In this way, event-related effectiveness checks become routine. The management receives a reliable status report on the effectiveness of measures at any time. This control provides security for supervision and management.

The first mistake is using generic answers without company-specific reference. Answers such as We carry out a risk analysis are considered inadequate. A concrete approach with methodology, samples and examples is expected. The second error is the lack of consistency between answers and evidence presented. If the policy statement announces training for all suppliers, but the training block only shows a 30% participation rate, BAFA will inquire or determine a violation.

The third error is the lack of quantification. BAFA asks for concrete figures on the number of suppliers, risk categories, audits, complaints and measures. Anyone who only answers prosaically will have to make adjustments. The fourth mistake is unclear responsibility. If the report form does not clearly identify an LkSG representative, BAFA will request the appointment certificate and, if necessary, complain to the supervisory organisation. This can result in a breach of supervisory duty relevant to Section 130 OWiG.

The fifth error is the lack of integration into other compliance processes. LkSG data overlaps with ESG data, data protection data and whistleblower data. If you don't interlink these, you will maintain data twice and produce inconsistencies. The CIVAC FAQ documents the most common error patterns from BAFA procedures and refers to suitable workspace templates, so that the report quality is already high in the draft and does not only arise as a late correction. A systematic comparison of answers and supporting documents prior to submission prevents most of these errors. A platform with linked documents carries out this comparison automatically and blocks release if inconsistencies are detected. This reduces the risk of BAFA additional demands significantly, and management can release the report with a clear conscience, without worrying about late requests for corrections.

Whoever creates the report for the first time should start with a structured onboarding. On the first day, the inventory is taken: which supplier data is available, which policy statement exists, which complaint procedures are active. The gaps are identified and prioritised. On the second day, the missing building blocks are added: adapt the policy statement template, set up a new risk analysis based on the supplier master data, and define effectiveness controls. This means that the platform is reportable, even if the first report has not yet been finalized.

The compliance platform and officer-as-a-service CIVAC provides the complete stack for this. 25 representative roles are live, 490 audit templates are ready for use, the LkSG representative workflow is configured. Licence the workspace for your internal representatives, or have our representatives order it. Both models use the same file structure, which enables changes without data loss. The CIVAC SLA of two working days replaces classic procurement channels of two to six weeks and thus also protects tight deadline cases before June 1st.

In the workspace, the appointment certificate, reporting line, risk analysis, supplier base, training, complaints and audits are linked in one file. The EU data residency protects sensitive data from third country transfers in accordance with Art. 44 GDPR. Versioning ensures the evidence base for seven years in accordance with Section 10 Paragraph 1 LkSG. For additional BAFA claims, the complete evidence path can be opened in just a few clicks. The auditor calls, the evidence is ready. With each subsequent report, the effort is reduced because the master data, methodology and documents are already in place. In the third reporting year, LkSG reporting is typically reduced to half a person day plus two working days of platform maintenance. This creates capacity for strategic topics such as CSDDD preparation, ESG data architecture and supplier transformation, which represent the true value proposition of due diligence.

The BAFA report is not an end in itself. It is a reflection of a robust due diligence process. Anyone who sets up the report as a routine process gains three effects: a verifiable defence of the supervisory obligation in accordance with Section 130 OWiG, credible arguments to major customers and banks, and preparation for the EU supply chain directive CSDDD, which will gradually introduce additional requirements from 2027. Anyone who only sees the report as a requirement is wasting the investment in the data architecture.

The compliance platform and officer-as-a-service CIVAC provides the architecture that creates these three effects at the same time. 25 representative roles are live, 490 audit templates are ready for use, 93 controls are mapped according to ISO/IEC 27001:2022, and the NIS-2 24/72 reporting path is configured. Appointment certificates, reporting lines and supplier files are in EU data residence. The CIVAC SLA of two working days replaces classic procurement channels. Licence the workspace for your internal representatives, or have our representatives order it. Both models use the same reporting standard, ensuring consistency across reporting years.

Turn reading into a mandate. Write to info@civac.de or use the contact form on civac.de. In the first conversation, we clarify your area of ​​employment, classify the LkSG obligations and show you how to set up the BAFA report form in an audit-proof manner in two working days. The appointment certificate, signed, filed, verifiable. The auditor calls, the evidence is ready. This is exactly what CIVAC is built for. Anyone who prepares the report today will be prepared for CSDDD tomorrow because the central data architecture can largely be adopted there. Investing in a clean LkSG reporting architecture is therefore also an investment in the future viability of the entire ESG compliance, well beyond the current reporting year. That is exactly the real operational leverage. The step from reporting to reliable care is small.