GoBD-compliant storage: immutability and evidence

Of all the requirements listed, immutability is the one on which organically grown storage most often fails. It means that once a record has been captured it must not be altered in a way that makes the original content impossible to establish. That is not a ban on corrections. An invoice captured incorrectly may be corrected — but the original version has to be preserved, and the correction has to be traceable with time, author and reason.

The gap to common practice is considerable. In many companies documents sit in a folder structure that grew over the years on a network drive. Anyone with access can replace, rename or delete a file without leaving a trace. That nobody does so is a matter of trust, but it is not evidence. This is exactly the distinction an audit looks at: not whether something was changed, but whether a change would be noticed at all. Storage is not unalterable because nobody alters it, but because an alteration cannot pass unnoticed.

Several technical routes lead to the goal, and none of them requires a large purchase. What matters is the combination of restricted rights, a log that records filing and changes, and a backup that cannot be overwritten from the same account. Leave out one of these three pillars and the requirement is not half met, it is not met at all.

Documents subject to retention have to remain machine-analysable for the whole period. That does not mean you can look at them on screen; it means data can be sorted, filtered, joined and exported. A stack of scanned pages in a folder does not meet the requirement, however legible each page may be. The difference becomes tangible the moment somebody asks which incoming invoices from a particular supplier exceeded a certain amount in the third quarter.

From this follows a rule that is often broken in practice: what arrives structured must stay structured. Since 1 January 2025 every domestic company must be able to receive electronic invoices in business-to-business transactions (Value Added Tax Act). With such an invoice, the structured data set is the original. A viewing format generated from it is a rendering, not a substitute; keeping only the rendering and discarding the data set gives up precisely the analysability at stake.

The same applies to conversions inside the company. If a document is transferred into another format, for instance when a system is replaced, the original version must be preserved, the conversion must be logged, and no analysable information may be lost in the process. Turning a spreadsheet with formulas into an image destroys analysability, even though the figures remain visible.

For day-to-day operations that means every document needs a set of structured attributes, regardless of whether it exists as an image, as a data set or as both. This index is what turns a collection of files into analysable storage. It can be represented in almost any system in use in mid-size companies, and in the simplest case can be kept as a separate table alongside.

The last fields of each row are the important ones: the link to the journal entry and the checksum over the file. Without the link there is no path from document to posting; without the checksum there is no evidence that the file is unchanged since filing. Where documents converge from several upstream systems and the index has to be populated from different sources, this becomes a matter of data integration rather than something accounting can handle on the side.

The process documentation is the part most often missing and the one that would cost the least effort. It describes how documents enter the business, what happens to them, where they are kept, who may access them and how long they are retained. Its purpose is to give a knowledgeable third party an overview of the workflow within a reasonable time. If it is missing, or if it describes a different workflow from the one actually lived, that can call the propriety of the accounting into question.

It usually consists of four parts. That structure is not an end in itself: each part answers a different question — what happens in business terms, how it is operated, what it runs on, and how operations are safeguarded.

Two points are regularly overlooked. First, the process documentation is itself subject to retention, for as long as the records it refers to (German Fiscal Code). Second, for any given period the version in force at the time applies. It follows that changes are dated, earlier versions are kept, and it is visible from when which rule applied. A file that is silently overwritten does not meet that standard — and repeats precisely the mistake immutability is meant to prevent.

The effort stays manageable if you treat the task as recording the current state rather than as writing. For a company with a modest system landscape, a workable first version takes a few days. Its structure follows the same rules as any other process documentation: short, current, dated, and kept somewhere it can be found by a person who is not yet with the company today.

Retention periods differ in length, and since the most recent amendment a shorter period applies to accounting vouchers than before. As matters currently stand, books, inventories, annual financial statements, management reports and the working instructions and organisational records needed to understand them must be kept for ten years, accounting vouchers for eight years, and commercial and business letters received or sent for six years (German Fiscal Code). The period starts at the end of the calendar year in which the last entry was made or the document arose. Because there are transitional provisions and sector-specific particularities, applying this to your own case belongs in a conversation with your tax adviser.

Across those periods the records must not only exist but stay legible and analysable. That is less self-evident than it sounds: media age, formats disappear, programs can no longer be started after two system changes. The IT-Grundschutz framework of the Federal Office for Information Security treats archiving as a building block of its own and requires, among other things, that restoration be tested regularly rather than merely planned (BSI). For document storage that means something very practical: once a year, actually retrieve and open a document from an older year.

During a tax audit the authorities may access the data in three ways: directly on the system with read-only access, indirectly through evaluations the business produces to specification, or by handing over the data on a storage medium (German Fiscal Code). From that follows a very tangible task: the export has to exist, it has to contain documents together with index and links, and it should have been tried out once in calm conditions. An export produced for the first time during a running audit costs time and nerves — and raises questions that could have been avoided.

For orientation: taking stock of document paths, with an assessment and a sequence, starts at 1,900 euros net. Implementing one workflow — storage, rights, index, logging, export and the accompanying description — starts at 4,900 euros net. The effort depends less on technology than on the number of document types and on the special cases: the document that passes through three stations, the till with its own recording obligation, the upstream system that is hard to export from. Current rates are listed on the pricing page.

The second block is operation, and it is underestimated more often than the build. Storage that nobody watches loses its properties within a few months: rights get added and never withdrawn, new document types appear without a scheme, the description quietly ages. Ongoing support starts at 190 euros net per month and covers monitoring the backup, testing restoration, maintaining rights and keeping the documentation current. If you keep that task in-house, at least give it a name. How the path from paper to an orderly file works in detail is described on the document digitisation page.