Audit-proof archiving

Here you can find out the essentials of compliant archiving and how an audit-proof archive helps to manage digital documents securely and transparently over the long term.

The key points in a nutshell:

The digital office has long been part of everyday life. Files are created in seconds on screen, emails have replaced paper correspondence, and e-invoices arrive automatically. While this offers convenience, documents often end up unstructured and scattered across numerous systems. This gives rise to two key challenges: how do you keep track of digital documents? And what requirements does the law impose on audit-proof storage?

What does audit-proof archiving mean?

Audit-proof archiving ensures that digital records are stored permanently in a complete, unaltered and fully traceable manner. Essentially, it involves storing electronic documents in such a way that their authenticity can be verified at any time – including their metadata, content and all relevant processing steps.

‘Audit-proof’ means that a document is preserved exactly as it was originally created or received. Every change must be documented, every version must be clearly identifiable, and every piece of information must be reliably retrievable. It is precisely these characteristics that form the foundation for legally compliant digital processes.

Audit-proof archiving thus meets three key requirements:

  • Integrity – digital files are protected without alteration.
  • Traceability – every action is clearly documented.
  • Accessibility – relevant information is available at all times.

Anyone using digital business processes needs a filing system that consistently adheres to these fundamental principles. Audit-proof archiving ensures that decisions, transactions and documentation remain traceable even years later, and is therefore a fundamental component of modern compliance.

Archiving is not the same as data backup – a brief explanation of the difference

Archiving and data backup serve two entirely different purposes. Data backup protects against data loss by creating copies of files that can be overwritten or restored as needed. Archiving, on the other hand, preserves digital documents in the long term, ensuring they remain unchanged and traceable – including all relevant metadata and versions.

Backups are essential for operational reliability, whereas an audit-proof archive ensures legal certainty, transparency and traceability in the digital office.

Common Misconceptions

There are a number of persistent misconceptions surrounding audit-proof archiving. A particularly common misconception is the assumption that a simple PDF is automatically audit-proof. In fact, it only meets these requirements if it is stored in a suitable archiving system in a way that prevents modification and if every action is logged.

It is also commonly assumed that storing files on a network drive or syncing them with cloud folders is sufficient. While both provide access, they do not offer complete documentation or protection against unnoticed changes. Backups are also often created using electronic Archivierung verwechselt, obwohl sie völlig andere Aufgaben erfüllen. Solche Missverständnisse führen schnell zu Nachweislücken – ein professionelles, revisionssicheres Archiv verhindert genau das.

Which documents are subject to archiving?

Quotations, contracts, approvals, minutes, supporting documents, invoices: many of these used to be produced on paper – today, they are almost exclusively available in electronic form. This raises a simple but crucial question: which digital documents must be stored in an audit-proof manner?

The answer is clear and unambiguous from a legal standpoint: All documents related to a business transaction and therefore relevant under tax or commercial law.

These business documents must be archived in an audit-proof manner

  • Books and Records
  • To invent
  • Financial Statements
  • Management Reports
  • Opening balance sheets, as well as the work instructions and other organizational documents necessary for understanding them
  • Booking documents (such as e-invoices)
  • Incoming business and commercial correspondence
  • Copies of the business and commercial letters that were sent
  • Documents pursuant to Article 15(1) and Article 163 of the Customs Code
  • Other documents, to the extent they are relevant for tax purposes
Die GoBD: Eine Geschichte von Mythen und Legenden

The Foundation: The 7 Pillars of Audit-Proof Compliance

Audit compliance is based on seven clearly defined fundamental principles. These principles ensure that digital records remain accurate, unalterable, and traceable at all times:

  • Accuracy – The content matches the original.
  • Completeness—nothing should be missing.
  • Immutability—nothing may be changed without being noticed; every modification must remain traceable.
  • Traceability—every action is fully documented.
  • Organization – Documents are filed in a structured and easily retrievable manner.
  • Security – Access and protection mechanisms are ensured.
  • Compliance with Retention Periods – Documents are retained for as long as required by law.

In short: These seven pillars form the framework for audit-ready digital records.

And only an audit-proof archive consistently meets these requirements, which, not least, makes life easier for auditors. Because in the end, that’s what really matters.

PROXESS DMS

With our TÜV-certified PROXESS DMS solution, you can archive your business documents in an audit-compliant manner and retrieve them quickly.

learn more

Audit-Compliant Storage—Implementing It Step by Step

The key question is: Which documents subject to retention requirements enter the company, and by what means?

Typical input channels include:

  • Automated data imports from ERP or e-invoicing systems
  • Paper documents to be digitized, including OCR text recognition
  • Clearly defined entry points (e.g., a central inbox for invoices)

The more accurate this data collection is, the lower the risk of gaps later on.

The second step involves determining exactly what type of document it is and the subject-matter context to which it belongs

In addition, the metadata for the archive is defined. Document type (e.g., invoice, contract, minutes)

  • Related business transaction or process
  • Information such as the date, amount, or customer number

The combination of subject classification and metadata forms the “control center” of the document. It ensures that automated verification and filing processes function smoothly—and that documents remain reliably retrievable even years later.

One thing is especially important here: The document must remain unchanged and clearly traceable. Every subsequent review, every version, and every access must still be verifiable even years later.

What matters most?

  • non-volatile storage
  • Unique identification of the document
  • Unique identification of the document
  • Logging of Accesses and Actions

Audit-compliant archiving is thus the moment when a document becomes a permanently reliable piece of evidence—regardless of how the company’s systems or processes may change in the future.

As soon as a document arrives at the company, the legally mandated retention period begins. It depends on the type of document and typically ranges from six to ten years—or longer in some cases. At the same time, GDPR requirements come into effect, mandating that documents be deleted once the retention period ends. How can this balancing act be achieved without manual effort?

An archiving system automatically manages retention periods. Retention periods are stored in the system based on the document type. After that, the processes run reliably in the background.

An archiving system automatically manages retention periods. Retention periods are stored in the system based on the document type. After that, the processes run reliably in the background.

  • Automatic assignment of the correct retention period
  • System-driven monitoring until the deadline
  • Clear labeling for documents entering the disposal phase
  • Clear labeling for documents entering the disposal phase

The result: Documents are neither disposed of too early nor retained for an unnecessarily long time. Companies remain compliant with the law and reduce the workload on their departments.

Audit compliance depends on transparency. That is why it must always be possible to trace who opened, modified, or reviewed a document. An audit-compliant archive automatically logs these steps, thereby protecting documents from tampering.

Key features for reliable traceability:

  • Role-based permissions (e.g., accounting, purchasing, management)
  • clear distinction between reading and editing
  • clear distinction between reading and editing
  • Support for the dual-control principle for sensitive processes (e.g., deletion of documents after the retention period has expired)
  • Support for the dual-control principle for sensitive processes (e.g., deletion of documents after the retention period has expired)

This transparency builds trust in data integrity throughout the retention period in the audit-proof archive. At the same time, it meets key GoBD requirements and facilitates both internal and external audits.

How to choose an Audit-Compliant Archive

Look for certifications

When choosing an archiving system, one question takes center stage: Can the software truly store documents in a way that is audit-proof in accordance with GoBD? A quick and reliable indicator of this is, for example, the “TÜV-certified archiving” certificate.

What does that mean?
This certificate from TÜV Saarland attests that a software solution fully complies with the strict legal and technical requirements for electronic archiving. The audit is based on the principles of the GoBD, the German Commercial Code (HGB), and the German Tax Code, and confirms to users that documents are stored in a tamper-proof, legally compliant manner and are available at all times. In addition to functional security, the seal validates that the IT security aspects comply with modern standards such as the BSI IT-Grundschutz.

Cloud, on-premises, or hybrid?

Companies should clarify how the archive will be made available:

  • Cloud: reduced IT workload, automatic updates.
  • On-premises: full control, but requires your own maintenance efforts.
  • Hybrid: Certain data must remain on-premises, while other documents are stored in the cloud

The choice depends on the company’s requirements, compliance standards, IT resources, internal policies, etc.

Which business processes and systems are affected?

It is important that the archive be able to integrate with all of the company’s relevant business processes and systems. Typical sources include:

  • Incoming Invoice Processes
  • ERP- oder CRM-Systeme
  • Contract and quality documents, etc.

A good archiving system organizes documents in a structured manner, automatically assigns metadata to them, and seamlessly integrates them into existing business processes.

Conclusion

Revisionssichere Archivierung ist eine Kernaufgabe für jedes Unternehmen. E-Rechnungen und neue Compliancevorgaben erhöhen den Druck, Informationen sauber, nachvollziehbar und unveränderbar abzulegen.

The question of how an archive is technically deployed is becoming increasingly important. Experience shows that purely cloud-based or purely on-premises models have their limitations. The trend is clearly moving toward hybrid solutions—they combine local control with the flexibility of modern cloud services and adapt better to different departments. Companies that make this strategic decision early and deliberately lay a foundation that will stand the test of time: for stable processes, simple audits, and audit-proof archiving you can trust.Retention—Implementing It Step by Step

Contact us

Are you interested in our solution?

Our experts are happy to assist you with a personal consultation or a customized online demo.

Contact us

Frequently Asked Questions About Audit-Compliant Archiving

Legally compliant or audit-proof archiving means storing documents in a way that complies with legal requirements (GoBD, HGB, AO, GDPR). It ensures that documents remain valid in the event of tax audits, legal disputes, or internal audits and are accepted as evidence.

Accordingly, a legally compliant archive must ensure that the archived documents and data:

  • The following are non-modifiable: Once documents have been saved, they may not be modified. Changes must be documented, for example, through versioning.
  • Secure storage: The archiving system must protect documents and data from loss or unauthorized access.
  • Stay readily available and easy to find: According to GoBD, documents must be retrievable at any time and machine-readable.

GoBD is the abbreviation for the principles governing the proper maintenance and retention of books, records, and documents in electronic form, as well as data access.

The GoBD is a guideline issued by the Federal Ministry of Finance (BMF) for digital accounting and archiving, designed to ensure that documents are tamper-proof, traceable, and complete. The current GoBD 2020 guidelines were published in a letter from the BMF dated November 28, 2019, and took effect on January 1, 2020. It replaces earlier regulations (GoBS, GDPdU) and applies to all taxpayers who process electronic and digital documents in order to make them verifiable by the tax authorities. Key principles include traceability, completeness, accuracy, orderliness, timeliness, and immutability.

The GoBD does not specify which documents must be retained or for how long; rather, it supplements and clarifies the general legal principles regarding the proper handling of digital documents within a company.

Additional Information on the Provision of Data Media:
At the request of the tax authorities, the audited company must also provide, as part of an audit, all structural information necessary for the evaluation of the data in a machine-readable format. To assist with this, the Federal Ministry of Finance (BMF) has provided supplementary information on the provision of data carriers: 2019-11-28-GoBD-Supplementary-Information-on-the-Provision-of-Data-Carriers

We regularly have the GoBD compliance of our PROXESS DMS and HABEL DMS solutions verified through TÜV certification.

When it comes to the legal regulations governing DMS/ECM systems, a distinction is made between aspects of commercial law, tax law, and civil law.

Commercial Law
Under Section 257 of the German Commercial Code (HGB), merchants are required to retain relevant documents in accordance with generally accepted accounting principles (GoB). Section 257 of the HGB also sets forth rules for the digital retention of documents.

Tax Law
Retention periods for analog and digital documents are governed by Section 147 of the German Fiscal Code (AO). Under the Fourth Bureaucracy Relief Act (BEG IV), a shortened retention period of 8 years has been in effect since January 1, 2025, for certain documents (e.g., accounting documents, receipts, invoices).

GoBD
The GoBD 2020 sets forth rules for handling electronically archived documents. The GoBD addresses the proper maintenance and retention of books, records, and documents in electronic form, as well as access to their data. The GoBD also requires the creation of procedural documentation.

GDPR
The EU General Data Protection Regulation (EU GDPR) takes effect on Mavay 25, 2018. It governs the handling of personal data in the archive (access, deletion after the retention period, security).

Civil Law
In civil law, a visually archived document is considered an “object of visual inspection.” In such cases, the judge may decide on a case-by-case basis whether to accept a reproduction of an original in the relevant proceedings. However, if the person who reproduced the document is able to prove that it is a faithful reproduction of the original in terms of both image and content (e.g., through documentation of the proceedings), the document is generally accepted.

Yes, documentation is absolutely essential for GoBD-compliant archiving. In the event of a tax audit or financial audit of the company, it serves as a key document for auditors, providing a comprehensive overview that helps them understand the technical and operational processes—in other words, the procedural documentation describes exactly “how” to achieve audit-proof archiving.

The purpose of procedural documentation, therefore, is to make your company’s digitized accounting transparent and understandable to auditors. It thus becomes an indispensable tool if you want to maintain your company’s books, documents, and records in compliance with GoBD.

 

 

The content, structure, and sequence of the relevant processes must be fully evident from the process documentation. The necessary elements of process documentation are therefore:

  • a description of the domain-specific solution
  • A description of the technical solution
  • A description of the technical solution
  • a description of how data integrity is maintained
  • User Instructions

You can find a detailed description here: Contents of a Process Documentation.pdf

Below are two samples of possible procedural documentation from the German Association of Tax Advisors:

At its core, compliance means adhering to applicable laws and guidelines.
With regard to DMS systems, particular attention must be paid to retention requirements, data security, and data protection.

No. Only business-related emails need to be archived—that is, messages with tax or accounting implications, such as quotes, order confirmations, or invoices, etc. Personal or purely organizational emails are not included, nor are promotional or spam emails.

Yes—but only if the process is done correctly. A PDF is not automatically audit-proof. Only when it is stored in an audit-proof archiving system does the GoBD principle of immutability apply: The document is either protected against changes, or every change is fully logged. What matters, therefore, is not the file format, but the storage process and the archive’s technical protection mechanisms.

Yes. Cloud archiving is permitted as long as the system meets the GoBD requirements and the provider processes data and documents in compliance with the law. This includes clear protocols, traceable processes, and reliable protection against undetected changes.

And how important is the location of the data?
For German tax authorities, the location where data is stored plays a crucial role. As a general rule, tax-related data must be stored in Germany or in an EU/EEA country so that the tax authorities can access it at any time. While storage outside this area is possible, it requires special authorization (“Permission to Transfer Data Storage Media Abroad”). Such authorization is rarely granted these days.

In short:

  • EU/EEA Cloud? No problem, as long as GoBD requirements are met
  • Outside the EU/EEA? Only with authorization
  • Industry Trend: Hybrid Models to Keep Sensitive Data Local

Damit bleiben Unternehmen flexibel und erfüllen gleichzeitig die Anforderungen der Finanzbehörden.

For most tax-related documents, retention periods range from 6 to 10 years. Since the legal amendment regarding mandatory e-invoicing in 2025, invoices must now be archived for only 8 years, while annual financial statements must still be retained for 10 years. It is important that the documents remain complete, legible, and unaltered throughout the entire retention period—regardless of the medium in which they were received.

The GoBD defines the key requirements for handling tax-related data. For archiving, this means that documents must be tamper-proof, complete, traceable, and available at all times. In addition, all steps must be documented. In short, the GoBD provides the binding framework that every audit-proof archive must follow.

If records are not audit-proof, this can result in tax estimates, additional tax assessments, or tax objections. Internal risks also increase: documents may be missing, tampered with, or no longer traceable. In the worst-case scenario, this can lead to legal consequences or delays in important business processes. Proper archiving therefore not only protects against audit risks but also stabilizes day-to-day operations.