Duty of crisis early detection – A ticking time bomb? 

This article originally appeared on gunnercooke’s German website, which can be found here.

Volker Beissenhirtz, German Restructuring & Insolvency, Civil Fraud & Asset Recovery and Compliance partner at gunnercooke, highlights the framework and risks of the legal duty of crisis early detection in this mini-series to help you stay up to date if you operate a business within Germany. 

Often Underestimated in SMEs 

A regulation still relatively unknown in small and medium-sized enterprises (SMEs) could prove to be a ticking time bomb in this phase of polycrisis: § 1 StaRUG requires all companies (regardless of legal form and size) to engage in “crisis early detection and crisis management. 

Although no direct sanctions are imposed, failing to comply with this obligation can still have dire consequences, such as the loss of insurance cover and exclusion from formal restructuring procedures under StaRUG. 

What is the Duty of Crisis Early Detection About? 

Since 1^st January 2021, § 1 StaRUG requires the management bodies of a legal entity to continuously monitor developments that could endanger the entity’s existence (duty of crisis early detection and crisis management). 

This duty is, unlike § 91 para. 2 AktG, fundamentally independent of the legal form and size of the company, and thus applies to all companies and associations operating in Germany. 

Numerous recent cases, especially in the banking sector (e.g., the failed risk management at Credit Suisse), highlight the necessity of identifying risks as early as possible. 

How Should SMEs Specifically Approach the Establishment of the Required Risk Management System (RMS)? 

While the IDW PS 340 standard exists for auditing an existing risk management system in a public limited company under § 317 para. 4 HGB, this and other standards are far too extensive for most SMEs and can only be applied in their basic assumptions. 

According to the relevant definitions, a threat to existence under § 1 StaRUG is assumed if the risk of insolvency is significantly increased or caused. Therefore, when setting up the RMS, the insolvency reasons of the Insolvency Code (see § 17 ff. InsO) should be the utmost limit of risk consideration, as the risk has materialised at the latest when the insolvency conditions are met. 

The proportionality principle applies when setting up an RMS, meaning that scope and structure depend on the vulnerability to crisis and the economic size of the legal entity. As a minimum requirement, companies should work through the checklists listed under “Early Warning Systems under § 101 StaRUG” by the Federal Ministry of Justice in Germany.  

Additionally, some literature suggests that legal entities should have at least a “13-week liquidity plan,” if not one covering a 24-month period (relevant for determining the so-called “impending insolvency” under § 18 InsO). 

What Risks Do Companies Face for Non-Compliance with the Duty of Crisis Early Detection? 

Failing to systematically detect crises, or to actively manage a recognised crisis, can lead to civil liability of the managers both before and during the company’s insolvency. 

After a decision by the Federal Court of Justice (BGH), a violation of the duty to file for insolvency no longer generally leads to an exclusion of D&O insurance liability (BGH, judgment of 18.11.2020 – IV ZR 217/19). However, insurers could use the violation of the duty to establish an RMS to justify the loss of insurance cover in the event of insolvency. This does not necessarily mean the “death of D&O insurance,” but the risk is significant as insurers stand to lose a lot of money in these cases. 

Even before insolvency occurs, there is also the threat of exclusion from using the restructuring instruments of StaRUG. The “Act on the Stabilisation and Restructuring Framework for Enterprises (Corporate Stabilisation and Restructuring Act – StaRUG)” was introduced amidst fears of an insolvency wave during the Corona pandemic to enable company restructuring before insolvency. 

After initial hesitation, the practice is increasingly adopting the possibilities of restructuring through the so-called “restructuring framework.” In some cases, courts have also requested information about existing crisis early detection systems in relation to the declarations to be submitted under § 14 StaRUG. It is likely only a matter of time before a court refuses to allow a restructuring because the company was too late to detect the crisis. 

Conclusion 

In the current flood of new laws impacting German SMEs, the duty of crisis early detection and crisis management under § 1 StaRUG has often been overlooked, probably because the immediate penalties are less severe than those for violating the LkSG or GDPR. 

However, given the current crisis, neglecting systematic risk assessment can have significant economic consequences and block restructuring paths. Therefore, practical guidelines for setting up one’s own risk early detection system are especially important for SMEs.