{"id":7080,"date":"2026-04-14T14:36:24","date_gmt":"2026-04-14T13:36:24","guid":{"rendered":"https:\/\/pragal-rechtsanwaelte.de\/blog\/compliance-blog-6-external-compliance-officer-an-underestimated-strategic-resource\/"},"modified":"2026-10-27T09:14:51","modified_gmt":"2026-10-27T08:14:51","slug":"external-compliance-officer-strategic-resource","status":"publish","type":"post","link":"https:\/\/pragal-rechtsanwaelte.de\/en\/blog\/external-compliance-officer-strategic-resource\/","title":{"rendered":"External Compliance Officer \u2013 an underestimated strategic resource (Compliance Blog #6)"},"content":{"rendered":"\n

In particular, fast-growing and medium-sized companies<\/strong> that have so far not established an independent compliance function<\/strong> but are increasingly exposed to regulatory requirements are increasingly faced with the question of whether, and in what form, a compliance function should be established. In such situations, an external compliance officer <\/strong>can be both a commercially sensible and, from a governance perspective, highly effective instrument<\/strong> \u2013 provided that the role of the external compliance officer is clearly defined, structurally embedded, and designed with liability considerations in mind. <\/p>\n\n

1. Legal framework: no duty to appoint \u2013 but a duty to ensure effective organisation<\/h2>\n\n

There is generally no explicit statutory obligation under German law to appoint either an internal or external compliance officer. Regardless of this, management and the board of directors are subject to extensive duties of legality and organisational responsibility<\/strong>. These duties are rooted in corporate law requirements for proper management of the company, in the supervisory and organisational duties of corporate bodies, and in civil and criminal liability standards that depend on the existence or absence of effective organisational<\/strong> structures. <\/p>\n\n

From a liability law perspective, the key reference points are in particular Section 130 of the German Administrative Offences Act (OWiG)<\/a><\/strong> (breach of supervisory duties), which may lead to fines against corporate bodies themselves in cases of inadequate organisational safeguards, as well as Section 30 OWiG (corporate fines)<\/strong><\/a> at the entity level. Relevant case law includes the Federal Court of Justice<\/strong> (BGH) decision of 17 July 2009 (5 StR 394\/08<\/a>) (\u201cBerlin municipal utilities decision\u201d) concerning the compliance officer\u2019s duty of care<\/strong>, as well as the \u201cNeub\u00fcrger\u201d decision of the Munich Regional Court I<\/strong> (5 HK O 1387\/10<\/a>) from 2013 on directors\u2019 liability for an insufficient compliance organisation<\/strong>. <\/p>\n\n

Standards and implementation requirements<\/h3>\n\n

Professional compliance management systems<\/strong><\/a> are based on the recognised audit and implementation standards IDW PS 980<\/a> and ISO 37301<\/a><\/strong>. For small and medium-sized enterprises, DIN SPEC 91524:2025-05<\/a><\/strong> (\u201cGuideline for compliance management systems in small and medium-sized enterprises\u201d) provides a useful framework for orientation. <\/p>\n\n

When implementing a compliance management system, what is decisive is not whether a particular function holder has been appointed, but whether the compliance organisation as a whole<\/strong> is capable of managing the company\u2019s key legal and reputational risks<\/strong>.<\/p>\n\n

Case law does not require any specific compliance model. However, it does require an appropriate<\/strong> compliance organisation t<\/strong>ailored to the company\u2019s risk profile. <\/p>\n\n

The key factors in this regard are in particular:<\/p>\n\n