An external ombudsperson who is also an internal reporting office?
There is no contradiction. “External” can describe the law firm’s position; under the HinSchG, “internal” describes the reporting office’s assignment to the employer.
Updated September 18, 2026 · Editorial team: Rudolph Rechtsanwälte
The personal confidential reporting contact remains a distinct concept
The traditional attorney-led ombuds model offers someone to speak with outside the organization. That person receives reports, asks questions, and assesses their legal significance. The engagement and confidentiality are governed by contract. This model existed before the HinSchG was introduced.
Statutory functions require a clearly defined engagement
Under section 14 HinSchG, an employer may entrust a third party with the functions of an internal reporting office. If the law firm assumes this role, responsibilities such as assessment, follow-up action, and feedback must be clearly allocated. The duty to remedy a violation remains with the organization.
A confidential reporting contact with a different engagement may perform only individual tasks. In that case, it must be particularly clear who operates the statutory reporting procedure and how information reaches that office. The title “ombudsman” alone does not answer these questions.
Three questions employee information should answer
- Responsibility: For which organizations, people, and subject areas has the reporting contact been appointed?
- Procedure: Who acknowledges receipt, handles the report, and provides feedback?
- Confidentiality: Who may receive which information, and what limits apply?
Government external reporting offices must be distinguished from these arrangements. Where the HinSchG applies, there is generally a choice between internal reporting and reporting to the competent external office.
Is an external ombudsperson also a compliance officer?
Not automatically. “External” describes the provider’s organizational position outside the company. Under German whistleblower protection law, “internal reporting office” describes the function of the reporting channel. A compliance officer may have broader duties, such as managing policies, risk assessments, or controls. The actual role must be clear from the engagement and the information provided to employees.
Combining roles requires particular attention to independence and conflicts of interest. A report about a person’s own failings should not be handled by that person without an effective conflict arrangement. Our discussion of attorneys’ professional duties explains the additional confidentiality and conflict issues that can arise when an ombudsperson later conducts an internal investigation.
Attorneys’ Professional Duties and Conflicts of Interest (German)
Professional-law questions of the ombudsperson role, from confidentiality to protection against seizure, are covered in chapter 3.11 of our textbook on German professional law for lawyers (in German).