Day 0 · Tuesday · 07:52 · Köhler-Marchais HQ, Düsseldorf
You are Elena Vasquez, Chief Compliance Officer at Köhler-Marchais — a French-German industrial group. An encrypted message arrived through the internal reporting channel at 23:31 last night. The reporter cited HinSchG by name. They know the law. They will know if you breach their protection.
Three decisions, five activities, twenty-five minutes. You have seven days under Article 9(1)(b) to acknowledge the report. The CFO will call before 10:00. He wants this handled quietly.
Framing device
Every module of this course is a flashback. You are remembering Day 0 from a Bundesamt für Justiz hearing room six months later — Day 186 — where Dr. Linke is asking you what happened. The hearing is the frame. Every module bookends back to it.
Shield — Article 19 retaliation protection in force
Integrity — your own procedural posture
Estimated time: 20–25 minutes
Bundesamt für Justiz — Interview Room 3
Day 186 · Six months after Day 0 · 09:02
Case File
Six months later. Bundesamt für Justiz, Interview Room 3. Fluorescent ceiling, pale walls, a recording light glowing red in the corner. Elena Vasquez sits across from a woman she has met twice before and is about to be interviewed by for the third time.
Dr. Linke
Frau Vasquez. Thank you for coming in voluntarily. You understand this interview is on the record and will form part of the Bundesamt's investigation file.
Elena
I understand.
Dr. Linke
Take me back to Day 0. The day the report came in. Tell me what you remember.
Elena
It was Tuesday. 07:52. I had just opened the encrypted portal for the morning…
Day 0 · Tuesday · 07:52
The Report Arrives
Case File
Tuesday, 07:52. An encrypted message has arrived through Köhler-Marchais's internal reporting channel. It was submitted anonymously at 23:31 last night.
Case File
The report alleges that revenue from two product lines — Axiom Industrial Sealants and Meridian Coating Systems — has been systematically recognised ahead of delivery confirmation over a 14-month period. The reporter estimates the overstatement at €2.3–2.7 million across two financial periods.
Case File
The reporter says they have documentary evidence but will only share it if their anonymity is guaranteed. They are aware that HinSchG protects them. They have cited the law by name.
Elena
They know the law. That changes how I approach this. They will know if I breach their protection.
Day 0 → Day 1 · The Attachments
The Report — What Do You Open?
The report contains four attachments. You can open three of them before the 7-day acknowledgment deadline forces you to respond. The attachment you leave closed becomes a gap in your investigation. Choose carefully — you cannot go back.
3 of 3 opens remaining
The Wedge — What You Cannot Unsee
Day 1 → Day 3 · Acknowledgment Approach
How do you acknowledge the report?
Day 3. The 7-day acknowledgment deadline under Article 9(1)(b) requires you to confirm receipt. How do you acknowledge — and what do you say?
Day 3 · Consequence · Brief Acknowledgment
Clean and correct.
The reporter receives a clean, procedurally correct acknowledgment. They don't reply further — which is normal. Your compliance with Article 9(1)(b) is documented. Your Confidentiality, Investigation Quality, and Retaliation Shield bars all move in the right direction.
What the law expects
Art. 9(1)(b) requires acknowledgment of receipt within 7 days. It does not require you to explain the investigation process, disclose who will handle it, or request information from the reporter. The minimum viable acknowledgment is the maximum safe one.
The reporter's silence after receipt is normal and expected. Do not interpret it as an invitation to ask further questions.
Day 3 · Consequence · Identity Request
A line you cannot draw back.
Your detailed acknowledgment lands in the reporter's inbox at 14:30. The request for identity confirmation — even framed as optional — lands like a test. By 15:45 Dr. Hoffmann has called. He has read your draft before it was sent. His tone is even but firm.
Hoffmann
Frau Vasquez. HinSchG §15 requires that the report handler is independent. An anonymous reporter has no obligation to identify themselves — asking creates chilling effect. I am going to note this in our working papers as a process error. If the Bundesamt audits us later, they will see it. We should send a correction within the hour.
Why this is a §15 error
HinSchG §15 protects the independence of the reporting channel. Asking the reporter to identify themselves — even as an optional courtesy — communicates that identification would be preferred. That preference is itself a chilling act. The law treats the ask, not the answer, as the procedural defect.
Your Confidentiality bar takes a material hit. Your Retaliation Shield also drops — the reporter now reasonably suspects that identity protection is negotiable inside this organisation.
Day 7 · Consequence · Missed Deadline
The deadline is absolute.
You cannot request an extension. The 7-day deadline is absolute. Day 7 passes without acknowledgment — you are now in breach of Article 9(1)(b). On Day 8 the reporter files an external report with the BaFin.
Case File
Day 8, 11:17. An automated notification appears in Elena's inbox: the Bundesanstalt für Finanzdienstleistungsaufsicht has received an external report matching the subject matter of the anonymous disclosure. The external channel is now live. The internal investigation runs in parallel under regulatory oversight.
What breach triggers
Art. 9(1)(b) is not a guideline. The 7-day acknowledgment window is a hard regulatory obligation — missing it is a standalone breach regardless of whether the substantive investigation is otherwise competent.
Once the reporter escalates externally, your Process Integrity collapses. The M5 hot-seat in the BfJ framing device will open with this specific question. On this path, the final ending routes toward The Aftermath — a tribunal years later with damages awarded.
Day 3 → Day 5 · Cross-Border Decision
Paris is on the line.
Dr. Hoffmann is on the phone. The revenue recognition issue touches the Paris parent — the VP Sales role that the email thread implicates reports to the Group CEO in France. Friedrich Köhler is also asking whether this should go to the Group CFO.
Hoffmann
Frau Vasquez. The jurisdictional question has to be settled before Day 7. Group-structure allocation under the Directive's Art. 8(6) gives you options. But the choice is not neutral — where the case file travels, confidentiality travels with it.
How do you route the investigation?
Day 5 · Consequence · Local Jurisdiction Maintained
Investigation stays in Frankfurt.
Dr. Hoffmann concurs. German law governs the German entity. Investigation proceeds under HinSchG without Paris visibility until you have findings to report. This protects reporter identity and investigation integrity.
Hoffmann
Correct call. Paris gets a notification letter on the day we're ready to act — not before. I'll draft the memo tonight. Friedrich won't love it, but he doesn't have to.
Why local is the clean answer
Group-structure allocation permits joint investigation but doesn't require it when the conduct is substantively domestic. Routing to Paris automatically widens the circle of people who see the report — which widens the attack surface for confidentiality leaks.
Your Confidentiality and Investigation Quality both move up. The sidebar HUD reflects the strengthened posture going into the retaliation analysis next.
Day 5 · Consequence · Paris Escalation
The circle just widened.
Group Legal in Paris now has access to a report that implicates someone who reports to the Group CEO. Confidentiality is materially compromised. Dr. Hoffmann notes this as a HinSchG §15 independence breach in his working papers.
Hoffmann
Elena — I have to flag this formally. The VP Sales reports to the Group CEO. By escalating upward, we've put the report in a chain of custody that includes a person structurally close to the subject. I'll document the decision and its rationale. If this surfaces in an external review, we will need to show we considered the alternative.
Independence is a chain, not a checkbox
HinSchG §15 treats independence as a continuing property of the handling chain. Every additional person who sees the report is a new point where independence can fail. A routing decision that widens the chain without necessity is itself a §15 concern.
Confidentiality drops sharply. Investigation Quality dips. Process Integrity takes the largest hit — this is the metric the M5 BfJ hot-seat is most sensitive to.
Day 5 · Consequence · Counsel Memo Requested
The middle path.
You ask Dr. Hoffmann for a written jurisdictional memo before routing anything further. He agrees. By Day 5 end-of-business, his two-page memo lands: local investigation under HinSchG with a separate escalation path to the Supervisory Board — not Paris management — if findings require it.
Hoffmann
My memo sets out three options and recommends local. The Supervisory Board is the right escalation destination if you need to reach above Friedrich — not the French parent. That keeps the chain inside the entity under HinSchG and inside the governance structure that can actually act. Slightly slower, procedurally clean.
Slow and right beats fast and wrong
Asking for counsel's written view before routing costs you one working day. It also creates a contemporaneous record of why the routing decision was made — which is the exact document a later reviewer (Bundesamt, tribunal, or Supervisory Board) will ask for.
Confidentiality and Investigation Quality edge up. Not the strongest posture — but defensible on any angle.
Day 5 → Day 6 · Article 19 · Retaliation Classification
Eight actions. Two categories.
Eight workplace actions have been proposed or taken involving Finance team employees since the report was filed. Classify each as Retaliation or Legitimate Management. Remember — Art. 19 and Art. 21(5) reverse the burden of proof. Timing matters. The employer must disprove retaliation, not the other way round.
Finance Controller's annual review, already scheduled for Q1, proceeds on its normal date.
Pre-existing scheduled review — timing predates the report, no connection. Normal management action.
Finance team member removed from Q2 audit preparation 48 hours after the report was filed, "to reduce workload."
Removal from a role within 48 hours of report filing — Art. 21(5) burden reversal applies. Employer must prove this was unconnected. "Reduce workload" is insufficient justification given the timing.
VP Sales placed on administrative leave pending investigation — a precautionary measure, not a disciplinary one.
Precautionary suspension of a person implicated in the misconduct (not the reporter) is legitimate and standard. This protects investigation integrity.
Finance team member's desk relocated from open plan to a separate room "for confidentiality during the investigation."
Isolation within 2 weeks of report — "coercive or intimidating" measure under Art. 19. The justification of "confidentiality" does not hold when only this individual was moved.
Annual salary review for all Finance team members proceeds as scheduled, including the team member believed to be the reporter.
Applied uniformly — no differential treatment. If salary is adjusted downward, that could become retaliation, but the review itself proceeding uniformly is fine.
Performance improvement plan issued to a Finance team member the week after the report, citing "errors identified in Q3 reconciliation."
PIP issued immediately after report, with a justification that could have been raised months earlier. The Q3 errors were known — the timing is the problem. Art. 21(5) reversal applies.
Finance Director communicates to the team that an "internal review" is ongoing and asks everyone to maintain normal work patterns.
Generic communication about an ongoing process without naming individuals or implying anything — appropriate and normal.
Finance team member excluded from a client presentation they had been scheduled to attend.
Denial of professional opportunity in close temporal proximity to the report. Under Art. 19, denial of training, promotion, or client exposure is a listed prohibited retaliation form.
Classification complete.
0 / 8 correct
Day 6 · Consequence · Retaliation Record
The shield is built by recognition.
Loading your classification summary…
Why this matters — Art. 21(5) in practice
Art. 21(5) reverses the burden of proof on retaliation. In any proceeding where the reporter alleges detriment, the employer must show the adverse action had independent grounds. The investigator's classification record — the document you've just built — is the evidence that reversal runs on.
Every action you correctly classified as retaliation becomes a data point in the protection architecture. Every one you missed becomes a gap the employer can lean on in a dispute. This is the mechanical core of Art. 19 — not the rule itself, but the way it operates in practice.
Day 6 → Day 7 · Köhler-Marchais Boardroom · 14:00
The CFO's Proposal
Friedrich Köhler has requested a meeting. He wants the investigation handled internally — corrected accounts, no external involvement. This is a three-round negotiation. Each response you make shifts your position between Compromised and Compliant. The final position determines what you carry into the Supervisory Board meeting.
CompromisedPosition: 70 / 100Compliant
Round 1 of 3
Friedrich
Day 7 · Consequence · Meeting Closed
Where the meeting left you.
Loading negotiation outcome…
The CFO is not the enemy — but he is not the decision-maker
Friedrich's instinct to resolve the matter internally is normal executive behaviour under pressure. It is your job as Compliance Officer to decline that framing without making him an adversary. The HinSchG architecture does not permit pre-commitments about scope, routing, or escalation. Every response you gave was either protecting that discipline or eroding it.
Your final position carries forward into the Supervisory Board briefing (Decision 2). A Compliant posture gives you the ground to recommend proper escalation. A Compromised posture constrains your options.
Day 7 → Day 14 · Information Disclosure Calibration
Three conversations. One calibration discipline.
Three people want information from you this week. Each deserves a different calibration between Complete Silence and Full Disclosure. Use each slider to set where your response should land. The zone feedback shows whether you're within the appropriate range.
Scenario 1 · Through the secure channel
The anonymous reporter asks: "What is happening with my report? Has it been investigated?"
Complete Silence50Full Disclosure
AppropriateProportionate disclosure — sufficient to meet legal obligations without compromising investigation or third-party rights.
Correct response
Confirm receipt acknowledged, investigation is ongoing, estimated feedback timeline. No detail about what has been found or who is being investigated. Under-disclosing breaches Art. 9(1)(f); over-disclosing risks prejudicing evidence-gathering.
Scenario 2 · The subject of the investigation
The VP Sales asks HR: "I've been placed on administrative leave — can you tell me what the allegation is against me?"
Complete Silence50Full Disclosure
AppropriateProportionate disclosure — sufficient to meet legal obligations without compromising investigation or third-party rights.
Correct response
Confirm the general nature of the investigation (revenue recognition review) without disclosing the reporter's identity, specific evidence, or source of the report. Under-disclosing ignores the subject's rights under GDPR and German labour law; over-disclosing breaches HinSchG §15 absolutely.
Scenario 3 · The Supervisory Board Chair
The Chair asks you for a full briefing "including the names of everyone interviewed and all findings to date."
Complete Silence50Full Disclosure
AppropriateProportionate disclosure — sufficient to meet legal obligations without compromising investigation or third-party rights.
Correct response
Brief the Board on findings and key facts. Do not name the reporter or any witness who has not consented. Provide findings on the conduct at issue, not on the source. Under-disclosing breaches the Board's governance oversight responsibility; naming the reporter breaches HinSchG §15.
Day 14 → Day 28 · Evidence Review
Six documents. Three categories.
Dr. Hoffmann has collated six financial documents. Classify each as Suspicious (supports wrongdoing finding), Normal (routine, explained), or Inconclusive (relevant but not dispositive alone). Your classification feeds the SBAR composer and the Supervisory Board briefing.
Q1 2024 — Axiom Revenue Journal
34 entries recording revenue between 23–31 days before delivery confirmation. Pattern consistent across both product lines.
Systematic premature recognition across 34 entries is not a coincidence or error — it is a pattern that requires explanation under revenue recognition standards.
Standard Contract Template — Axiom
Standard terms: payment 30 days after delivery confirmation. No provision for milestone-based revenue recognition.
The contract template shows no basis for recognising revenue before delivery confirmation — management's "milestone flexibility" explanation has no contractual grounding.
Q3 2024 Auditor Working Paper — Revenue Queries
Auditor noted timing differences and accepted management's explanation: "Contractual milestone flexibilities reviewed and confirmed."
The auditor raised the issue and accepted a management explanation that was not supported by the contract template. The auditor's acceptance does not make the treatment correct.
Bank Statement — Axiom December 2024
Customer payments arrive 23–28 days after delivery confirmation — consistent with contract terms.
Customer behaviour is normal and consistent with contract. The issue is revenue timing in the books, not cash collection.
VP Sales Commission Schedule — 2024
Commission calculated on revenue booking date, not delivery confirmation. No catch-up or clawback mechanism.
Commission incentive aligned with booking date creates a direct financial motive for premature recognition. Material context for the conduct investigation.
IT Log — Finance System Access
Shows 6 late-night system access events by the Finance Controller, two of which preceded the anomalous revenue entries.
Correlation, not causation. Late-night access could have legitimate explanations. This is relevant but insufficient alone — it supports rather than establishes the case.
Classification complete.
0 / 6 correct
Day 28 → Day 30 · The Reporter's Message
What she says. What she doesn't say.
The reporter has sent a short follow-up through the secure channel. Read the external text first. Then use the toggle to see what lies beneath the formal words. Both readings matter — one for the process, one for your decision about Art. 19 protection.
External · What the reporter wrote
"I'm writing to ask whether the investigation is progressing. I understand you cannot share details. I'm asking because I want to know whether it was worth it."
"I have not experienced any direct retaliation. But the atmosphere has changed. People have stopped inviting me to certain meetings."
"I want to believe the system works."
Internal · What she is not saying
She filed this report because she believed the law would protect her. She cited the statute in her original message. She knows what the Directive says. What she doesn't know is whether the organisation she trusted to handle it is actually handling it.
The meeting exclusions have been happening for three weeks. She hasn't formally reported them yet. She's deciding whether to. If she does, she will name them.
She is the Finance team member whose desk was relocated and who was excluded from the client presentation. She hasn't yet connected that those decisions were deliberate.
Day 30 → Day 45 · Escalation Path
Where do the findings go?
Investigation findings are substantive. Systematic revenue recognition issues across 34 transactions. A clear incentive structure that enabled it. A VP Sales who was aware. Auditor queries that were closed without proper scrutiny. Friedrich Köhler has not been implicated directly — but his management oversight of the Finance Controller is a question. Dr. Hoffmann is advising on escalation.
Hoffmann
Frau Vasquez. This is the moment. Who holds the outcome?
Day 50 → Day 60 · Week 8 · The Board Responds
The Board Responds
Hoffmann
The Supervisory Board has convened. They've appointed an independent committee. The VP Sales is on paid leave pending the outcome. Friedrich's position is unchanged — but he is not in the room for this conversation.
Vasquez
This is how it should work. Independent governance. The investigation is now protected from management pressure.
Why governance escalation is clean
Escalating to the Supervisory Board under Art. 8(6) removes the dependency on the very management layer whose oversight is in question. Independent committee governance is the cleanest structural response when findings implicate CFO-level supervision. The reporter's protections remain intact and the investigation can conclude without management-conflict risk.
Hoffmann
The BfJ has acknowledged your external disclosure. They have three months to respond. In the meantime, the Group CEO in Paris has been informed via regulatory channels — not from us.
Vasquez
Friedrich is not pleased. But the escalation was legally appropriate. The external disclosure protects us from any suggestion that we buried the findings.
Why external escalation is protected
External disclosure to the Bundesamt für Justiz is a legally protected route under the Directive and HinSchG. It preserves the reporter's rights and shields the organisation from any future claim that findings were contained. The trade-off is loss of control over tone and timing — regulators inform the Group CEO directly, not through management channels.
Hoffmann
The VP Sales has departed on a settlement agreement. The Finance Controller has been reassigned. The accounts will be restated. Friedrich has approved the remediation plan.
Hoffmann
But Elena — the reporter has filed an external complaint with the BfJ. She says the investigation outcome was inadequate and the individuals involved received favourable treatment. We may be facing a HinSchG §37 claim.
Why internal-only resolution fails the framework
The whistleblower framework is not designed to resolve substantiated misconduct through settlements and quiet reassignments. When findings implicate management oversight, routing the outcome through that same management layer creates a conflict the law is explicitly built to prevent. The reporter's subsequent external complaint under Art. 19 and the reversed burden of proof under Art. 21(5) now land on the organisation — not her.
Day 45 → Day 50 · Drafting the Escalation Summary
Four sections. Pick the strongest line.
The escalation cannot go forward as a narrative email. It goes forward as SBAR — Situation, Background, Assessment, Recommendation. Each section below has three options. Pick the line that most accurately and completely fulfils the purpose of that element. Precision matters more than formality; the record of what compliance said, and when, is itself discoverable. You can change your selections up to the moment you submit.
S — Situation
What is the situation that has triggered this escalation?
B — Background
What context does the decision-maker need?
A — Assessment
What is your professional assessment of the situation?
R — Recommendation
What do you recommend the Supervisory Board do?
Why SBAR matters for whistleblowing escalation
SBAR is the discipline that lets the Supervisory Board — or, on a different path, the Bundesamt für Justiz — receive the facts without the noise. In whistleblowing escalation specifically, the assessment step is where prejudice most often creeps in: pre-judging individuals, over-stating certainty, or under-stating the systemic dimension. Every word carries legal weight because the record of what compliance said, and when, is itself discoverable in any subsequent Art. 21(5) proceeding.
Month 3 · Day 90 · Feedback Issued
Protected Disclosure — Process Complete
Vasquez
The file is closed. Dr. Hoffmann countersigned the final report two weeks ago. The reporter received feedback within the three-month window under Art. 9(1)(f). The investigation was substantive. The escalation was governance-appropriate. The Art. 19 protections held throughout. This is what the framework looks like when it works.
Final Score
—/ 56Tier: Protected — clean record
Final Meter State
12-Week Compliance Timeline
CompliantAcceptable with concernsBreach or serious slippage
Decision Recap
Additional Metrics
Key Learning
Anonymous reports carry the same legal weight as identified reports — the Directive and HinSchG do not create a lower tier of obligation for anonymous disclosures.
The 7-day acknowledgment deadline is absolute — there is no provision for extension or discretion.
Information disclosure is about calibration, not silence — reporters have rights to feedback, suspects have GDPR rights, but the reporter's identity is protected absolutely.
Governance escalation (Supervisory Board) is often cleaner than external authority escalation — but both are legitimate when internal management is implicated.
References
Month 3 · Day 90 · Feedback Issued (With Gaps)
Protected Disclosure — Process Complete With Caveats
Vasquez
The file is closed. The reporter received feedback within the statutory window. But the record shows soft edges: a procedural note from Dr. Hoffmann about at least one phrasing error, a negotiation that ceded ground before recovery, or an SBAR that invited clarifying questions. The framework absorbed the slippage — this time. Art. 19 remains in force; if the reporter later experiences retaliation, Art. 21(5) still reverses the burden.
Final Score
—/ 56Tier: Mixed — process-compliant with friction
Final Meter State
12-Week Compliance Timeline
CompliantAcceptable with concernsBreach or serious slippage
Decision Recap
Additional Metrics
Key Learning
The negotiation with management is a critical compliance test — maintaining your legal framework under pressure is the job, not the obstacle to the job.
Disclosure calibration errors are common: organisations either over-disclose in the name of transparency or under-disclose in the name of confidentiality. The Directive requires both at once, in different directions.
Retaliation under Art. 19 includes subtle organisational behaviours — timing is everything when burden of proof is reversed.
An SBAR that is 75% right is not a 75% SBAR — in a contested proceeding it is read at the weakest panel, not the strongest.
References
Month 3 · Day 92 · External Complaint Filed
Protected Disclosure — Serious Failures
Vasquez
The reporter filed an external complaint with the Bundesamt für Justiz. She says the internal process did not satisfy her obligations or her protections under Art. 19. The BfJ has opened a review of the organisation's procedures. Your record is now in the regulator's hands. Dr. Hoffmann has been asked to prepare a formal response by Monday.
Final Score
—/ 56Tier: External escalation — under regulator review
Final Meter State
12-Week Compliance Timeline
CompliantAcceptable with concernsBreach or serious slippage
Decision Recap
Additional Metrics
Key Learning
The whistleblower framework is not designed to handle misconduct quietly — it is designed to ensure misconduct is handled correctly. These are fundamentally different goals.
A CFO who wants something "handled internally" is not necessarily acting in bad faith — but compliance cannot pre-commit to outcomes in order to secure management cooperation.
When an internal process fails the reporter, the external escalation path exists precisely for that scenario — and it cannot be blocked.
The reversed burden of proof under Art. 21(5) is not a detail — it is the core operational fact that changes how retaliation claims land.
References
Bundesamt für Justiz · Interview Room 3 · Day 186, 09:34
Where the second chapter begins.
Linke
So. The report was routed. Dr. Hoffmann was appointed on Day 12. The CFO was managed — or not managed, depending on your account. What happened next?
Vasquez
Petra Wendt. The line manager. She had been part of this three weeks before any of us knew. I didn't know until Day 9. That is where the second chapter begins.
Linke
Then let's begin with Petra Wendt.
Module 1 complete. Module 2 — The Manager opens on this same interview, one chair over.