GoBD archiving: keeping receipts audit-proof

If you simply store invoices as PDFs in a company folder, you will in most cases not meet the tax authorities' requirements for proper archiving. For businesses with bookkeeping and record-keeping obligations, audit-proof archiving of tax-relevant documents is a legal duty, not an optional extra.

In short: GoBD-compliant archiving (the German principles for the proper keeping and retention of books, records and documents in electronic form and for data access) requires businesses with bookkeeping and record-keeping obligations to retain all tax-relevant receipts and relevant emails in a way that is unalterable and traceable. Practically every business with a bookkeeping or record-keeping obligation is affected. If you do not archive receipts in an audit-proof way and do not document the process, you risk, in a tax audit (Betriebsprüfung), an estimate of the tax base or the rejection of your accounts.

Who is required to archive in line with the GoBD?

All businesses and self-employed people who are required under commercial or tax law to keep books or records are obliged to do so, from simple recording of business income and expenses to full double-entry bookkeeping.

The GoBD, an administrative directive of the German Federal Ministry of Finance (BMF), specify how this obligation arising from § 147 AO (the German Fiscal Code) is to be put into practice, especially for digital receipts and IT-supported bookkeeping processes. They apply regardless of company size as soon as electronic invoices, cash register systems or digital receipts are in use.

In practice, this affects not only incorporated companies with traditional bookkeeping obligations, but also freelancers and small business owners who only prepare a cash-basis profit calculation: they too must archive their receipts so that they remain unaltered, complete and retrievable within a reasonable time. Anyone using a cash register system, accounting software or an e-invoice format is also subject to the requirements for data access by the tax authorities, which means the data must not only be archived but also remain machine-readable for analysis.

What do you need to do in practice?

Setting up GoBD-compliant archiving follows a fixed sequence that must be established once and then maintained on an ongoing basis.

1. Identify all sources of receipts (paper, emailed invoices, online banking, cash register system, e-invoices).
2. Set up a digitisation and archiving system with unalterability (audit-proofing).
3. Prepare process documentation for each IT system in use (workflow, responsibilities, backup).
4. Define an access and deletion policy that respects the statutory retention periods.
5. Check the archiving process for completeness at regular intervals by sampling.

A tool such as Company Audit shows which of these obligations apply to your business in detail.

What does "audit-proof" mean in practice?

Audit-proof means that once a receipt has been archived, it cannot subsequently be altered or deleted unnoticed, and every change is logged in a traceable way.

A PDF lying loose on a company drive generally does not meet this requirement: files there can be moved, overwritten or deleted without it being possible to trace this later. A dedicated archive system with access control, versioning and a change log is therefore a safer choice than an ordinary folder on the company drive or in the cloud.

This does not necessarily require buying an expensive specialist solution: many accounting and document management (DMS) programs already include audit-proof storage, provided they are configured accordingly and not mistaken for an ordinary file folder. What ultimately matters is less the tool used than whether you can demonstrate, without gaps and after the fact, that a receipt has remained unchanged since the moment it was archived.

Why is process documentation so important?

The process documentation describes, for each IT system in use, in a comprehensible way how receipts are captured, processed, archived and backed up, and who in the company is responsible for this.

It is regularly requested during tax audits and should therefore not be prepared only when an audit is announced, but maintained from the start and updated whenever the archiving process changes.

What happens if you breach the GoBD?

If proper, audit-proof archiving is missing, or the process cannot be evidenced by process documentation, the tax authorities may classify the bookkeeping as not properly kept.

The consequence may be estimates of the tax base; in the extreme case, the entire bookkeeping may be rejected. Either can have a direct effect on the tax burden, regardless of whether the underlying business transactions were in fact recorded correctly.

Frequently asked questions

Is cloud storage such as Google Drive or Dropbox enough for archiving?

Ordinary cloud storage without version control and deletion protection generally does not meet the requirement of unalterability. What is needed is a system that technically prevents changes and deletions to archived receipts or logs them without gaps.

Do business emails also have to be archived?

Yes, where they are relevant for tax purposes, for example when an invoice is sent or received by email or when the email itself is a commercial or business letter. Such emails are subject to the same requirements as paper receipts.

Do the GoBD apply only to large companies?

No. The GoBD apply to all businesses and self-employed people with bookkeeping and record-keeping obligations, regardless of size, as soon as electronic receipts or IT-supported bookkeeping processes are used, which affects practically every business.

What is the difference between retention and archiving in the sense of the GoBD?

Retention generally refers to keeping documents available for the statutory period. Archiving in the sense of the GoBD specifically means unalterable, traceable and machine-readable storage, including documentation of the process behind it.

Who checks whether archiving is GoBD-compliant?

In the course of a tax audit, the tax authorities obtain access to the archived data and the process documentation and check whether completeness, unalterability and traceability are ensured.

Source: § 147 AO · GoBD (BMF). This article is general information and does not replace legal advice in an individual case. As of: July 2026.