Reporting office annual report
The annual report of the internal reporting office summarises a financial year of whistleblowing cases in anonymised, aggregated form and gives management the evidence it needs to steer and to demonstrate an effective reporting system.
The annual report of the reporting office is the periodic, aggregated evaluation of every report received during the reporting period. It answers four core questions: how many reports came in through which channels, which subject areas they fell into, how quickly and with what outcome they were handled, and which follow-up measures were taken. Unlike the case-by-case documentation required by Section 11 of the German Whistleblower Protection Act (HinSchG), the report is not aimed at case handling but at the management board, the audit committee or the supervisory body. The Act does not expressly oblige internal reporting offices to produce an annual report, yet it has become a standard instrument, because it is the only robust basis for demonstrating to management that the system actually works.
Legally, the report is derived from the interplay of several duties. Under Section 12 HinSchG the employer must establish and operate an internal reporting office; under Section 13 the office must maintain the reporting channels, take follow-up measures and meet the deadlines set out in Section 17. Anyone who carries these operating duties must also be able to evidence them, and the management board can only discharge its duty to monitor legal compliance if it knows whether the system is functioning at all. At European level, Article 27 of Directive (EU) 2019/1937 requires Member States to provide annual statistics on reports. That duty binds the external reporting offices and the Member States directly rather than individual companies, but its set of indicators is frequently used as a template for internal statistics.
The content must be kept strictly anonymised. The confidentiality requirement in Section 8 HinSchG applies towards management as well, so figures have to be aggregated to a level at which no conclusions can be drawn about whistleblowers or persons implicated. In small units even a breakdown by site and category can be identifying; there the data must be consolidated or the breakdown dropped. Typical indicators are report volume, channel distribution, share of anonymous reports, proportion of reports giving rise to an initial suspicion, average handling time, compliance rates for the seven-day acknowledgement and the three-month feedback deadline, and the type of follow-up measures. A qualitative reading belongs alongside them: visible patterns, risk hotspots and improvement needs, plus evidence that the office was reachable and its staff trained. For companies within the scope of sustainability reporting, the same data can feed the business conduct disclosures under ESRS G1 — although the CSRD timetable has been reworked since the EU Omnibus package and postponed for many companies, so the applicable dates need to be checked case by case.
Legal Basis
Sections 11, 12, 13 and 17 HinSchG; Section 8 HinSchG (confidentiality requirement); Article 27 of Directive (EU) 2019/1937; supplementary frameworks ESRS G1, ISO 37002 and IDW PS 980
Practical Example
A mechanical engineering group with 900 employees across four sites presents the first annual report of its internal reporting office to the management board and the audit committee. The report shows 23 cases, 9 of them anonymous: 14 arrived through the digital whistleblowing platform, 6 by telephone and 3 in a face-to-face meeting. Eleven cases produced an initial suspicion and triggered an internal investigation; two ended in employment-law measures and one was handed over to the public prosecutor. The seven-day acknowledgement was met in 22 of 23 cases and the three-month feedback in all of them. One pattern stands out — a cluster of reports on procurement at a single site — so the report recommends a targeted process review in purchasing and refresher training on the four-eyes principle. When individual supervisory board members ask for the names involved, the designated officer refers to Section 8 HinSchG and discloses no case-level data; the refusal is minuted and visibly strengthens employees' trust in the system.