Internal reporting office under the HinSchG, run externally

How it runs

1. 1

   Headcount and threshold

   We put together which German company has how many employees and which reporting routes exist today. Section 12 Para. 2 HinSchG attaches the duty to normally at least 50 employees per employer, while for the financial and insurance undertakings listed in Section 12 Para. 3 HinSchG it applies regardless of headcount. Where the group holds several small German entities, this is the point at which we look at the joint office that Section 14 Para. 2 HinSchG allows for employers with normally 50 to 249 employees. The assessment in your case belongs to your legal function; we supply the figures and the open points.

2. 2

   Entrustment and expertise

   The entrustment of a third party under Section 14 Para. 1 HinSchG is put in writing, together with the powers that Section 12 Para. 4 HinSchG requires the employer to give the internal reporting office. The officer acts independently under Section 15 Para. 1 HinSchG, and Section 15 Para. 2 HinSchG requires the employer to ensure the necessary expertise. The third sentence of Section 15 Para. 1 HinSchG is the argument for an external appointment: other duties must not create conflicts of interest.

3. 3

   Channel and communication to staff

   Channel, deputy and deadline logic are set up and agreed with your internal decision-making body. Employees are told how to report and what happens next, together with the information on external reporting procedures required by Section 13 Para. 2 HinSchG. Where a works council exists, the channel is agreed with it, and in practice that agreement sets the start date.

4. 4

   Running the office

   Every report goes through acknowledgement, examination of scope, examination of substance and feedback under Section 17 HinSchG. Feedback is given only in so far as internal enquiries are not affected and the rights of the persons who are the subject of the report are not impaired, Section 17 Para. 2 sentence 3 HinSchG. The facts and the courses of action go to your decision-making body, and the decision on the remedy stays there.

5. 5

   Evidence and analysis

   The documentation required by Section 11 HinSchG runs in the workspace with date of receipt, deadlines, form of record and deletion date. Anonymised analysis shows which areas reports come from and where policy or management is not working. For group internal audit and for auditors, the export is the evidence that deadlines were met and reports were handled.

The legal frame

These provisions determine who needs an internal reporting office, who may run it, what the officer has to bring and what a failure costs. Each is quoted in the German original, because that is the wording that binds, with the effect stated underneath.

Section 12 Para. 1 sentence 1 and Para. 2 HinSchG

Beschäftigungsgeber haben dafür zu sorgen, dass bei ihnen mindestens eine Stelle für interne Meldungen eingerichtet ist und betrieben wird, an die sich Beschäftigte wenden können (interne Meldestelle). Die Pflicht nach Absatz 1 Satz 1 gilt nur für Beschäftigungsgeber mit jeweils in der Regel mindestens 50 Beschäftigten.

The duty has two halves, setting the office up and operating it. It applies to employers with normally at least 50 employees, counted per employer, and it applies regardless of headcount to the financial and insurance undertakings listed in Section 12 Para. 3 HinSchG.

Section 14 Para. 1 HinSchG

Eine interne Meldestelle kann eingerichtet werden, indem eine bei dem jeweiligen Beschäftigungsgeber oder bei der jeweiligen Organisationseinheit beschäftigte Person, eine aus mehreren beschäftigten Personen bestehende Arbeitseinheit oder ein Dritter mit den Aufgaben einer internen Meldestelle betraut wird. Die Betrauung eines Dritten mit den Aufgaben einer internen Meldestelle entbindet den betrauenden Beschäftigungsgeber nicht von der Pflicht, selbst geeignete Maßnahmen zu ergreifen, um einen etwaigen Verstoß abzustellen.

The first sentence permits a third party to be entrusted with the tasks, which is the legal basis of this service. The second sentence draws the line: the employer still owes the remedy. Outsourcing the office does not outsource the risk.

Section 15 Para. 1 and Para. 2 HinSchG

Die mit den Aufgaben einer internen Meldestelle beauftragten Personen sind bei der Ausübung ihrer Tätigkeit unabhängig. Sie dürfen neben ihrer Tätigkeit für die interne Meldestelle andere Aufgaben und Pflichten wahrnehmen. Es ist dabei sicherzustellen, dass derartige Aufgaben und Pflichten nicht zu Interessenkonflikten führen. Beschäftigungsgeber tragen dafür Sorge, dass die mit den Aufgaben einer internen Meldestelle beauftragten Personen über die notwendige Fachkunde verfügen.

Independence and freedom from conflicts of interest are why the dual role with HR or internal audit regularly fails. On expertise the Act says that it is necessary and that the employer has to ensure it. No examination, no certificate and no number of training hours appears in the statute.

Section 40 Para. 2 and Para. 6 HinSchG

Ordnungswidrig handelt, wer 1. entgegen § 7 Absatz 2 eine Meldung oder dort genannte Kommunikation behindert, 2. entgegen § 12 Absatz 1 Satz 1 nicht dafür sorgt, dass eine interne Meldestelle eingerichtet ist und betrieben wird, oder 3. entgegen § 36 Absatz 1 Satz 1, auch in Verbindung mit § 34, eine Repressalie ergreift. Die Ordnungswidrigkeit kann in den Fällen des Absatzes 2 Nummer 1 und 3, der Absätze 3 und 5 mit einer Geldbuße bis zu fünfzigtausend Euro, in den Fällen der Absätze 1 und 2 Nummer 2 mit einer Geldbuße bis zu zwanzigtausend Euro und in den übrigen Fällen mit einer Geldbuße bis zu zehntausend Euro geahndet werden. § 30 Absatz 2 Satz 3 des Gesetzes über Ordnungswidrigkeiten ist in den Fällen des Absatzes 2 Nummer 1 und 3 und der Absätze 3 und 4 anzuwenden.

This mapping is reported wrongly across the market. Failing to operate an internal reporting office is the case in Para. 2 No. 2 and carries up to twenty thousand euros under Para. 6, while up to fifty thousand euros attaches to obstructing a report and to reprisals, meaning conduct after a report rather than the absence of the office. The second sentence of Para. 6 is why the half million euro figure quoted in this market does not belong here either: Section 30 Para. 2 sentence 3 OWiG multiplies the maximum fine against a legal person by ten, and Section 40 Para. 6 sentence 2 HinSchG declares it applicable only to Para. 2 Nos. 1 and 3 and to Paras. 3 and 4. For the missing reporting office under No. 2 the cap therefore stays at twenty thousand euros.

How the price is built

The price has four components, each shown separately. Without that split, a comparison of monthly figures compares offers that are cut differently.

• Headcount and the number of German companies that each need their own internal reporting office.
• Languages the channel has to be reachable in, which for an international group is usually German and English at minimum.
• Whether several companies with normally 50 to 249 employees use a joint office under Section 14 Para. 2 HinSchG.
• Expected volume of reports and the number of cases included in the fee.
• Whether the channel is additionally to allow anonymous submission.

You receive a fixed figure per component once headcount, entities and scope are settled. The platform is EUR 49 per officer role per month and is shown separately in the mandate.

Frequently asked

What does an external reporting office officer cost in Germany?

The price is made up of four components: a one-off set-up, a monthly fee for the role of the reporting office officer including a deputy, case handling per report, and optional training. The level depends on headcount, on the number of German companies that each need their own internal reporting office, on the languages the channel has to cover, on the expected volume of reports, and on whether the channel is also to allow anonymous submission. When comparing offers, look at the cut rather than at the monthly figure. Three questions separate a low price from a complete offer: is case handling above an included quota charged separately, and at what rate? Is the expertise required by Section 15 Para. 2 HinSchG, including a deputy, part of the price or a further item? And who carries the contractual consequence if the seven days under Section 17 Para. 1 No. 1 HinSchG or the three months under Section 17 Para. 2 HinSchG pass unanswered? Where a platform is offered without a named person, the reporting office officer is not part of the price and the role stays with you. You receive a fixed figure per component once headcount and scope are settled. The platform is EUR 49 per officer role per month and is shown separately.

Does the reporting office officer need a certificate of expertise?

The Act knows no certificate. Section 15 Para. 2 sentence 1 HinSchG reads: Beschäftigungsgeber tragen dafür Sorge, dass die mit den Aufgaben einer internen Meldestelle beauftragten Personen über die notwendige Fachkunde verfügen. The duty is addressed to the employer, not to the appointed person, and the statute names no examination, no certificate and no number of training hours. What the expertise has to cover follows from the tasks: the material scope of the Act, the procedure and the deadlines in Section 17 HinSchG, the follow-up measures under Section 18 HinSchG, the confidentiality requirement in Section 8 HinSchG and the documentation under Section 11 HinSchG. In practice it is evidenced through qualification, training records and professional experience, and where the office is filled externally it is documented in the mandate.

Does the internal reporting office have to allow anonymous reports?

Two sentences of the statute sit next to each other and are often merged. Section 16 Para. 1 sentence 4 HinSchG reads: Die interne Meldestelle sollte auch anonym eingehende Meldungen bearbeiten. Sentence 5 reads: Es besteht allerdings keine Verpflichtung, die Meldekanäle so zu gestalten, dass sie die Abgabe anonymer Meldungen ermöglichen. So processing reports that arrive anonymously is provided for, while the technical option to submit anonymously is not mandatory. An employer running an anonymous mailbox does more than the Act requires, and an employer without one still has to handle a report that arrives anonymously. Providers who claim a statutory duty to offer an anonymous channel are not reporting the wording correctly.

From how many employees is an internal reporting office required?

Section 12 Para. 2 HinSchG reads: Die Pflicht nach Absatz 1 Satz 1 gilt nur für Beschäftigungsgeber mit jeweils in der Regel mindestens 50 Beschäftigten. The decisive word is jeweils, meaning per employer: headcount is counted at the level of the individual employer, not across a group. Regardless of headcount, the duty applies under Section 12 Para. 3 HinSchG to the undertakings listed there, among them investment services firms, institutions within the meaning of the German Banking Act and undertakings within the meaning of the German Insurance Supervision Act. Section 14 Para. 2 HinSchG allows several private employers with normally 50 to 249 employees to set up and operate a joint office, but under sentence 2 the duty to remedy and the feedback to the reporting person stay with the individual employer.

What deadlines apply once a report comes in?

Two deadlines in Section 17 HinSchG set the pace. Receipt of a report has to be acknowledged to the reporting person no later than seven days, Section 17 Para. 1 No. 1 HinSchG. Feedback is owed within three months of the acknowledgement, and where receipt was not acknowledged, at the latest three months and seven days after the report was received, Section 17 Para. 2 HinSchG. The feedback covers the follow-up measures planned and already taken and the reasons for them. Under Section 17 Para. 2 sentence 3 HinSchG it may go only so far as internal enquiries are not affected and the rights of the persons who are the subject of the report are not impaired. The deadlines run through holidays and sickness, which is why a deputy arrangement is part of the mandate.

How is the whistleblowing platform set up technically and in data protection terms?

The channel takes reports orally and in text form as Section 16 Para. 3 HinSchG requires, and it allows a personal meeting on request. Access to incoming reports is limited to the persons responsible and those supporting them, as Section 16 Para. 2 HinSchG and the confidentiality requirement in Section 8 HinSchG prescribe, implemented in the workspace through per-case roles. Documentation is append-only and permanently retrievable as Section 11 Para. 1 HinSchG requires, audio recordings only with consent under Section 11 Para. 2 HinSchG, and deletion three years after the procedure is concluded under Section 11 Para. 5 HinSchG runs as a tracked deadline. Operation and support are provided from Germany, in German and in English. Hosting location, subprocessors, security standards and the data processing terms are named in the offer and in the contract rather than asserted on this page.

Does an AGG complaints body cover the HinSchG reporting office?

No. These are two duties with two scopes. The complaints body under Section 13 Para. 1 AGG receives complaints about disadvantage on the grounds listed in Section 1 AGG and applies regardless of headcount. The internal reporting office under Section 12 Para. 1 sentence 1 HinSchG receives reports of violations within the material scope of the HinSchG and is tied to normally at least 50 employees under Section 12 Para. 2 HinSchG. The deadlines differ as well: the AGG sets none for handling a complaint, while Section 17 HinSchG binds the reporting office to seven days and three months. The consequences differ too, since the AGG contains no fine provision and works through civil claims under Sections 15 and 22 AGG, whereas Section 40 HinSchG provides for an administrative offence. In practice both routes run side by side, and sorting an incoming report into the right one is part of the procedure, not a decision for the employee. CIVAC runs the two bodies separately and in the same workspace: the AGG side is described on the external complaints office page, and the routing of all complaint and reporting channels on the complaints management page.