Occupational Safety Consulting in Germany: Roles, Duties, and the External Specialist

Occupational safety consulting in Germany is not optional. The Arbeitssicherheitsgesetz (ASiG) of 1973 requires every employer to appoint a Fachkraft für Arbeitssicherheit (specialist for occupational safety, SiFa) and an occupational physician. The DGUV Vorschrift 2 (Accident Prevention Regulation 2) specifies the minimum supervision hours per employee, the qualification of the specialist and the documentation requirements. Failure to appoint a qualified specialist is an administrative offence under § 25 ASiG, sanctioned with fines up to 10,000 euros, and may trigger criminal liability under § 130 OWiG if a workplace accident occurs. The Bundesanstalt für Arbeitsschutz und Arbeitsmedizin (BAuA) and the accident insurance funds (Berufsgenossenschaften) audit appointments and documentation regularly.

This article explains the legal framework, the practical scope of an external occupational safety specialist, the mandate documentation, the interplay with the occupational physician and the integration into a broader compliance architecture. You will learn how the SiFa supports risk assessments under § 5 Arbeitsschutzgesetz (ArbSchG), how the documentation withstands a Berufsgenossenschaft audit and how CIVAC operates the mandate as a Compliance-Plattform und Officer-as-a-Service. License the workspace for your internal officers, or commission ours. The appointment certificate is signed, filed, and verifiable.

The German framework for occupational safety rests on three pillars. First, the Arbeitsschutzgesetz (ArbSchG) of 1996 transposes the EU Framework Directive 89/391/EEC and obliges the employer to ensure safe and healthy working conditions, to assess risks under § 5 ArbSchG and to document the assessment under § 6 ArbSchG. Second, the Arbeitssicherheitsgesetz (ASiG) requires the appointment of an occupational physician and a Fachkraft für Arbeitssicherheit (SiFa). Third, the DGUV Vorschrift 2, issued by the Berufsgenossenschaften, specifies the minimum supervision time and the qualification requirements.

The Sicherheitsfachkraft must hold one of the qualifications listed in § 7 ASiG: engineer, technician or master craftsman with additional training of at least 360 hours, plus practical experience. The training is accredited and ends with an examination by the Berufsgenossenschaft. An employer may employ the SiFa internally or commission an external specialist. External commissioning is the typical solution for small and medium-sized enterprises that lack the workload for a full-time internal appointment.

The supervision time under DGUV Vorschrift 2 follows a matrix. For office work (hazard category III), the basic time is 0.2 hours per employee per year, plus operational task time based on company size and complexity. For high-risk industries (chemicals, construction, metalworking), the basic time rises to 0.5 hours per employee. The total time is split between the SiFa and the occupational physician. An external mandate must cover both basic and operational tasks. The mandate certificate names the specialist, lists the hours and references the underlying DGUV calculation. Whoever appoints a Fachkraft für Arbeitssicherheit through CIVAC receives a signed appointment certificate within two business days. Signed, filed, verifiable.

The scope of the SiFa is defined in § 6 ASiG and refined in DGUV Vorschrift 2 Annex 3. The basic tasks include advising the employer and the works council on occupational safety, assessing workplaces and work processes, investigating accidents and contributing to occupational health management. The operational tasks are tailored to the company and include risk assessments, training, audits, supplier evaluations, ergonomic assessments and the integration of new equipment, processes and substances.

A typical deliverables list includes: risk assessments under § 5 ArbSchG (initial and annual review), operating instructions for hazardous substances and machinery, safety inspections of workplaces and equipment, training records for new hires and recurring training, accident investigation reports and the participation in the Arbeitsschutzausschuss (ASA) meetings under § 11 ASiG. The ASA convenes at least quarterly in companies with more than 20 employees and includes the employer, the works council, the SiFa, the occupational physician and the Sicherheitsbeauftragte (safety representatives).

Documentation is the hard currency. Each risk assessment, training record and ASA minute must be filed and dated. Auditors from the Berufsgenossenschaft request these documents during routine and incident-based audits. A compliance platform that versions every document and links each finding to the underlying risk assessment shortens the audit response time from days to minutes. CIVAC provides this platform with 490 ready-to-use audit templates, including risk assessment matrices, operating instructions and ASA minute templates. Others run compliance like a filing cabinet. We run it like software. The European Union data residency is active by default, so no occupational health data leaves the EU.

The risk assessment under § 5 ArbSchG is the heart of every occupational safety mandate. The employer must identify hazards, evaluate their severity and likelihood, derive protective measures, implement them and verify their effectiveness. § 6 ArbSchG adds the documentation requirement: the assessment must be recorded in writing or electronically, including hazards, measures and the date of the assessment. The Bundesarbeitsgericht has confirmed that a missing or superficial assessment can lead to direct personal liability of the managing director under § 130 OWiG.

The German framework requires consideration of physical hazards (mechanical, electrical, thermal, noise, vibration), chemical hazards (under the Gefahrstoffverordnung), biological hazards (under the Biostoffverordnung), psychological strain (under § 5 Abs. 3 Nr. 6 ArbSchG, added in 2013), ergonomic factors and work organisation. The latter category, psychological strain, is a frequent audit finding because many companies still treat it as a soft topic without structured assessment.

A robust assessment methodology proceeds in seven steps: define workplaces and activities, identify hazards, evaluate risks (often via a 5x5 matrix of severity and likelihood), define protective measures following the TOP principle (Technical, Organisational, Personal), implement and document measures, verify effectiveness, repeat at least annually or after significant changes. The Berufsgenossenschaft expects the assessment to be specific to each workplace, not a generic copy. A blanket statement "office work, low risk" does not survive an audit. The CIVAC workspace structures the assessment by workplace, hazard category and measure, and stores every version with author, date and approval. The SiFa workspace covers all standard sectors. The auditor calls, the evidence is ready.

Whether to appoint an internal or external SiFa depends on company size, hazard category and management bandwidth. For very small companies (up to 10 employees in low-risk sectors), the alternative model of DGUV Vorschrift 2 Annex 2 allows the employer to act as the safety responsible person after participating in a structured information and motivation programme, without appointing a full SiFa. For companies above this threshold, a qualified specialist is mandatory.

An internal SiFa makes sense when the supervision hours exceed roughly 60 percent of a full-time equivalent and the company has the budget for ongoing training and substitution coverage. Internal appointments build deep knowledge of the operations and shorten reaction times. The downside is the dependency on one person and the cost of ongoing qualification, including the 360-hour SiFa training, annual refresher courses and specialisation modules (machine safety, construction sites, chemicals).

An external SiFa is the typical solution for small and medium-sized enterprises and for distributed organisations with multiple sites. Advantages include immediate availability of a qualified specialist, cross-industry experience, substitution coverage by the consulting partner and a clear cost structure based on the hours under DGUV Vorschrift 2. Disadvantages include the limited on-site presence and the dependency on the external partner's scheduling. CIVAC operates as Compliance-Plattform und Officer-as-a-Service: license the workspace for your internal officers, or commission ours. The external appointment is issued within two business days. The classical lead time of two to six weeks no longer applies. Signed, filed, verifiable.

The SiFa does not work alone. § 8 ASiG defines the cooperation duty with the occupational physician, the works council and the Sicherheitsbeauftragte. The occupational physician focuses on health surveillance under the Arbeitsmedizinische Vorsorge-Verordnung (ArbMedVV), the SiFa focuses on technical safety. Both jointly attend the Arbeitsschutzausschuss (ASA), the central forum for occupational safety topics in the company. The ASA convenes at least quarterly under § 11 ASiG and produces minutes that are part of the audit evidence.

The works council has co-determination rights under § 87 Abs. 1 Nr. 7 Betriebsverfassungsgesetz (BetrVG) in matters of occupational safety. The SiFa supports the works council by providing risk assessments, accident reports and proposed measures. Disagreements between the employer and the works council on safety measures can lead to mandatory mediation by the conciliation board (Einigungsstelle). A well-documented SiFa report, prepared independently, often resolves disputes before they reach the conciliation board.

The Sicherheitsbeauftragte under § 22 SGB VII are appointed by the employer in companies with more than 20 employees. They support the SiFa in the workplace and report hazards and near-misses. The SiFa trains them and meets with them regularly. The reporting line goes from the Sicherheitsbeauftragte to the SiFa, from the SiFa to the employer and the ASA. CIVAC manages this reporting line in the workspace, with versioned minutes, action items and follow-ups. License the workspace for your internal officers, or commission ours. The auditor calls, the evidence is ready.

The cost of an external SiFa mandate is driven by the supervision hours under DGUV Vorschrift 2 and the hourly rate of the specialist. Typical hourly rates range from 90 to 150 euros for routine work, and 150 to 250 euros for specialised tasks (machine safety, hazardous substances, construction). A typical small enterprise with 30 office employees and hazard category III pays roughly 4,500 to 8,000 euros per year for SiFa and occupational physician combined, depending on operational tasks.

The mandate contract should specify the hours, the included tasks, the surcharge for additional work, the substitution coverage, the travel cost handling and the termination conditions. A modular structure with a base mandate and predefined add-ons (additional site visits, accident investigation, ergonomic assessments) provides cost predictability. Beware of low-cost offers that undercut DGUV Vorschrift 2 minimum hours, because they regularly fail audits.

The reporting and documentation should be included in the base mandate, not charged separately. A specialist who charges for every risk assessment update creates incentives to delay documentation. CIVAC offers a flat workspace fee plus the SiFa hours under DGUV Vorschrift 2, with documentation included. The SLA of two business days for new appointments and template updates replaces the classical lead time of two to six weeks. Whoever waits for the next quarterly visit to update a risk assessment after a workplace change has misunderstood the mandate. The risk clock runs from the moment of knowledge. Signed, filed, verifiable.

Occupational safety does not stand isolated. Three intersections are particularly audit-relevant. First, the NIS-2 Implementation Act (NIS2UmsuCG) and the underlying BSIG include cybersecurity training as part of operational risk management. Cybersecurity awareness training overlaps with workplace safety training, and the SiFa typically participates in the alignment. Roughly 29,500 companies in Germany fall under NIS-2, with fines up to 10 million euros or 2 percent of group turnover for essential entities.

Second, ISO 45001:2018 (Occupational Health and Safety Management Systems) provides a voluntary certification framework that aligns with the ASiG and the ArbSchG. Companies that hold ISO 45001 satisfy most of the documentation requirements of the German framework and benefit from internal management system structures: leadership commitment, worker participation, planning, support, operation, performance evaluation and improvement. The integration with ISO 9001 and ISO 14001 (the High-Level Structure) facilitates a combined management system.

Third, the Hinweisgeberschutzgesetz (HinSchG), in force since July 2023, requires companies with 50 or more employees to operate an internal reporting channel. Occupational safety incidents, near-misses and bullying are typical reporting topics. The SiFa cooperates with the internal reporting office (Interne Meldestelle) under the HinSchG to ensure that safety-related reports are processed promptly. CIVAC integrates the SiFa workspace with the whistleblowing module and the NIS-2 documentation, providing a single source for audit evidence across three frameworks. Multiplicity of records is a tooling question, not destiny. Audit-ready, documented, § 5-ready. A consolidated platform also reduces the workload of the internal control system under § 130 OWiG, because the same evidence supports occupational safety, cybersecurity and whistleblowing audits.

A Berufsgenossenschaft audit examines a defined set of documents. First, the written appointment certificate for the SiFa and the occupational physician under § 5 ASiG, with names, qualifications and hours. Second, the risk assessments under § 5 and § 6 ArbSchG, with versions, dates and approvals. Third, the operating instructions for hazardous substances under § 14 GefStoffV and for machinery under § 9 BetrSichV. Fourth, the training records under § 12 ArbSchG, with dates, contents, participants and signatures.

Fifth, the ASA minutes under § 11 ASiG, at least four per year for companies with more than 20 employees. Sixth, the accident records under § 193 SGB VII for accidents leading to more than three days of absence, reportable to the Berufsgenossenschaft. Seventh, the surveillance and follow-up of corrective measures from previous audits. Eighth, the personal protective equipment (PPE) inventory and the maintenance records of safety-critical equipment. The auditor typically requests a sample, not the full archive, and judges by quality and currency.

The most common audit findings are: outdated risk assessments (older than 12 months without revision), missing operating instructions for newly introduced equipment, incomplete training records (missing signatures or dates), missing or incomplete ASA minutes, and missing follow-up on previous audit findings. A compliance platform that automates the recurring reviews, sends reminders for upcoming deadlines and stores every document with version and approval reduces these findings significantly. CIVAC offers the platform with 490 ready-to-use templates and an audit-mode export that produces the complete audit dossier as a PDF within minutes. The auditor calls, the evidence is ready.

Occupational safety is not a quarterly afterthought. It is the daily operational risk that determines whether an accident becomes a tragedy or a near-miss. CIVAC is a Compliance-Plattform und Officer-as-a-Service that operates the SiFa mandate as a continuous process, not as a periodic visit. The workspace holds risk assessments, training records, operating instructions, ASA minutes, accident reports and follow-ups in one versioned archive. Every record is linked to the workplace, the activity and the hazard category, so audit queries are answered in minutes.

License the workspace for your internal SiFa, or commission ours. The appointment certificate is issued within two business days, not the classical two to six weeks. It is signed, filed and connected via the reporting line to senior management. In the event of an accident, the BG-meldung is prepared, the investigation template is ready and the corrective action plan integrates with the risk assessment update. The classical fragmentation between SiFa file, occupational physician file and ASA minutes is resolved into a single source of evidence.

Whoever reviews the occupational safety status only during an audit has already lost. Whoever operates a structured, versioned, audit-ready file with a clear reporting line significantly reduces fines under § 25 ASiG and personal liability under § 130 OWiG. Turn reading into a mandate: write to info@civac.de or use the contact form on civac.de to commission an external Fachkraft für Arbeitssicherheit or license the workspace. We send a sample file with risk assessment template, operating instructions and ASA minute template, tailored to your sector and hazard category. A 30-minute initial consultation with the SiFa is part of the first contact. Others run compliance like a filing cabinet. We run it like software.