HinSchG Effectiveness Self-Review 2026: 12 Audit Points for Compliance Officers

Why an effectiveness self-review makes sense

A self-review makes sense because it demonstrates compliance with the hard duties of the HinSchG before a supervisory authority, a court or your own management asks about it — it does not create a statutory audit obligation. Even without an obligation: a structured annual self-review of the internal reporting channel is a widespread practical recommendation and fits into the performance evaluation of a compliance management system under ISO 37301 (clause 9 — "Performance evaluation"). It bundles evidence for requests for information from the external reporting channels (§ 29(1) HinSchG; BfJ § 19, BaFin § 21, Federal Cartel Office (Bundeskartellamt) § 22) and improves management's ability to demonstrate, in the event of damage, that the reporting channel worked. Effort: 1–3 person-days internally or 3–5 person-days externally (experience values from the first version, as at 2 May 2026).

The second reason is the sanction framework: anyone who obstructs a report, fails to establish and operate an internal reporting channel, takes a reprisal or breaches confidentiality commits a regulatory offence under § 40 HinSchG. For the offences carrying fines of more than EUR 15,000, the limitation period for prosecution is three years (§ 31(2) no. 1 OWiG) — the review documentation must therefore outlast this period. In addition, since 15 April 2025 the Federal Office of Justice (BfJ) has been responsible for prosecuting and sanctioning regulatory offences under § 40 HinSchG, insofar as the implementation of the Act falls to the Federal Ministry of Justice or an authority within its remit (HinSchGOWiZustV, BGBl. 2025 I Nr. 111).

Before the first point: define the scope of application and the review scope

First determine which law applies to which legal entity — German employers are reviewed against the HinSchG, Austrian legal entities against the Austrian Whistleblower Protection Act (HSchG). The obligation to establish a channel is tied to the same size threshold in both jurisdictions: in Germany it applies to employers with, as a rule, at least 50 employees each (§ 12(1) sentence 1 in conjunction with (2) HinSchG), in Austria to companies and legal persons of the public sector with 50 or more employees or staff members each (§ 3(1), § 11(1) HSchG). For the employers named in § 12(3) HinSchG — including investment services firms, institutions under the German Banking Act (KWG) and the German Investment Firm Act (Wertpapierinstitutsgesetz), capital management companies, insurance undertakings as well as crypto and payment services institutions — the obligation applies irrespective of the number of employees.

What differs is the substantive scope of application, and that changes the review scope: the HinSchG covers all criminally sanctioned breaches, breaches subject to fines that serve to protect life, limb, health or employee rights, as well as numerous enumerated legal provisions (§ 2(1) nos. 1 to 3). The HSchG is narrower: EU areas such as public procurement, financial services, product safety, environmental protection and data protection, plus the corruption offences under §§ 302 to 309 of the German Criminal Code (StGB) (§ 3(3) HSchG). Anyone operating in both jurisdictions therefore reviews the same twelve points, but against two separate sets of references.

The 12 points in detail

1. Was the 7-day deadline for the acknowledgement of receipt met?

§ 17(1) HinSchG requires an acknowledgement of receipt within 7 days. Review: sample of 10 reports from the last 12 months — date of receipt vs. date of acknowledgement. Gaps: document + adjust the workflow.

Why this point comes first: the acknowledgement of receipt simultaneously starts the period for feedback (point 2), so an error here shifts the entire case file. The precise reference is § 17(1) no. 1 HinSchG (internal reporting channel); for the federal external reporting channel, § 28(1) HinSchG applies with the same seven-day period. Austrian legal entities are reviewed against § 9(1) HSchG: receipt of written reports must be confirmed in writing without undue delay, at the latest after seven calendar days — unless the reporting person has expressly objected to this or the confirmation would compromise the protection of their identity. Precisely these two exceptions belong in the Austrian review file, otherwise a permissibly omitted confirmation will be counted as a deficiency.

2. Feedback within the 3-month deadline?

§ 17(2) HinSchG: substantive feedback to the whistleblower within 3 months. Review: same sample of 10 — date of feedback. A frequent deficiency in practice: the deadline being exceeded in complex cases without an interim notice.

Review the start of the period, not only its end: the three months run from the acknowledgement of receipt; if receipt was not acknowledged, feedback is due at the latest three months and seven days after the report was received (§ 17(2) HinSchG). Substantively, the provision requires communication of planned as well as already taken follow-up measures and the reasons for them — a mere "we are still reviewing" does not satisfy this. The extension to six months in cases requiring extensive processing is governed by § 28(4) HinSchG for the external reporting channel; the internal period under § 17(2) HinSchG is fixed at three months. In Austria, the period runs differently, namely from receipt of the report (§ 13(9) HSchG).

3. Is confidentiality under § 8 documented?

§ 8 HinSchG: protection of the identity of whistleblowers and of persons concerned. Review: is there a written confidentiality concept? Are RBAC roles documented? Is there an audit trail of access to report data? Is HR separated from the reporting channel? Have confidentiality declarations been signed by everyone involved?

Review standard: § 8(1) HinSchG extends confidentiality to three groups of persons — the reporting person, the persons concerned by a report and the other persons named in the report. The identity may become known only to the persons responsible for receiving reports and taking follow-up measures and to those supporting them. The evidence of roles is therefore not an IT formality but the core of this point: every person with read access must be attributable to one of these categories. An intentional or reckless breach (§ 40(3) HinSchG) carries a fine of up to EUR 50,000, a negligent breach (§ 40(4) HinSchG) up to EUR 10,000 (§ 40(6) sentence 1 HinSchG). In Austria the corresponding provision is § 7(1) and (2) HSchG, which additionally prohibits disclosure by employees who are not responsible.

4. Can anonymous reports be processed? ("should", not an obligation)

§ 16(1) HinSchG: the internal reporting channel should also process reports received anonymously — however, there is no statutory obligation to design the reporting channels for anonymous reports (not an obligation, but a clear expectation of the legislator; the date "1 January 2025" discussed in the government draft did not become law). Review: if anonymous processing is offered — is the anonymous intake channel functional? Is the anonymous return channel functional (e.g. post box, reference number)? Has an end-to-end test report been carried out? A frequent finding in practice: the anonymous return channel is not functional (practitioner assessment from the first version, as at 2 May 2026).

Precise structure of the provision for the review record: § 16(1) sentence 4 HinSchG phrases the processing of anonymous reports as "should"; sentence 5 expressly clarifies that there is no obligation to design the reporting channels in such a way that they enable anonymous reports to be submitted. The transitional provision § 42 HinSchG likewise contains no such cut-off date — it concerns the deadline for establishing a channel for employers with 50 to 249 employees (17 December 2023) and the applicability of § 40(2) no. 2 (1 December 2023). For the assessment this means: a non-functioning anonymous return channel is a deficiency against your own procedural rules, not against the Act. Anyone who promises anonymous processing must deliver it; anyone who does not offer it documents that decision.

5. Is the prohibition of reprisals under § 36 covered in the procedural DPIA?

§ 36 HinSchG: prohibition of reprisals with a reversal of the burden of proof. Review: is there a procedural DPIA for the reporting channel (Art. 35 GDPR)? Is it documented there that HR measures following a report must be documented with evidence of independence? Is training of HR and managers on the prohibition of reprisals documented?

Why evidence of independence is the actual subject of the review: § 36(1) HinSchG prohibits reprisals including threats and attempts. Under § 36(2) HinSchG, where a person suffers a work-related detriment, it is presumed that this is a reprisal — the party causing the detriment must then prove that it was based on sufficiently justified grounds or was not based on the report. Anyone wishing to provide this proof needs documents from the period before the measure, not afterwards. This two-stage review scheme was confirmed by the Higher Labour Court of Lower Saxony (LAG Niedersachsen) in its judgment of 11 November 2024 (7 SLa 306/24). In the event of a breach, damages under § 37 HinSchG apply; no claim to the establishment of an employment relationship or to career advancement arises from this (§ 37(2) HinSchG).

6. Is the 3-year retention period documented?

§ 11 HinSchG: retain report documentation for three years after conclusion of the procedure; delete it thereafter (Art. 5 GDPR). Review: is the retention concept in writing? Is a deletion routine implemented? Sample of older cases: actually deleted?

Review both directions: deleting too early costs you the ability to provide evidence, deleting too late is a data protection breach. The reference is § 11(5) HinSchG (three years after conclusion of the procedure). The period matches the three-year limitation period for prosecution of the HinSchG regulatory offences carrying fines of more than EUR 15,000 (§ 31(2) no. 1 OWiG) — which is why a shorter retention concept is risky in practice. Caution in groups with Austrian entities: the HSchG provides for retention of five years (§ 8(11) HSchG). A group-wide uniform three-year routine would fall short of the Austrian period — this review point must therefore be ticked off separately for each jurisdiction.

7. Evidence of expertise for reporting officers?

§ 15(2) HinSchG: reporting officers must possess the expertise necessary for the activity. Review: are training certificates available? Is the training less than 3 years old (practical recommendation)? Are refreshers documented?

What "necessary expertise" actually requires: the Act names no qualification and no legal training — it requires the expertise necessary for the activity. In practice, 5 to 8 teaching units with a certificate are used for this, covering procedure and deadlines, confidentiality, the GDPR interface, protection against reprisals and fact-finding (practical recommendation, not a statutory requirement). The three-year limit for the refresher is likewise a practical recommendation and not a statutory deadline — the HinSchG provides no repetition interval for expertise. Therefore review two things separately: first, whether any evidence of expertise exists at all (statutory point), and second, whether the internally defined refresher cycle has been observed (self-commitment).

8. Is training of employees documented?

§ 7(3) sentence 2 HinSchG: employers provide employees with clear and easily accessible information on the use of the internal reporting procedure. § 13(2) HinSchG, by contrast, concerns information about external reporting procedures (including EU bodies) — provide evidence for both information duties separately. Review: is the notice/intranet information up to date? Does the onboarding material contain information on the reporting channel? Is there a reference to external reporting channels (§ 13(2))? Is the training rate verifiable (attendance lists)?

Substantive review standard: the information must correctly reflect the right of choice. Under § 7(1) HinSchG, reporting persons may choose whether to turn to an internal or an external reporting channel; they should prefer the internal report where the matter can be effectively remedied internally and no reprisals are to be feared. The information should therefore expressly also name the external route (practical recommendation). Irrespective of this, § 7(2) HinSchG prohibits obstructing, or attempting to obstruct, reports or the subsequent communication; obstructing a report carries a fine of up to EUR 50,000 under § 40(2) no. 1 HinSchG. So read the notice once from the perspective of a hesitant employee.

9. Reporting channels: oral or in text form — an in-person meeting on request?

§ 16(3) HinSchG: reports in oral or in text form; an in-person meeting must be made possible within a reasonable time at the request of the reporting person (sentence 3). Oral reports must be possible by telephone or by another means of voice transmission (sentence 2). Three channels in parallel = best practice, not legally mandatory. Review: has a test report been carried out via every channel offered? Is an in-person meeting actually made possible on request (not just in theory)? Are availability times documented?

A frequent assessment error: reviewers treat the absence of a second channel as a deficiency. However, § 16(3) sentence 1 HinSchG gives the employer a right to choose between oral form and text form; the only mandatory addition is the in-person meeting on request, which with the consent of the reporting person may also take place via video and audio transmission (sentence 4). For the meeting, the Act says "reasonable time" and gives no number of days — an appointment within 14 days is a widespread practical benchmark, not a statutory deadline. Therefore assess in two stages: does the offering meet the statutory minimum standard, and does it additionally keep what your own procedural rules promise?

10. Data processing agreement with an external ombudsperson, where applicable?

Where the reporting channel is outsourced (law firm, ombudsperson, software provider): a data processing agreement under Art. 28 GDPR. Review: is the agreement in place? Are third country clauses (SCCs) in place for providers with servers outside the EU? Is there evidence of technical and organisational measures from the Data Processor?

Two legal bases, two sets of evidence: in data protection law, Art. 28(1) and (3) GDPR requires that only Data Processors offering sufficient guarantees are used and that the contract sets out the subject matter, duration, nature and purpose of the processing, the types of data, the categories of data subjects as well as the obligations and rights of the controller. In whistleblower law, § 14(1) sentence 1 HinSchG expressly permits the tasks of the internal reporting channel to be assigned to a third party — but § 14(1) sentence 2 HinSchG keeps the employer itself under the duty to take appropriate measures to remedy a breach. Therefore review not only the agreement but also the interface: how does a finding by the ombudsperson reach the unit within the company that is able to remedy it?

11. Is the group hybrid solution documented?

There is no EU infringement procedure concerning group outsourcing under § 14 HinSchG; the German procedure INFR(2022)0052 concerning Directive (EU) 2019/1937 was closed on 4 June 2026. Review: in the case of a group solution: is there a written agreement between the group companies? Is the hybrid model (the subsidiary keeps its own reporting channel + the group unit acts as a third party) documented? Are the thresholds observed for each legal entity?

Status of the procedure and its consequence: there is no infringement procedure by the European Commission against Germany concerning group outsourcing under § 14 HinSchG. The German procedure concerning Directive (EU) 2019/1937 was INFR(2022)0052 for late transposition; it ended with the judgment of the Court of Justice of the European Union C-149/23 of 6 March 2025 (lump sum of EUR 34 million) and was closed on 4 June 2026. As at 17 August 2026, § 14 of the German HinSchG is unchanged. For the self-review, no legal breach follows from this, but a documented handling of the risk does: group compliance officers should choose a hybrid model — the subsidiary's own reporting channel plus the group unit as a third party under § 14(1) sentence 1 HinSchG — instead of pure group outsourcing, and track the threshold of § 12(2) HinSchG individually for each legal entity.

12. Has the annual report to management been prepared?

Best practice management reporting + ISO 37301 clause 9: Review: is there an annual report with statistics (report volume, categories, resolution rate, deadline compliance)? Is there a lessons-learned section? Is there an action plan with responsible persons + deadlines? Is management sign-off documented?

What belongs in the report so that it holds up: deadline compliance should be shown separately for the two statutory deadlines (§ 17(1) no. 1 and § 17(2) HinSchG) so that an outlier remains visible and does not disappear into an aggregate rate. Add the escalation routes: for Germany the federal external reporting channel at the Federal Office of Justice (BfJ) (§ 19(1) HinSchG) as well as the special bodies at BaFin (§ 21) and the Federal Cartel Office (Bundeskartellamt) (§ 22), for Austria the Federal Bureau of Anti-Corruption (BAK) (§ 15(1) HSchG) with the sectoral special responsibilities of the FMA, the Federal Competition Authority (Bundeswettbewerbsbehörde) and the Auditor Oversight Body (Abschlussprüferaufsichtsbehörde) (§ 15(2) HSchG). The report itself is best practice and not a statutory obligation — its benefit lies in the documented sign-off by management.

Reference mirror: the same review question, two jurisdictions

For six of the twelve points, the review question can be mapped directly onto an Austrian reference — the systematics remain the same, the provision and the authority change. Each cell of the following table names a statutory reference; practical recommendations are not included in it.

For points 4, 7, 8, 9, 10 and 11, this article works with the German references; whether and how the HSchG governs these points in detail is not set out here.

Sanctions and limitation periods: why the evidence must last three years

The sanction framework determines how long the review documentation should be kept — not the review cycle. All amounts and periods in the following table are statutory values of German law (maximum amounts under § 40(6) sentence 1 HinSchG, limitation periods under § 31(2) OWiG); for Austrian legal entities, § 24 HSchG applies instead.

Against legal persons, the fine may be multiplied tenfold under § 30(2) sentence 3 OWiG — up to EUR 500,000. However, § 40(6) sentence 2 HinSchG orders this tenfold increase only for § 40(2) nos. 1 and 3 as well as (3) and (4); for a missing internal reporting channel (§ 40(2) no. 2 HinSchG), the limit therefore remains EUR 20,000. For the self-review this means: the most expensive findings are obstruction, reprisal and breach of confidentiality — above all points 3 and 5.

The self-review procedure in five steps

The following procedure is a practical recommendation and not a statutorily prescribed methodology — the HinSchG governs neither the procedure nor the cycle of an effectiveness review.

1. Define the review scope: reporting period (usually the last 12 months), the legal entities concerned and, for each entity, the applicable law — HinSchG or HSchG.
2. Draw a sample: 10 reports for points 1 and 2; if fewer cases exist, review the period in full. If there was no report in the period, the case-related points fall away, while the structural points 3 and 6 to 12 remain reviewable.
3. Review documents against the references: confidentiality concept, DPIA, retention and deletion concept, evidence of expertise, workforce information, data processing agreement and group agreement — each with a note on the provision against which the review was carried out.
4. Functional test instead of file review: for points 4 and 9, submit a test report via every channel offered and track it through to the feedback. Paper form is not enough here, because it is precisely the anonymous return channel that typically only shows up in the test.
5. Report, measures, follow-up: findings per point with a responsible person and a deadline, sign-off by management, follow-up for the next cycle (point 12).