Audit-proof archiving and GoBD audit program.
How to audit whether records relevant under German tax and commercial law are retained completely, immutably and readably for the whole period and whether the process documentation proves this.
Last updated: 13 October 2026 · Sample, not legal advice
Download the sample as PDF 8 pages, no sign-up
Download as Excel template with columns for result and notes, no sign-up
Audit objective
The audit assesses whether the organisation records documents and data subject to retention completely, retains them immutably and analysably for the statutory periods and whether an internal control system and current process documentation evidence proper bookkeeping. It also assesses whether scanning, system changes, data access by the tax authorities and deletion after expiry are governed.
Scope
- Accounting, upstream systems and archive systems holding data and documents subject to retention
- Incoming invoices, commercial and business correspondence including email and scanned paper vouchers
- Process documentation, internal control system and permissions in the archive
- Out of scope: the substantive correctness of individual postings
Audit program
| No. | Criterion | Reference | Audit procedure | Expected evidence |
|---|---|---|---|---|
| 1 | Records subject to retention and their periods are defined; accounting vouchers have a shorter period than books and financial statements. | § 147(1) and (3) AO; § 257(1) and (4) HGB | Reconcile the retention policy with the statutory periods and spot-check the settings in the archive. | Retention policy, schedule of periods, archive system settings |
| 2 | Responsibility for proper bookkeeping is defined, even where tasks are transferred to service providers. | GoBD para. 21 | Ask about responsibilities for accounting, archive and outsourced processing and reconcile them with contracts. | Organisation description, service provider contracts |
| 3 | Current process documentation describes capture, processing, retention and controls of the data. | GoBD para. 151 to 155 | Read the process documentation, check its version and trace the described flow for one voucher. | Process documentation with version history |
| 4 | Postings and records cannot be altered unnoticed; changes are logged. | § 146(4) AO; GoBD para. 58 and 107 | Have the technical immutability measures in the archive and accounting system explained and review change logs. | System description, change logs, retention lock configuration |
| 5 | An internal control system with established, performed and logged controls secures compliance with the bookkeeping rules. | GoBD para. 100 | Ask about controls such as access rules, reconciliations and plausibility checks and review logs for three controls. | Control description, control logs |
| 6 | The system is protected against loss and against unauthorised entries and changes. | GoBD para. 103 | Check backup, permissions and restore tests for the archive. | Backup concept, permission extract, restore test record |
| 7 | Electronic records remain available, promptly readable and machine-analysable for the whole period. | § 147(2) AO; § 146(5) AO | Retrieve five records from the oldest year and check readability and analysability. | Retrieval records, format overview |
| 8 | Scanning of paper vouchers follows a documented procedure; paper is destroyed only after a defined check. | GoBD para. 136 and 140 | Read the scanning instruction and trace capture, check and destruction for five vouchers. | Scanning instruction, check evidence, destruction rule |
| 9 | On a system change or when data is moved out, analysability is preserved for the remaining period. | GoBD para. 142 | Trace the last system change and check how legacy data can be analysed today. | Migration record, legacy data concept, retrieval example |
| 10 | Data access by the tax authorities is prepared: responsibility, export formats and read access are defined. | § 147(6) AO; GoBD para. 158 | Ask about the procedure for tax audits and have a test export in the required format demonstrated. | Procedure description, test export, auditor role in the system |
| 11 | The archive system is secured technically and organisationally and protects records against loss and falsification. | BSI OPS.1.2.2; ISO/IEC 27001:2022 Annex A 5.33 | Review the archive concept and check operation, storage media and responsibilities of the archive. | Archive concept, operating documentation |
| 12 | After the periods expire, data is deleted in a controlled way unless other obligations prevent it. | BSI CON.6; ISO/IEC 27001:2022 Annex A 8.10 | Read the deletion concept and trace the last deletion after expiry with its log. | Deletion concept, deletion logs |
Documents to request
- Retention policy and schedule of periods
- Process documentation with version history
- Description of the internal control system and control logs
- Archive concept and system description
- Scanning instruction
- Backup concept and record of the last restore test
- Procedure for data access by the tax authorities
- Deletion concept and deletion logs
Typical findings
- Process documentation is missing or describes an outdated state.
- Emails that are business correspondence are not archived.
- Paper vouchers are destroyed after scanning without a defined check.
- After a system change, legacy data exists only as print files.
- Archived documents can be deleted by administrators.
- Data is not deleted after the periods expire.
Note on references
The references point to laws, regulations and standards so that you can read the requirement in the original. No normative text is reproduced. Criteria and procedures are original wording and replace neither the text of the provisions nor legal advice. Whether and to what extent a provision applies to your organisation should be clarified before the audit.
The complete package
This sample shows the objective, the audit steps and the document list on one page. For your own audit topic, ProAuditMap creates the complete package: audit plan, audit program per audit dimension, document request list, interview guides, schedule, communication and report template. You review the draft, approve it and export to Excel and Word.
Create account View a complete sample package View pricing