WHP Compliance Audit

WHP Compliance Audit: How Does the German Labor Inspectorate Check Your Company?

Note: based on German law. In a WHP audit, labor inspectors mainly check GBPsych documentation (Sec. 5 ArbSchG), BEM records (Sec. 167 SGB IX), and action logs. If GBPsych documentation is missing, the inspectorate usually first orders it to be completed; if that order is not complied with, a fine of up to €30,000 may follow (Sec. 25 ArbSchG).

What the labor inspectorate specifically checks

Audit point	Documentation requirement	Fine if missing
GBPsych in place	Written documentation of the psychosocial risk assessment per job group	Up to €30,000 (Sec. 25 para. 1 no. 2 lit. a ArbSchG) if an order from the inspectorate is not complied with
GBPsych up to date	Date of last assessment, proof of update after material changes to working conditions	The inspectorate can order an update; the law sets no fixed interval
Actions from GBPsych	Documentation of which measures were derived from the assessment and implemented	Missing follow-up on measures → correction order issued + re-inspection
BEM process	Proof that BEM invitations were sent after more than six weeks of incapacity to work within one year + response documented	No direct fine, but termination becomes contestable (BAG 2 AZR 755/13)
Works council involvement	Where a works council exists: proof of co-determination under Sec. 87 para. 1 no. 7 BetrVG	The works council can enforce its involvement; without it, the GBPsych is open to challenge

How Does an Occupational Health and Safety Audit Work in Practice?

Note: this reflects German law and labor inspection practice. Occupational health and safety audits by the labor inspectorate (state occupational safety offices, trade supervisory offices) are often triggered by specific events — a complaint, an accident, an anonymous report, or as part of industry-wide programs. Since 2026, there is also a statutory minimum inspection rate: each German state must inspect at least 5% of businesses every year (Sec. 21 para. 1a ArbSchG).

The process: advance notice (often, though sometimes unannounced), on-site document review (risk assessments, operating instructions, GBPsych documentation, BEM records), and a discussion with management/HR and selected employees. This is followed by a written inspection report listing deficiencies and deadlines for correction.

What must be produced immediately: (1) the current risk assessment for all job groups, including GBPsych. (2) The action plan from the last assessment plus proof of implementation. (3) Training records from the last 12 months. The authority can demand that the documents be produced (Sec. 22 para. 1 ArbSchG) and, if something is missing, order measures (Sec. 22 para. 3 ArbSchG).

Important: authorities don't assess whether the GBPsych is “good” — only whether it took place and was documented. A formally correct but methodically thin GBPsych will pass inspection better than an undocumented in-depth analysis that was only done verbally.

Which compliance mistakes often stand out in audits?

**Mistake 1: GBPsych conducted but not documented in writing.** “We did that last year” without a document doesn't count. The labor inspectorate only accepts written records — date, method, job groups, results, measures. Verbal assurances carry no evidentiary value.

**Mistake 2: GBPsych outdated with no reassessment.** After material changes to working conditions (digitalization, new shift models, remote work, restructuring), the GBPsych must be updated. A GBPsych from 2019 with no post-pandemic update is, in many companies, effectively obsolete.

**Mistake 3: GBPsych only for office staff, not production/field staff.** The obligation applies separately to each job group — not to “the company as a whole.” A logistics company needs a separate GBPsych for drivers, warehouse staff, dispatch, and administration. If individual groups are missing, the GBPsych is incomplete.

**Mistake 4: Forgetting BEM invitations.** The duty applies when employees are unable to work for more than six weeks within one year, continuously or repeatedly (Sec. 167 (2) SGB IX) — the periods are added up, not only looked at as one consecutive stretch. Without a tracking system, companies routinely miss the invitation obligation. In an illness-related termination case, the labor court checks whether BEM was offered. Without proof, the termination is not automatically invalid, but the employer bears an extended burden of presentation and proof (German Federal Labor Court, BAG, 20 Nov 2014 – 2 AZR 755/13).

**Mistake 5: Follow-up on measures not documented.** The GBPsych is not a closing document but an ongoing process. Once a need for action has been identified, companies must document whether and how it was addressed. “Problem identified, nothing done” is worse than no GBPsych at all — it proves both awareness and inaction.

How can you prepare for the audit in one day?

**Step 1 — GBPsych inventory (30 minutes).** Open your filing system and search for “risk assessment” or “GBPsych.” Is there a document? If not: prioritize it immediately. If yes: check whether working conditions have changed materially since its date (the law sets no fixed interval), whether all job groups are covered, and whether measures were documented.

**Step 2 — Close the action gap (if needed).** If the GBPsych exists but follow-up on measures is missing: write a 1-page memo today (date, need for action from the GBPsych, measure, person responsible, completion date). That's a first piece of evidence — it doesn't need to be a perfect concept.

**Step 3 — Check BEM status (15 minutes).** Were there employees in the last year who were unable to work for more than six weeks, continuously or repeatedly? If yes: were BEM invitations sent and the response documented? If no or unclear: set up a BEM process immediately (written invitation template + filing system for responses).

**Step 4 — Ensure works council involvement (if applicable).** If your company has a works council, the GBPsych must have taken place with its involvement (Sec. 87 para. 1 no. 7 BetrVG). Get this confirmed in writing — a short meeting record is sufficient.

**Step 5 — Set up digital filing.** Store everything paperless, searchable, with dates and version numbers. During an audit, you should be able to produce documents quickly. Spending 30 minutes searching makes a poor impression — even if all the documents actually exist.

Related measures & topics

Key takeaways

Note: applies to German law. The labor inspectorate checks: GBPsych documentation, currency, follow-up on measures, BEM invitations.
If it can't be shown, it doesn't exist — verbal statements don't count.
5-point self-check achievable in 1 day — priority: GBPsych document + BEM records.
The works council must be involved in the GBPsych — without its involvement, the assessment is open to challenge.
Digital filing saves hours if it comes down to it — and makes a better impression on the authority.

Frequently asked questions

How often does the labor inspectorate check WHP obligations?+

Since 2026, the law sets a minimum inspection rate: each German state inspects at least 5% of businesses every year (Sec. 21 para. 1a ArbSchG, German law). Event-driven checks (after complaints, accidents) happen more often. Industry-wide programs can lead to more frequent inspections — for example in nursing care, construction, or retail. Unannounced inspections are permitted, but site visits are often announced in advance.

What happens if the labor inspectorate finds a deficiency?+

The inspector writes an inspection report listing the deficiencies found and sets deadlines for correction depending on the type of deficiency. If the deficiencies are not remedied despite an enforceable order (Sec. 22 para. 3 ArbSchG), a fine of up to €30,000 may follow (Sec. 25 ArbSchG, German law). For serious deficiencies, the authority can issue immediately enforceable orders. Shutting down operations over WHP deficiencies is very rare — the goal is compliance, not punishment.

Do I need to hire an external WHP provider for the audit?+

No. The labor inspectorate checks whether your obligations are met — not how. You can conduct the GBPsych internally (with managers and employees), use digital WHP software, or hire external consultants. The documentation must be accurate and complete. What matters is the outcome, not the path. Important: if you hire external consultants, keep the documentation yourself — the responsibility lies with you, not the consulting firm.

How long must WHP records be retained?+

Under German law, there is no statutory retention period for GBPsych documentation. Keep it at least as long as the working conditions it relates to remain in effect, and retain earlier versions as evidence of how things developed. Keep BEM records separate from the personnel file (BEM file); the personnel file should only contain the offer, consent or refusal, and the agreed measures — no diagnoses. How long the BEM file is kept after completion is set in your deletion policy (Art. 5(1)(e) GDPR), based on your need for evidence, for example the standard three-year limitation period (Sec. 195 BGB).

Well prepared for your WHP audit

EasyWHP guides you step by step through the GBPsych documentation, keeps track of BEM deadlines, and creates reports for the inspection.

Try EasyWHP for Free WHP Compliance Check

Sources

Last updated: 2026-06-27. Not legal or tax advice — have your specific case reviewed by a professional.

Psych Risk Assessment for SMEsDoes a small or mid-sized business (SME) have to conduct a risk assessment for psychological workload?Management Liability in WHPWhat WHP duties does company management have — and what happens if they're violated?BEM deadline: six weeksBEM after more than six weeks of incapacity for work: When must the employer offer the meeting?