Legality obligation of the company management vs. independence of the internal reporting office
Section 15 of the Whistleblower Protection Act stipulates that the internal reporting office must be independent in the performance of its duties. It must therefore not be subject to the employer's right to issue instructions. In addition, according to the Whistleblower Protection Act, the internal reporting office must take follow-up measures to investigate reported violations. According to the law, follow-up measures should also include internal investigations. The company management, on the other hand, is already required by its duty of legality to investigate and remedy any indications of misconduct. However, the management's investigative measures are nothing other than internal investigations.
This quickly reveals a tension between the powers of the internal reporting office in the context of its independence and the interests and obligations of the company management in the context of its duty of legality. Who is really responsible in these cases? Whose investigations have priority?
Based purely on the wording of the law, the internal reporting office may conduct internal investigations independently, i.e. quasi bypassing the company management. However, this can have far-reaching and serious consequences. Internal investigations are a sensitive and liability-laden topic that requires a great deal of legal knowledge. The internal reporting office, which according to the law only has to have the "necessary expertise", is probably not in a position to make adequate decisions independently. If this task were actually the responsibility of the internal reporting office, it could easily commission cost-intensive investigations against the will of the company management, the results of which could, in the worst case, endanger the entire company. This would create a kind of investigative authority within the company's own ranks, which could thwart any investigations initiated by the company management.
If one also considers the fact that the responsibility for investigating breaches and also the (personal) liability risk always lies with the company management, the complete independence of the internal reporting office in follow-up measures can only be denied and was also not intended by the legislator. How this is to be solved dogmatically remains open. Dilling's approach of teleologically reducing Section 15 para. 1 sentence 1 appears to make sense, namely that the internal reporting office can at most be independent when operating the reporting channels pursuant to Section 16 and when conducting the proceedings pursuant to Section 17 para. 1 nos. 1-5, para. 2, but not when taking follow-up measures, for which the company management is responsible under applicable company law (BeckOK HinSchG/Dilling, 1st ed. 15.10.2023, HinSchG Section 15 para. 8).
In any case, it should be noted that the company management - due to its duty of legality and liability risks - must have the opportunity to influence both the decision to initiate internal investigations and their implementation. But even this is not enough in itself, if one considers that the company management bears full responsibility and liability in case of doubt. In practice, this problem area could be resolved in such a way that the internal reporting office, using § 18 No. 4 a, refers further investigations to the internally responsible office. It should be made clear that this body is the company management. Based on the concept of the Whistleblower Protection Act, this would then also formally have the authority that it already has under general company law (see also BeckOK HinSchG/Dilling, 1st ed. 15.10.2023, HinSchG Section 15 para. 11 et seq. with further implementation proposals).
Companies are well advised to formally regulate any conflict situations with regard to responsibilities, powers and tasks with their internal reporting office at an early stage. If a crisis occurs, quick action is required. If you first have to clarify responsibilities and any conflicts with the internal reporting office, you will lose valuable time. It is also important to avoid a situation where the internal reporting office has already initiated an internal investigation in an erroneous assessment of its competencies before the company management has been able to take action.
Status: 11.12.2023