Psychological risk assessment with the company doctor: process in seven steps

§ 5 ArbSchG obliges every employer to assess the risks associated with work, which has been expressly supplemented since October 25, 2013 by assessing psychological stress. Section 4 No. 1 ArbSchG requires that work be designed in such a way that a risk to life and health is avoided as far as possible. The supervisory authorities of the federal states, in particular the district governments and the accident insurance providers, have significantly increased the intensity of testing in psychological risk assessments over the past three years. Fines of up to 30,000 euros according to § 25 ArbSchG are documented if there is no or insufficient assessment; in particularly serious cases, § 26 ArbSchG imposes a criminal sanction.

This article is aimed at HR managers, HR business partners, safety officers and management in companies with 50 to 5,000 employees who have the psychological risk assessment carried out for the first time or on a regular basis. You will find out which seven steps structure the process, what role the company doctor plays, how confidentiality and documentation requirements are to be agreed, which methods are recognised, which documents the supervisory authority requests and how the CIVAC Compliance Platform and Officer-as-a-Service supports the process with standardised templates. The text does not replace individual occupational health advice, but rather structures the process.

The obligation to carry out a psychological risk assessment arises from several legal sources. Since 2013, Section 5 Paragraph 3 No. 6 ArbSchG has expressly named psychological stress at work as a risk factor to be assessed. The Joint German Occupational Safety Strategy GDA published a guideline in 2014 that specifies the requirements for method and documentation. The Occupational Safety Act ASiG supplements the obligation to provide company medical and safety-related care, the tasks of which are defined in Section 3 ASiG for the company doctor and Section 6 ASiG for the occupational safety specialist.

It is important to delimit the roles. The employer remains responsible according to Section 13 ArbSchG, but can assign the task in writing to reliable and competent people. According to Section 3 Paragraph 1 No. 3 ASiG, the company doctor provides professional support in assessing working conditions and selecting measures, but has no right to issue instructions to management. The occupational safety specialist according to Section 6 ASiG complements the ergonomic and workplace-related perspective. According to Section 87 Paragraph 1 No. 7 BetrVG, the staff council or works council has a right of co-determination in the method and implementation.

This distribution of roles must be determined in writing before the assessment begins. The company doctor is formally integrated with an appointment certificate, job description and reporting line to the management. The appointment certificate, signed, filed, verifiable. Failure to appoint a company doctor is one of the most common complaints in supervisory authority audits and regularly leads to orders with a deadline for improvement. Anyone who processes the order via CIVAC will receive the appointment certificate within two working days of placing the order. The appointment certificate also specifies the replacement arrangement in the event of vacation or illness in order to ensure continuity of company medical care.

Step 1 is preparation. The employer puts together the project team, which usually consists of management, human resources management, company doctor, occupational safety specialist, staff council or works council and a project coordinator. The project plan includes objectives, scope, methodology, schedule, responsibilities and budget framework. The management approves the project order in writing, which documents the seriousness of the approach in the audit.

Step 2 is determining the scope. In companies with homogeneous activities, the scope can include the entire company. In companies with heterogeneous activities, a breakdown according to work areas or activity groups is necessary. The GDA guidelines recommend a structure into a maximum of fifteen to twenty areas in order to keep the subsequent evaluation manageable. A structure that is too fine distributes the answers across samples that are too small, and a structure that is too coarse misses job-specific burdens.

Step 3 is the choice of method. Recognized methods include written employee surveys using standardised instruments such as the COPSOQ or the KFZA, moderated workshops and observation interviews in the workplace. The combination of survey and workshop is most common in medium-sized companies and provides quantitative data plus qualitative in-depth knowledge. The company doctor recommends the method based on industry-specific experience and the workforce structure. If there is a proportion of employees with a migrant background, the survey instrument should be available in multiple languages. The choice of method is coordinated with the works or staff council and recorded in writing by the employer. Others run compliance like a filing cabinet. We run it like software. The justification for the choice of method is a separate test point in supervisory authority practice and should cover at least half a page, including a reference to the selected validated instrument. A mixed method of survey and workshop has proven successful in practice because it combines quantitative validity and qualitative depth.

Step 4 is the operational implementation. The survey is carried out anonymously using a digital or paper-based instrument, with a minimum participation rate specified in the method agreement, usually sixty percent. Lower rates jeopardize the significance and are viewed critically in the audit. The company doctor monitors the methodological correctness, in particular the anonymity of the survey and the protection against drawing conclusions about individual employees.

The workshops typically follow one to four weeks after the survey. They serve to deepen conspicuous survey results and to identify specific working conditions that are relevant to stress. A workshop group includes six to twelve people from one work area, moderated by an external or internal person with workshop experience. The company doctor can provide professional support at the workshop, but is not necessarily present. Important: Workshops are not therapy sessions, but rather structured surveys about working conditions.

The survey of psychological stress must not become a survey of individual mental illnesses. The dividing line runs along the company doctor's duty of confidentiality in accordance with Section 203 StGB and Section 78 SGB X. Individual health data may not be passed on to the employer without the employee's express consent. However, aggregated findings from at least five employees per evaluation unit are not problematic. The occupational safety specialist complements the ergonomic perspective and checks whether the psychological stress also has a physical component, for example due to noise, lighting or shift work. The auditor calls, the evidence is ready. as soon as the survey methodology, the workshop protocols and the evaluation rules are documented. A workshop frequency of at least one workshop per work area is considered the minimum standard. In shift operations, additional workshops are required for each shift group in order to make shift-specific stress patterns visible.

Step 5 is the structured evaluation. The survey data is evaluated according to work area, hierarchy level and, if necessary, gender and age group, always taking into account the minimum group size of five people per evaluation unit. The GDA guidelines recommend an assessment based on the five stress areas of work content and work task, work organisation, social relationships, work environment and new forms of work. This structure allows comparison with reference values ​​from industry studies.

Measures are derived from the findings, divided into relationship prevention and behaviour prevention. Ratio prevention aims at the working conditions themselves, such as adjusting shift planning, reducing workload control or improving break room design. Behavioral prevention is aimed at employees and managers, such as stress management training, leadership training or resilience workshops. § 4 No. 1 ArbSchG primarily requires relationship prevention because it works structurally and not individually.

The measures are prioritised according to expected effectiveness and implementation effort and transferred to an action plan. Each measure is given the person responsible, deadline, budget and effectiveness indicator. The action plan is approved by management and coordinated with the works or staff council. In the CIVAC workspace, the action plan is managed as a task, with deadlines, responsible persons and status. The effectiveness is continuously checked and documented in accordance with Section 3 Paragraph 1 ArbSchG. Audit-proof, documented, § 5 ArbSchG-proof. The supervisory authority sees the effectiveness check as actual proof that the risk assessment is not a one-off paper, but a process. A pure initial assessment without follow-up inspection is considered not to have been carried out completely and will be criticized in the audit. Effectiveness indicators should be combined quantitatively and qualitatively in order to avoid false successes due to special effects. A reduction in sick days alone without an accompanying survey is not methodologically sufficient. The supervisory authority sees proof of effectiveness as a decisive factor.

Step 6 is the effectiveness check. It takes place after an appropriate period of effectiveness of the measures introduced, typically six to twelve months after the start of implementation. Methods include renewed surveys of the affected employees, qualitative interviews with managers and the evaluation of indirect indicators such as sick leave, fluctuation and the number of complaints. The effectiveness control is documented in a follow-up report that is attached to the action plan.

Step 7 is the update. The risk assessment is not a one-time exercise, but an ongoing process. Significant changes such as reorganizations, new work equipment, new working time models or the addition of new business areas trigger an update. Even without significant changes, the GDA guidelines recommend a complete repetition of the assessment every three years at the latest.

In practice, updating is the weak point. The initial assessment is carried out with great attention; the update disappears into day-to-day business. In the third round of audits, the supervisory authority often checks for outdated document statuses and complains about missing or delayed updates. The CIVAC workspace keeps update reminders automatically, with date, responsible person and prepared templates. Licence the workspace for your internal representatives, or have our representatives order it. In the Officer-as-a-Service variant, the CIVAC company doctor takes over the update as a standard process, which reduces the internal effort to a few coordination appointments. In the audit, this continuity is the central difference between a documented supervisory obligation and a de facto neglect with the risk of a fine. Anyone who integrates the update into the standard templates avoids the typical gap between year one and year three. An automatic reminder nine months before the planned update date gives the project team enough time to choose the method. This means that the effort is not postponed to a final phase with time pressure.

The medical confidentiality obligation is punishable in Section 203 of the Criminal Code and anchored in Section 78 of the SGB It includes all information that the company doctor obtains about individual employees in the course of his work, including examination results, conversation content and medical assessments. Passing on to the employer is only permitted with the express written consent of the employee or if there is a legal reason for notification.

In psychological risk assessment this means: Aggregated evaluations with at least five employees per evaluation unit may be passed on to the employer. Individual findings are not allowed. If a workshop identifies an individual employee with noticeable stress symptoms, the appropriate measure is a confidential conversation between the employee and the company doctor, not a report to the employer.

The employer receives the report on the psychological risk assessment in aggregated form, supplemented by the company doctor's recommendations for action. This separation is not only legally required, but is also an operational prerequisite for employees' willingness to participate. Anyone who does not provide convincing evidence of anonymity will not receive honest answers and therefore a worthless survey. The CIVAC workspace implements this separation technically: the company doctor area is separated, the employer only sees the aggregated evaluations. The clock starts on awareness. This double structure is the central protective function of the company doctor according to Section 8 ASiG, and it distinguishes company medical support from pure consulting services. Anyone who does not secure the separation technically risks data protection violations with consequences for fines according to Art. 83 GDPR.

The state regulatory authorities and the professional associations check the psychological risk assessment using a standardised checklist. The following are usually checked: presence of a written risk assessment in accordance with Section 5 of the ArbSchG with explicit recording of psychological stress, involvement of the company doctor and the occupational safety specialist, co-determination of the staff or works council, choice of method with justification, implementation documentation, action plan, effectiveness control and timeliness of the last assessment.

Typical complaints are: general statements without differentiation based on the work area, missing workshop protocols, missing Action plan with responsible persons and deadlines, lack of effectiveness control, outdated document statuses older than three years, insufficient involvement of the company doctor and lack of training evidence for managers on dealing with psychological stress. If there are several complaints at the same time, the supervisory authority can issue an enforceable order with a deadline in accordance with Section 22 ArbSchG.

In particularly serious cases, especially in the case of repeated complaints or proven damage to health as a result of the omission, Section 26 ArbSchG is relevant, which provides for a prison sentence of up to one year or a fine. This sanction falls directly on the management or the appointed responsible person. The CIVAC platform provides the required documents in a closed audit folder that can be exported with one click. The auditor calls, the evidence is ready. Anyone who doesn't use the workspace organises the same documents in a mix of Sharepoint folders, email attachments and paper files and loses time during the audit for purely collecting evidence instead of for discussing the content. Licence the workspace for your internal representatives, or have our representatives order it. The closed audit folder also contains the appointment certificates from the company doctor and the occupational safety specialist, which the supervisory authority regularly wants to see first.

The total costs of a psychological risk assessment depend on size, heterogeneity and choice of method. For a company with 200 employees and three to five work areas, the typical expense is between 12,000 and 28,000 euros for external support, including method preparation, surveys, three to five workshops, evaluation, recommended measures and reporting. In addition, there is the internal effort of around 60 to 140 person-hours for project management, workshop participation and implementation of measures.

The duration from the project order to the final report is typically three to six months. Steps 1 to 3 take four to six weeks, step 4 another four to six weeks, steps 5 to 7 another two to four months. An acceleration of less than three months is methodologically problematic because the effectiveness control requires an appropriate period of effectiveness of the measures.

The CIVAC variant combines the external company doctor with the workspace and reduces the preparation and documentation costs by typically thirty to fifty percent. The 490 ready-to-use audit templates cover all seven steps, from project plan template to effectiveness report. The external company doctor is formally integrated via the Officer-as-a-Service order, with an SLA of two working days for the order. Anyone who has the assessment carried out via CIVAC will not only receive the report but also the multi-year plan with update dates and automatic reminders. The total costs over a three-year cycle are typically eight to fifteen thousand euros less than traditional external support without a platform. Turning reading into an assignment begins with a short message to the CIVAC team and ends with a completed, audit-proof initial assessment within four to six months. In many cases, funding programs from professional associations reduce external costs by a further ten to twenty percent, provided the measures are designed to prevent accidents.

Anyone who has read the article up to this point knows the legal basis according to Section 5 ArbSchG and ASiG, the seven-step process, the company doctor's duty of confidentiality, the typical complaints from supervisory authorities and the cost structure. The next step is to take stock: When was your last mental health risk assessment carried out? Are the survey documents, workshop protocols, action plan and effectiveness control available in full? Is a company doctor formally appointed, with an appointment certificate, job description and reporting line? Is an update due within the next twelve months?

CIVAC works as a compliance platform and officer-as-a-service. The platform manages the project plans, survey instruments, workshop protocols, action plans, effectiveness reports and training certificates in a common workspace with EU data residency, separate access rights between the company doctor and employer and 93 controls according to ISO/IEC 27001:2022. Licence the workspace for your internal representatives, or have our representatives order it. In the Officer-as-a-Service variant, the external company doctor takes over the order, the methodical support of the risk assessment and the effectiveness control, regularly within two working days after the order is placed.

Turn reading into a mandate. A short email to info@civac.de with the industry, number of employees and status of the last risk assessment is sufficient for the first appointment. If you prefer to use the contact form, you can find it linked via the FAQ page. What you don't get: a generic workshop offer without any methodological depth. What you get: a concrete recommendation as to which method is suitable for your workforce structure, which steps should be implemented in which order and which templates you can use directly from the workspace. Verifiable, documented, with appointment certificate as soon as the basis for the order is in place. If you don't want to make an appointment straight away, you can request a checklist with the seven steps and the required documents as a PDF in advance.