Audit Obligation (HinSchG)

Clarification: there is no general audit obligation under the HinSchG

What does 'Audit Obligation (HinSchG)' actually mean?

The term 'HinSchG audit obligation' was used in numerous compliance publications and marketing texts in 2024–2025 — usually with reference to a supposedly new § 22 HinSchG said to require an annual effectiveness review of the internal reporting office from 1 January 2026. This obligation does not exist. A check against the wording of § 22 HinSchG (gesetze-im-internet.de/hinschg) shows that § 22 governs the external reporting office at the Federal Cartel Office (Bundeskartellamt).

§ 22 HinSchG: the actual content

§ 22 HinSchG designates the Federal Cartel Office (Bundeskartellamt) as the external reporting office for reports of infringements of the Act against Restraints of Competition (GWB) and of the Digital Markets Act (DMA). Whistleblowers in the fields of antitrust law and platform regulation may therefore turn directly to the Federal Cartel Office — in parallel to the internal reporting office (§ 12) or to the general external reporting office at the Federal Office of Justice (BfJ) (§ 19).

Other external reporting offices under the HinSchG: § 19 BfJ (general), § 20 federal states (optional), § 21 BaFin (financial services).

Actual HinSchG obligations for companies

• § 8 — confidentiality of the identity of the whistleblower; document a confidentiality concept.
• § 11 — retention of the report documentation for three years after the procedure has been concluded.
• § 12 — obligation to establish an internal reporting office from 50 employees (the financial sector irrespective of size under § 12(3)).
• § 17 — processing deadlines: acknowledgement of receipt within 7 days, substantive feedback within 3 months.
• § 16(1) — anonymous reports: reporting offices should also process reports received anonymously (a 'should' provision under § 16(1) sentence 4). An obligation to maintain dedicated anonymous reporting channels expressly does not exist under § 16(1) sentence 5; there is no statutory cut-off date of 1 January 2025.
• § 36 — prohibition of reprisals with a reversal of the burden of proof.
• § 40 — fines of up to EUR 50,000 (natural persons; legal persons up to EUR 500,000 via the tenfold increase under § 30 OWiG).

Best practice: self-assessment of effectiveness (voluntary)

An annual self-assessment of the internal reporting office's effectiveness is good compliance practice and is provided for in ISO 37301:2021 (Compliance Management Systems) as part of the management review — it is, however, not a HinSchG obligation. It is useful as an annual management reporting instrument for risk and reputation management.

Germany and Austria compared

Germany (HinSchG): No general audit or effectiveness review obligation for internal reporting offices. What the law does require is the establishment and operation of an internal reporting office from 50 employees (§ 12; the financial sector irrespective of size under § 12(3)), confidentiality (§ 8), three-year retention (§ 11), processing deadlines (§ 17: acknowledgement of receipt within 7 days, feedback within 3 months) and the prohibition of reprisals (§ 36). The federal external reporting office is the Federal Office of Justice (BfJ) (§ 19); special external offices include the Federal Cartel Office (Bundeskartellamt) (§ 22) and BaFin (§ 21). Fines of up to EUR 50,000 (§ 40).

Austria (HSchG): The Austrian Whistleblower Protection Act (HSchG) likewise contains no general audit or effectiveness review obligation for internal offices (§§ 11–13 HSchG). What is mandatory is the establishment of an internal office from 50 employees (§ 11(1) in conjunction with § 3(1)), confidentiality (§ 7), written acknowledgement of receipt within 7 calendar days (§ 9(1)) and feedback on follow-up measures within 3 months (§ 13(9)). The external office is the Federal Bureau of Anti-Corruption (BAK) (§ 15). Fines are imposed by the district administrative authority (Bezirksverwaltungsbehörde) of up to EUR 20,000, and up to EUR 40,000 for repeat offences (§ 24).

Sources

• HinSchG (German Whistleblower Protection Act), gesetze-im-internet.de/hinschg
• HSchG (Austrian Whistleblower Protection Act) — internal office §§ 11–13, external office BAK § 15
• Federal Office of Justice (BfJ), federal reporting office
• Federal Cartel Office (Bundeskartellamt) — external HinSchG reporting office under § 22
• ISO 37301:2021 (Compliance Management Systems)

See also

• HinSchG: setting up an internal reporting office (§ 12)
• HinSchG confidentiality concept (§ 8)
• HinSchG updates 2024–2026 (fact check)
• Internal Reporting Office
• Whistleblower