Compliance. Externally organised.

Services

• External compliance officer

  A central advisory, coordination and monitoring function for corporate compliance. The external compliance officer supports the departments and management and ensures transparent responsibilities, processes and escalation paths. Responsibility for the business remains with the management board.

• Compliance risk analysis

  Structured recording and assessment of the compliance risks relevant to the business. Risks are prioritised by significance and likelihood and documented and maintained in a traceable compliance risk register.

• Compliance management system

  Building and developing a risk-based compliance management system with clear responsibilities, processes, controls, escalation paths and documentation. Scope and design follow the size, activity and risk profile of the business.

• Policies and processes

  Advice on developing and refining internal compliance rules and organisational processes, for instance on conflicts of interest, gifts and hospitality, business partners, whistleblowers, the use of AI and the protection of information. Legal assessments of individual cases are handled where needed by cogito.legal.

• Monitoring and reporting

  Risk-based monitoring of the agreed compliance processes, spot checks, documentation of the deviations identified and regular reporting to management. Necessary measures are recommended and their implementation is tracked.

• Training and awareness

  Design and delivery of appropriate compliance training for staff, managers and particularly exposed functions. Digital training can be provided through cogito.training and supplemented by formats specific to the business.

• Third-party compliance

  Building risk-based processes for business partners and service providers, in particular for recording, categorising, reviewing and continuously observing the relevant compliance risks. Contractual review and legal assessments of individual cases are handled where needed by cogito.legal.

• Reports and compliance incidents

  Structuring the reporting, escalation and handling processes for possible compliance breaches, and coordinating the internal units involved. Where needed, cogito.legal can be engaged separately as an external internal reporting channel under the Whistleblower Protection Act, or support investigations with a legal dimension.

Healthcare

Healthcare businesses, hospitals, service providers and health tech companies operate amid regulatory requirements, sensitive data, professional confidentiality duties, complex service provider structures and high expectations of integrity in business conduct.

IT & SaaS

Digital business models, cloud and SaaS structures, international service providers, information security, data protection, licensing models and the growing use of AI call for clearly defined compliance processes and responsibilities.

Artificial intelligence

Using and developing AI combines new regulatory requirements with data protection, information security and general governance questions. A central compliance function can coordinate the specialist functions involved without assuming their respective responsibilities.

Energy & critical infrastructure

Regulated markets, business-critical processes, information security, extensive service provider structures and sector-specific requirements raise the demands on governance, control and documentation.

Mid-sized businesses & groups

As an organisation grows, with several companies, decentralised responsibilities or international business relationships, the need increases for common compliance principles, transparent responsibilities and dependable reporting lines.

Legal framework

No general duty to appoint

Ordinary businesses are under no general statutory duty to appoint a compliance officer. The role is in principle part of the internal governance and organisational structure.

Responsibility of the management board

Responsibility for the proper organisation of the business remains with the management board. General duties of care and organisation follow among other things from company law. Section 130 OWiG additionally covers the breach of supervisory measures required to prevent business-related contraventions.

External compliance function

Businesses may draw external expertise into their compliance organisation and assign advisory, coordination, monitoring and documentation tasks by contract. This does not shift the management and organisational responsibility of the corporate bodies onto the external compliance officer.

Distinction from legal advice

Compliance advice can touch on legal questions. Where a specific matter requires a legal assessment of the individual case or legal representation, that is provided where needed by cogito.legal under a separate engagement.

Whistleblower Protection Act

Under section 14 HinSchG, a third party may also be entrusted with the tasks of an internal reporting channel. The employer’s responsibility for suitable remedial measures remains. The reporting channel must be operated independently and requires the necessary expertise.

Specially regulated roles

Particular statutory or supervisory requirements may apply to certain sectors and functions. Specialised roles such as money laundering officers or regulated compliance functions are therefore not automatically covered by the general corporate compliance service and must be assessed separately.

As at August 2026.

Frequently asked questions