GENERAL
A clear commitment by the management to HR compliance
A clear decision by the board of management or the management to establish an HR-CMS is absolutely essential. This represents a real commitment toward the employees and third parties to ensure that the company observes and complies with applicable laws, guidelines and regulations. This unequivocal and binding decision needs to be communicated to all stakeholders, and also serves to bind the board of management or the management itself to this decision once it has been made.HR compliance is a critical issue and has become even more important in recent times. The same applies to the Whistleblower Protection Act (HinSchG), which entered into force on July 2, 2023.
Company-specific definition of HR compliance
From the outset, it is important to document in writing exactly what the board of management or the management are committing to on behalf of the company. This commitment needs to be amended or changed as necessary, and also consistently developed.
- HR compliance encompasses all of the measures taken with regard to human resources to guarantee that employees and members of company bodies comply with all of the laws, guidelines and directives while acting on behalf of the company. As such, compliance serves to safeguard the conduct of the company in accordance with the standards.
- Where necessary, this HR compliance concept can also be replaced by a company-specific description. In this case, it is essential to ensure that this description is both clear and understandable as it serves to define and communicate the company’s position on compliance internally and externally.
The benefits of an HR-CMS for the company, company bodies and employees:
The following benefits of the HR-CMS for the company can be emphasized in both internal and external communication:
- Prevention of violations of the company’s compliance objectives (internal rules).
- Prevention of legal violations and, therefore of criminal sanctions such as prison sentences, fines and penalties, claims for damages, labor-law sanctions and legal proceedings, etc.
- An improved corporate culture for employees, customers, etc.
- Strengthened organizational structures
- Image benefits, greater credibility both internally and externally
- Stronger business relationships and greater creditworthiness; eligibility to participate in tenders
THE HR COMPLIANCE MANAGEMENT TRIAD
Compliance management is characterized by three specific elements. This triad encompasses the objective and the scope of a company’s compliance efforts as a whole:
- Prevent: Prevent future violations in order to avoid the risk of damage to the company due to unlawful conduct
- Detect: Identify compliance violations that have taken place
- Respond: Sanction compliance violations that have taken place
This triad also represents the objective and scope of an HR-CMS.
Prevent
Corporate ethics guidelines
To be perceived as an attractive employer or provider of goods and services, we recommend formulating ethical guidelines for the company that exceed the scope of the legal regulations, and which are not legally binding. These guidelines become binding through their integration into employment contracts.
Establish a compliance team to set up an HR-CMS
Creating adequate personnel capacities to establish an HR-CMS also clearly expresses the company’s strong commitment.
A compliance team should be set up to implement the HR-CMS:
- The board of management/management appoints a team leader
- Recruit additional supporting employees
- Present the compliance team internally and externally, along with all of the necessary contact details (e.g. compliance@company.com e-mail address)
- Define the tasks of the HR-CMS and assign these tasks within the compliance team, for example:
- Determine the company’s compliance-relevant risk areas (see the list of possible risk areas)
- Enable employees to contribute to detecting compliance risks/violations as whistleblowers. This also includes anonymous options, such as a whistleblower digital system, whistleblower hotline via telephone or e-mail.
- Document all compliance risk areas and violations (create a constantly updated overview)
- Submit monthly or quarterly reports to the board of management/management regarding compliance risk areas and violations
- Create additional, specific measures designed to establish and continue developing the HR-CMS on the basis of the identified risk areas in cooperation with the board of management/management
- Observe the works council’s participation rights (such as informing the works council in due time about plans for new working processes and procedures)
- Where necessary: Involve external consultants such as lawyers, tax consultants and management consultants (in particular with regard to Detect measures)
Organizational processes
The company’s following human resources organizational processes need to participate in the implementation and ongoing development of the HR-CMS:
- Assigning responsibilities
(organizational diagrams, job descriptions) - HR-CMS organizational manual
- Introduction of standardized processes for the HR-CMS
Transfer the HR-CMS to normal operations
Every department within the company has to be informed about the transfer of the HR-CMS to the company’s normal activities. This requires intensive communication with all employees:
- Verifiably document the provision of written information to the employees
- Live or online compliance training
- Information pages on the Intranet
Additionally:
- Commit the employees to compliance via their employment contracts (agree on corresponding provisions in new employment contracts, amendments to existing contracts or written instructions)
- Co-determination right of the works council when including specific regulations in the HR-CMS which pertain to the organizational conduct and not only the working behavior of the employees (e.g. when implementing a new or expanded Code of Conduct or when carrying out an internal investigation)
Regularly align and monitor the HR-CMS processes
After the HR-CMS has been established, the board of management or the management assign their original HR-CMS monitoring and compliance responsibilities to an HR Compliance Officer (HRCM).
Detect
The HR-CMS provides the following tools for detecting compliance violations:
- Monitoring changes to laws and guidelines, in particular in the respective risk areas. These changes have to be integrated into the HR-CMS immediately and also announced and implemented throughout the company
- The introduction of a whistleblower system which all employees have access to, including anonymous access
- Regular employee training regarding compliance violations
- Internal investigations to identify legal violations or to investigate well-founded suspicions (the works council’s right of co-determination may also need to be considered here)
- The implementation of IT-supported monitoring applications (monitoring e-mail correspondence/telephone calls/video surveillance/GPS monitoring)
- Employee interviews
- Internal investigations and audits by external consultants
Respond
The HR-CMS provides the following measures in the event of violations:
- Possible sanctions such as warnings, written warnings, termination, reassignment, salary reduction, compensation for damages;
- Report to the police in the event of criminal offenses;
- Internal amnesty programs for charged but cooperative employees;
- No waiver of sanction measures without cause due to the fact that this could be regarded as implicit approval of the legal violation.
IDENTIFYING COMPLIANCE RISK AREAS
Compliance risks can arise in these human resources areas:
Risk area: labor law
Employee representatives
- Guarantee the unimpaired establishment and activity of the works council, youth and trainee representation
- Legally compliant remuneration for works council members
- Maintain the co-determination rights and other participation rights of the works council, such as those regarding social issues (Section 87 BetrVG); hearing before orderly termination (Section 102 BetrVG); hiring approval (Section 99 BetrVG)
- Compliance with company agreements and collective agreements, where applicable
Occupational safety
- Observe occupational safety on every level of the company including compliance with the Working Conditions Act (ArbSchG), the Occupational Safety Act (ASiG) and the Workplace Ordinance (e.g. Section 3 ArbStättV)
- Observe maternity leave regulations, along with the specific arrangement of working conditions for pregnant and breastfeeding women (Section 9 MuSchG); compliance with protection periods
- Compliance with general and specific safety obligations, such as fire protection (e.g. unimpeded access to emergency exits and escape routes, use of certified electronic devices, fire protection regulations); construction site safety (building site regulations)
Working hours
- Compliance with the maximum daily or weekly working hours (Section 3 ArbZG); rest periods; minimum rest periods
- Observe the specific regulations regarding work on Sundays, holidays and at night
- Observe the restrictions for pregnant women (Section 8 MuSchG), severely disabled persons (Section 124 SGB IX) and adolescents (Section 8 JArbSchG)
Data protection
- Application procedures: Aptitude tests and recruitment assessments only with the consent of the applicant; social media as a recruiting resource
- Ongoing employment relationship: compliance with the regulations of the Federal Data Protection Act (BDSG) and the General Data Protection Regulation (GDPR), in particular the protection of the employees’ personal information; observe safe processing (Art. 32 GDPR); suitable technical and organizational measures implemented by the data controller (Art. 24 GDPR); observe the particularities when processing special categories of personal data (Art. 9 GDPR)
- Appoint a Data Protection Officer if at least 20 people are regularly and consistently involved in the automated processing of personal data (Art. 37 GDPR, Section 38 BDSG)
- Prepare to respond to requests for information in accordance with Art. 15 GDPR
- After the end of the employment relationship, block or delete personal data in accordance with Section 35 BDSG, Art. 17 GDPR
Bans on discrimination
- Prevent discrimination due to race or ethnic origin, sex, religion or world view, disability, age or sexual identity (Section 1 AGG)
- Discrimination-free application procedures including discrimination-free job advertisements; discrimination-free interviews, i.e. no questions regarding disability, pregnancy, union membership, religion/world view; discrimination-free applicant selection; discrimination-free applicant rejection
- Eliminate discrimination from ongoing employment relationships such as when selecting candidates for promotion or for further training; eliminate wage discrimination (EntgTranspG)
Remuneration issues
- Observe the legal minimum wage (Section 1 MiLoG) including documentation obligations (Section 17 MiLoG)
- Fair remuneration (EntgTranspG)
Health protection
- Observe the accident prevention regulations of the employers’ liability insurance associations (Section 15 SGB VII)
- Observe the works council’s right of co-determination regarding regulations concerning health protection within the scope of the legal directives or accident prevention regulations (Section 87 (1) No. 7, 2. Alt. BetrVG)
- Constant development of the company’s occupational health and safety
Protection against dismissal
- Regulations regarding protection against ordinary dismissal (KSchG); protection against extraordinary termination (Section 626 BGB); the proper involvement of the works council (Section 102 BetrVG); the formal criteria of the dismissal
- Special protection against dismissal such as for works council members, pregnant employees, severely disabled employees, etc.
Mobile work
- Implement rules governing the observance of the regulations regarding recording working hours; availability; data protection; revocation options/limited period; equipment and compensation for expenses
- Observe the works council’s right of co-determination
Contract management
- Management of employment contracts and management of company agreements; constant revision of contract templates and company agreements in response to changes to case law and laws
- Requirements of the Business Secrets Act
- Monitor GDPR compliance
Whistleblowing and whistleblower systems
- Compliance with the Whistleblower Protection Act since July 02, 2023:
- Obligation to set up internal reporting body (Section12 HinSchG);
- Protective measures for whistleblowers (Sections 36 et seq. HinSchG);
- Reversal of burden of proof to protect whistleblowers against “reprisals”, e.g. in the event of dismissal, non-renewal or premature termination of a fixed-term employment contract (Section 36 (2) HinSchG);
- Two parallel reporting channels (internal to the company or authority and external to an independent body – but no requirement to report anonymously) (Sections 12, 19 HinSchG et seq.);
- Preference for internal reporting body (Section 7 (1) HinSchG);
- Documentation requirement (Section 11 HinSchG), confidentiality requirement (Sections 8 HinSchG);
- Extension to violations of German law.
Other employee protection regulations
- Effective fixed-term employment contracts (Section 14 TzBfG)
- Vacation (BUrlG); particularities for underage employees (Section 19 JArbSchG) and the severely disabled (Section 208 SGB IX)
- Special protection for trainees including termination after the probationary period by the employer only for due cause and stating the reasons (Sec. 22 (2) BBiG)
- Observe the particularities of employee leasing (AÜG) and employee posting (AEntG)
Risk area: income tax law
Proper tax classification of benefits including substitute claims or substitute employee benefits; waiver of the employer’s substitute claims against the employee
Risk area: social security law
- Prevent pseudo self-employment of freelancers, etc.
- Obligation to report every employee insured under health, long-term care or pension insurance or in accordance with employment promotion law by operation of law to the collection agency (Section 28 a SGB IV)
- Marginally employed workers such as mini-jobbers up to €450, midi-jobbers up to €1,300; employer’s obligation to report to the Mini-Job Center as the responsible reporting office for the employer’s social insurance and to the accident insurance fund
- Inform employees prior to termination of the employment relationship about their necessary activities when seeking other employment as well as their obligation to report to the Employment Agency (Section 38 (1) SGB II, Section 2 (2) No. 3 SGB III)
Risk area: labor criminal law
Criminal offenses:
- Withholding and embezzlement of remuneration, such as non-payment of social security contributions in the event of illegal employment, pseudo self-employment or unlawfully reduced wages (Section 266a StGB)
- Offenses against works constitution bodies and their members or violation of secrets (Sections 119, 120 BetrVG)
- Serious violation of the regulations regarding working hours, rest breaks, work on Sundays and public holidays (Section 23 ArbZG)
- Tax evasion, for example through pseudo self-employment or illegal employment due to violation of income tax payment obligations (Section 370 AO)
- Violation of the BDSG (Section 42 BDSG)
Administrative offenses:
- Undercutting the minimum wage (Section 21 MiLoG)
- Employing foreign workers without a work permit (Section 404 SGB III)
- Illegal employment (Section 8 SchwarzArbG)
How can we help?
Our team of compliance experts specializing in labor law has many years of extensive, practical experience in developing, introducing and implementing the tools that companies utilize to implement an active and proactive HR CMS.
The BUSE Compliance Team is here to assist you in order to ensure that you achieve your corporate objectives. We help you to avoid compliance risks before they even arise. If compliance risks have occurred, we then assist you with rapidly identifying and sustainably neutralizing the corresponding dangers.
Drawing on the long-standing operative experience of our Compliance Team members, we implement strategic, flexible and proven concepts that fulfill the highest standards and quality requirements. This enables our clients to successfully meet the requirements for an HR-CMS in Germany, in the European Union and worldwide.
