Digital business processes simplify both workflows and collaboration within companies: Data and documents arise along the way – as do the legal obligation to archive them. No need to worry. Here we highlight in particular the requirements for audit-proof archiving of documents for companies subject to accounting requirements.
Definition: What does archiving mean?
Secure archiving means the permanent storage of documents and data in an unchangeable state: just as the document reached the company. Two additional requirements: On the one hand, archiving is a process that must follow a systematic approach. On the other hand, the storage and retention of documents must take place in a controlled manner.
“Systematic” and “controlled” in the context of electronic archiving simply mean that you have established a structurally consistent archiving process. Ideally, the process is described in documented procedures: Where are which documents stored with which IT systems and who has what kind of access to them? So much for the definition of archiving in a nutshell.
good to know
Which documents have to be archived?
As soon as the data and documents created in digital business processes have fiscal relevance, they must be archived in an audit-proof manner. Documents to be archived typically include the following:
- Books and records (e.g. business transactions, bookings, etc.)
- Inventories (e.g. records detailing the physical existence and value of all assets and liabilities)
- Financial statements
- Management reports (e.g. as legally significant additions to the annual financial statements)
- Opening balances as well as the operating procedures and other organizational documents required for understanding them
- Accounting documents (e.g. incoming invoices, but also sent invoices)
- Received commercial and business letters (any correspondence for the preparation, settlement, conclusion, or revocation of a transaction)
- Copies of commercial and business letters sent
- Documents under Article 15 (1) and Article 163 of the Customs Code (e.g. import customs declaration, invoices, etc.)
- Other documents relevant for taxation (e.g. HR documents)
Document retention periods
In principle, businesses subject to accounting requirements must retain business documents and comply with retention obligations during the archiving of documents. Basically, there are two different retention periods of 10 and 6 years. Below is a partial list of the most common business documents and their retention periods.
The 10-year retention period applies to the following documents
- Progress payments
- Delivery bills (if the delivery bill is also the invoice)
- Invoices
- Accounting documents
- Outgoing invoices
- Depreciation documents
- Bank statements
- Financial statements
- etc.
The 6-year retention period applies to the following business documents
- Offers and quotations
- Import/export documents and customs documents
- Company audit reports
- Commercial and business letters
- Plus, other documents relevant to taxation
These two retention periods are based on tax and commercial law for business entities. However, it is also clear that when it comes to archiving documents, retention obligations of completely different lengths may apply. Without getting into details, longer retention periods of 30 years apply, for example, for:
- Judgments
- Dunning notices
- Trial records
Likewise, various industries are familiar with retention periods for archiving documents that apply specifically to them. Examples include the construction industry, the energy sector, medical device manufacturers, food processors, pharmaceutical companies, etc. However, it should be noted here as well that other statutory provisions apply.
Audit-compliant archiving made easy
For electronic archiving in general and specifically for the entire retention period, all documents to be retained must be archived in an audit-proof manner. This brings us to the question of what “audit-proof” means in the context of electronic archiving.
What does audit-proof mean?
In the context of digital archiving, audit-proof means that the document to be stored is protected against changes. It must always be available in the form in which the document initially reached the company – unaltered.
What does audit-proof archiving mean?
Business documents, records, and receipts that must be kept in the archiving system must meet the requirements of commercial and tax law requirements. Audit-proof archiving therefore primarily means that the archiving software complies with the following four aspects:
- Immutability
- Traceability
- Completeness
- Availability
The factors just mentioned refer to all changes made to the document. They are intended to protect against changes to the document. If changes take place, then only on a copy of the document. When this happens, it must be documented who made changes to the document, when and where. The modified copy must also contain a reference to the original document.
Emails with fiscal relevance or emails that can be understood as commercial letters, i.e. that depict the company’s business correspondence, naturally fall under the same retention obligations.
However, there is one difficulty: Over the last two decades, email has become a widespread medium of exchange and communication. Millions of emails are sent and received every day – and so the email inboxes of companies also turn into a data dump, something that every vacationer knows from the first day back at work. The difficulty in GoDB-compliant email archiving is now quite simply to make the distinction between whether an email has fiscal relevance or not. For an introduction to the topic, see the following two Newsroom articles: 6 reasons for email archiving and 7 mistakes regarding email archiving.
Under no circumstances should you confuse the audit-proof archiving of emails with a backup of your email inbox or mail server. A backup has a different purpose and is intended for storing emails in case of data loss, just to quickly restore emails, etc. As a rule, audit-proof email archiving cannot be achieved with a backup alone.
Advantages and disadvantages at a glance
Analog versus digital archiving
The topic of archiving has been driving human history for several thousand years. Not to get too deep into the definitional weeds, archiving is essentially always a matter of saving knowledge for the future. For example, findings from the Mesopotamian city of Nineveh refer to the time around 4000 BCE, when jurists and priests wrote the first archives on clay tablets in cuneiform to preserve collective memories for the future.*
Advantages of analog archiving
Despite the many disadvantages of archiving on analog media in today’s world, there is one exceptional, unbeatable advantage of analog archiving: its permanence. The 4000-year-old clay tablets from Nineveh bear witness to this. No wonder that contemporary projects like “Memory of Mankind (MoM)” rely on ceramic panels as a storage medium.
The choice of archiving system therefore stands or falls with the answer to the question of why one wants to archive at all – and “real” long-term archiving for a million years, as in the MoM project, only works reliably with ceramic panels. However, such long retention periods are not part of the objective for archiving business documents. Here, retention periods of only 10 years are to be expected as a rule.
Disadvantages of analog archiving
Apart from the archiving objective just mentioned, analog archiving systems have only disadvantages. They are not suitable for fast-moving business environments and processes. Compared to digital archiving, analog archiving systems prevent modern, decentralized
working styles right from the start. The old “take a quick look in the archive” simply does not work if you are in Munich and the archive is in Hamburg. Even beyond that, however, there are other disadvantages of analog archiving:
- Costs for paper or other analog storage media
- Costs for archive rooms far exceed the costs for a digital archive
- Searching in an analog archive is inferior to searching in a digital archive even just in terms of the time required
- Decentralized and location-independent work is not possible with an analog archive
- Paper consumption is not kind to the environment and wastes valuable resources
- Personnel costs incurred for the analog archive
Advantages & disadvantages of digital archiving
Just to get one thing out of the way first: There is no real disadvantage to digital archiving. At least not as long as one is clear about the requirements placed on the digital archive scenario. Let’s summarize the situation:
What are the advantages of digital archiving?
- The majority of documents already reach the company digitally or are created digitally – so digital archiving is only logical and avoids media discontinuities
- Enables location-independent work, making digital archiving the perfect basis for decentralized organizations
- Speeds up access and search times: one of the important advantages of digital archiving since the archive can be accessed from any workstation with just a few clicks
- As a single source of truth, the archive system serves as the perfect basis for deep insights and data-based decisions
- Saves costs by eliminating file rooms, files, paper, printers, toner, etc.
- Less space and organizational effort required
What are the disadvantages of digital archiving?
- As mentioned above: the limited lifetime of electronic storage media
- Complexity of the procedures used: especially with regard to audit-proof archiving
- A certain amount of effort for access protection if the archive is to be accessible over a network
In summary, the advantages of digital archiving outweigh the disadvantages, at least in the scenario of audit-proof archiving as discussed here.
Requirements for archiving software
Digital is more fun, no question. You may already be using electronically managed processes in many areas of your business. If so, audit proof archiving is only logical. To simplify the process of choosing archiving software, here is a list of common criteria that will help you make the right choice for the first step. Keep in mind, however, that your company’s requirements will be a key factor.
- Internationality in terms of legal and compliance conformity: With respect to GDPR for the handling of private data in the EU
- For the archiving system, pay attention to certificates and attestations, e.g. IDW PS-880 and ISAE 3000
- Multilingual archiving software interface
- Diverse format options: The archiving software should be able to handle as many document and file formats as possible
- Roles and rights concept: The archiving software should make use of a finely granular and sophisticated rights concept
- Hosting of the archive: The choice depends on your requirements – cloud, on-premises or hybrid options are available
- The electronic archiving solution should be available as a SaaS solution: This makes it clearly calculable in terms of number of users and usage time
- Considering the archive from the user’s perspective, easy usability and sophisticated search functions are essential
- Make sure that the archiving software and its provider have already been on the market for a long time
- Check for options to connect the digital archiving to third-party systems, such as ERP or financial accounting systems (SAP ERP, 365 Business Central, etc.): This is a prerequisite for seamless digital processes, e.g. incoming invoice processing or contract management
- If necessary: Take note of options for digitizing paper-based documents to ensure they can be archived smoothly
Provider selection
What should you pay attention to when introducing archiving software at your company?
Investing in a system for audit-proof archiving represents an investment in the future. In this context, much depends on the current situation of your company. Before you implement an archiving solution, you should ask yourself important questions about it and answer them honestly. Since an archive is used by many departments, you should involve these departments in the deliberations. For the sake of simplicity, here is a schematic overview, divided into four steps:
Have conversations with relevant departments. Questions should include: Why, where, and with what should an archive system help? What are the goals to be achieved by this? Audit-proof archiving is not the only important aspect. Try to categorize the answers to these questions.
In the first step, a rough categorization could be as follows:
- Which archive functions are absolutely necessary and which are simply nice to have?
- Don’t forget to think about the future already today: What could become important later?
Once you have completed this list, engage with the various departments to expand the list.
This involves identifying key figures that describe the current status in the company with regard to the day-to-day handling of archiving. Questions of this type could be:
How long does it take your colleagues to enter, file, archive, and eventually search for information, measured in total minutes per document?
Record the time in minutes for
a) Entering a document
b) Filing a document
c) Archiving a document
d) Searching for a document
Note these times per document, then calculate the time required for all documents per day, and finally for a whole month. This gives you a first impression of how much time manual, paper-based archiving costs.
Finally, answer the following two questions:
g) What is the footprint of your company archive in m²?
h) What is the monthly rental cost (including heating) of the company archive?
Try to accurately capture the current situation. Only when you know which paths documents take through the company can you plan an approach for achieving the optimizations hoped for with the archive introduction. Consider: Transformation alone does not improve the process.
Ask the following questions:
- Which document and file types exist in the company?
- How do documents flow through the company from arrival to filing, and which intermediate stations lie along the way to the archive?
- Which employee groups are involved in the document flow, who processes which documents and when?
With this approach, you will recognize quite quickly which processes prove to be efficient or inefficient. This process will help you find the biggest pain points in your company.
Once an initial determination of the above metrics has been made, you will have a strong basis for further argumentation within the company. The decisive factor at this point will be open communication with the respective archive developer, who can give you a realistic estimate of the target values to be achieved with the archive.
User acceptance – key users from the business departments
Once you have completed this step, the shortlisted archive systems can be subjected to user testing. Identify a representative sampling of the users in the departments that will eventually work with the solution, then arrange for them to participate in a workshop with the provider. Have them determine whether the archiving solution meets expectations. Depending on the archive, a test installation with sample data is also possible. This enables testing even beyond the workshop. With SaaS and cloud solution providers, the steps just mentioned can be simplified, and much of it can
certainly take place online.
User-friendliness: Even with compliant archiving
Take the judgment of the key users from the specialist departments seriously. Because the future archive of choice should truly simplify the work. Ask yourself: Would you look forward to working with the archive solution that was demonstrated to you by the developer? Invite key users from the departments to answer the same question. Have the selected key users tell you:
- Is the future archiving solution really a pleasure to work with?
- Does use of the software seem simple, self-explanatory, coherent, and ergonomic?
A solid start to audit-proof archiving: The data archive as the beating heart of your company
Now that you have gained an overview of the requirements of compliant retention procedures and periods as well as statutory provisions and rules, there is one last thing to say on the topic of digital archiving. The archive is increasingly moving to the center of the information architecture of modern companies. What was considered a “data dump” ten years ago is now developing into the beating data heart of every company. Starting from integration of the archive into adjacent business processes in ERP systems and the need for audit-proof archiving, you can create the perfect data basis for seamless digital business processes: that means location-independent collaboration and a single point of truth, from which you can look clearly into the past and confidently into the future.