LkSG report to BAFA: Guidelines for filling out, providing evidence and submitting

According to Sections 10 and 12 of the Supply Chain Due Diligence Act (LkSG), obligated companies are required to submit an annual report on the fulfilment of their due diligence obligations to BAFA and at the same time publish it on the company website. BAFA structures the report using a binding questionnaire with around 437 individual questions, which must be processed online in the BAFA report portal. Anyone who answers questions unclearly, without evidence or with standard formulations risks a review procedure and fines according to Section 24 LkSG.

This guide is aimed at management, compliance and sustainability officers as well as those responsible for LkSG in medium-sized companies. You will find out which companies have to report from which deadline, which structural logic the questionnaire follows, which documents must be kept for each section and which typical sources of error BAFA complains about in its audits. The goal is a verifiable report that documents the due diligence requirements and can withstand follow-up audits.

The LkSG has been in effect since January 1, 2023 for companies with headquarters or headquarters in Germany and at least 3,000 employees. Since January 1, 2024, the threshold has been lowered to 1,000 employees. Relevant are employees employed in Germany, including employees posted abroad, temporary workers for periods of more than six months and employees affiliated within the group in accordance with Section 1 Paragraph 3 LkSG.

The reporting obligation arises for each past financial year. The report must be submitted to BAFA no later than four months after the end of the financial year and at the same time published on the company website free of charge for seven years. For companies with a calendar year as their fiscal year, April 30th is the hard deadline.

Companies that are indirectly covered also come into contact with the LkSG: medium-sized companies below the threshold receive supplier questionnaires from their major customers, have to document human rights and environmental risks in-house and are named in their client's reporting chain. The planned EU CSDDD directive will further lower the thresholds after transitional periods. Deadline begins as soon as we become aware of it. Anyone who only names the LkSG representative after a customer audit is usually already too late.

The BAFA questionnaire is divided into eleven topic areas, which exactly follow the due diligence requirements of Sections 4 to 10 LkSG. Anyone who prepares the content of the report should follow this structure and name a responsible person for each complex.

1. General information about the company and the reporting period
2. Risk management according to Section 4 LkSG
3. Company responsibility, in particular human rights officer according to Section 4 Paragraph 3 LkSG
4. Risk analysis according to Section 5 LkSG
5. Declaration of principles according to § 6 para. 2 LkSG
6. Preventive measures in your own business area according to § 6 para. 1 and 3 LkSG
7. Preventive measures with direct suppliers according to § 6 para. 4 LkSG
8. Remedial measures according to § 7 LkSG
9. Complaint procedure according to § 8 LkSG
10. Indirect suppliers and event-related risk analysis according to § 9 LkSG
11. Documentation and reporting according to § 10 LkSG

Within each complex, closed questions (yes/no, multiple selection) alternate with free text fields. If the answer is yes, an in-depth question often needs to be followed. Standardized answers without company-specific reference are regularly rated as inadequate in the BAFA exam. Others run compliance like a filing cabinet. We run it like software.

The risk analysis according to Section 5 LkSG is the anchor on which all further answers depend. It must be carried out at least annually and on an ad hoc basis and affects the company's own business area, direct suppliers and, if there is substantiated knowledge, also indirect suppliers.

The report must conclusively explain which methodology was used, which data sources were included and how risks were prioritised. BAFA expects a combination of quantitative indicators (country risk indices, industry risks according to NACE) and qualitative sources (stakeholder surveys, NGO reports, audit results, own complaints).

Mandatory components of the answer are: the examined human rights and environmental risks (catalogue § 2 para. 2 and 3 LkSG), the geographical and sectoral distribution, the prioritization criteria (severity, Probability, contribution, possibility of influence), the supplier levels included and the derived prevention measures.

Frequent errors: purely qualitative description without prioritization logic, exclusion of the company's own operations, lack of connection between risk findings and concrete measures, no documentation of the update in the current financial year. In the CIVAC workspace, the risk analysis is stored as a versioned template that brings together prioritization, measures and effectiveness testing in one data view. The auditor calls, the evidence is ready.

The policy statement in accordance with Section 6 Paragraph 2 LkSG must be submitted by management and must contain three elements: the human rights and environmental risk profile, the expectations of employees and suppliers, and the procedure for implementing due diligence obligations. In the report, BAFA checks whether the declaration is publicly available on the company website, whether it contains the date and signature and whether it has been updated after significant changes.

Preventive measures in its own business area in accordance with Section 6 Paragraph 3 LkSG include anchoring the strategy in the relevant business processes, procurement practices, training and risk-based control measures. Each measure must be named in the report with the addressee, responsibility, frequency and effectiveness indicator.

Preventive measures for direct suppliers in accordance with Section 6 Para. 4 LkSG require consideration of human rights and environmental-related expectations when selecting, contractual assurances, training and contractual control mechanisms. General references to a Code of Conduct are not enough. Differentiated measures are expected for each risk cluster, for example for high-risk countries, critical raw materials or labour-intensive industries. Anyone who only names the measures in procurement guidelines but does not operationalize them in contracts, training courses and audits is not fulfilling their obligation. The appointment certificate, signed, filed, verifiable.

The complaints procedure is one of the most audit-intensive complexes. BAFA asks in detail whether there is an accessible, fair, confidential procedure conducted in a language understandable to the target group, whether reprisals are excluded and whether it is regularly checked for effectiveness.

Concrete mandatory information in the report: the accessible office (internal or external), the communication channels (web, telephone, letter, personal address), the languages covered, the confidentiality rules, the confirmation of receipt and processing deadlines, the number of tips received in the reporting period (aggregated, without personal reference), the type of information, the measures taken and the effectiveness test.

The rules of procedure must be published on the company website. A mere email address without a documented procedure is not enough. The integration with the Whistleblower Protection Act (HinSchG) is permissible and makes sense in practice, provided that the LkSG-specific requirements are met, in particular accessibility for external parties affected along the supply chain.

Frequent finding by BAFA: the procedure exists, but is not accessible to suppliers on the third or fourth level; or there is no documented effectiveness test. The workspace bundles LkSG and HinSchG reports in a pipeline and documents receipt, processing and effectiveness steps in an audit-proof manner. Audit-proof, documented, § 8-proof.

If a violation of a human rights or environmental obligation is discovered in one's own business area or with direct suppliers, appropriate remedial measures must be taken immediately in accordance with Section 7 LkSG. If there are violations in your own business area, the violation must be stopped. For direct suppliers, a concept for termination or minimization must be drawn up, with a specific schedule.

The report must describe the main violations, the measures taken, the effectiveness test and, if necessary, the temporary suspension of business relationships. A complete termination of the business relationship is the last resort and is only intended in the case of serious violations and unsuccessful escalation.

Indirect suppliers according to Section 9 LkSG must be included on an ad-hoc basis as soon as there is substantiated knowledge of a possible violation. Substantiated knowledge exists when actual evidence is credible, for example through complaints, NGO reports, press releases or our own audits. In this case, an event-related risk analysis, appropriate prevention measures, a concept for termination or minimization and an update of the policy statement are required.

The report must present these triggers transparently and describe the cases that became known in detail during the reporting period, as far as possible without reference to individuals. Anyone who does not provide any substantiated knowledge in the report field should be able to provide plausible reasons why there was no evidence.

According to Section 10 LkSG, the fulfilment of due diligence obligations must be continuously documented and retained for seven years. This documentation is the source of evidence for each answer in the BAFA report and must be submitted in the event of a review.

The report is submitted exclusively via the BAFA reporting portal. Prior registration of the company is required. The technical submission takes place in a structured online form; PDF submission is not permitted. Once sent, you will receive a submission confirmation with a process number, which must be archived.

Deadline: no later than four months after the end of the financial year. As a rule, there is no provision for an extension of the deadline. In the event of late submission or non-submission, there is a risk of penalty payments, fines and, after repetition, exclusion from public procurement procedures in accordance with Section 22 LkSG for up to three years.

Regarding the publication requirement: The report can be made available in parallel on the company website free of charge, without registration and for seven years. Personal data and business secrets must be blacked out. BAFA randomly checks availability and complains about missing or difficult-to-find publications.

CIVAC manages the LkSG documentation in the workspace with EU data residency and provides an export template whose fields match the BAFA reporting structure one-to-one. Licence the workspace for your internal representatives or have our representatives order it.

Recurring weaknesses can be derived from the BAFA evaluations of the first reporting cycles. Six patterns occur particularly frequently.

1. General answers without reference to the company. Building block formulations from sample texts generate questions. Answers should name specific business areas, countries, supplier groups or measures.
2. Risk analysis without methodology. Without an explicit description of the methodology (criteria, data sources, prioritization), the obligation is considered not to have been fulfilled.
3. Complaint procedure without access for those affected deep in the supply chain. Language, low threshold and accessibility must be proven.
4. Measures without effectiveness testing. § 6 Paragraph 5 and Section 8 Paragraph 5 LkSG require at least annual and event-related effectiveness tests.
5. No documented involvement of the management. The responsibility according to Section 4 Paragraph 3 LkSG requires written, documented regular information from the management.
6. Publication missed or cannot be found. Parallel web publication is mandatory. A hidden link in the sustainability report PDF does not meet the requirement.

If you address these six points clearly, you will avoid around 80 percent of the typical complaints and significantly shorten any follow-up review.

The LkSG report is the documented receipt of your due diligence obligations. It doesn't occur in April, but rather over the twelve months before. Anyone who carries out the risk analysis, the complaint procedure, the prevention and remedial measures as well as the effectiveness tests in a guided workflow will answer the BAFA questionnaire in days instead of weeks.

CIVAC is a compliance platform and officer-as-a-service with 25 representative roles, 490 ready-to-use audit templates and EU data residency. For the LkSG, the workspace bundles the risk analysis, the supplier register, the complaint procedure (interlinked with the HinSchG), the list of measures, the effectiveness tests and the management consultation in an audit-proof line. The export template reflects the BAFA structure, so that the report is created without double maintenance.

Licence the workspace for your internal representatives or have our representatives order it. Turn reading into an assignment. If you would like to prepare the next BAFA report in an audit-proof manner, write to info@civac.de or use the contact form on civac.de. We will get back to you within two working days with an assessment as to whether a workspace setup or an external appointment as a LkSG representative is the appropriate option.