Audit-proof archiving is not an optional IT requirement but a statutory obligation. The legal foundations are the German Commercial Code (HGB §§238, 239, 257), the German Fiscal Code (AO §§146, 147) and the (Principles for the Proper Management and Storage of Books, Records and Documents in Electronic Form). Merchants are required to store tax-relevant documents immutably for 6 or 10 years — invoices, accounting documents, commercial books, annual financial statements.

Audit-proof archiving is, however, more than immutability. An audit-proof archive meets ten cumulative criteria: proper retention of all mandatory documents, completeness without information loss, earliest possible archiving, assignment to the business transaction, technical immutability (), protection against loss, findability through systematic indexing, reproducibility in readable form throughout the entire retention period, traceability through complete access logs, and auditability through complete procedural documentation. All ten criteria must be met simultaneously — partial compliance is insufficient.

The most common errors in practice: file servers without technical immutability are operated as archives, software is used without the required organizational measures, procedural documentation is completely absent, retention periods are not systematically managed, or readability over the entire retention period is not ensured.

Frequently asked questions

The tax authority can reject the regularity of the accounts under §158 AO. The consequence is an estimated tax assessment — typically to the detriment of the taxpayer. Fines may also apply. In serious cases involving deliberate manipulation, criminal prosecution for tax evasion (§370 AO) is possible.
Procedural documentation (GoBD sections 151–155) describes the complete archiving process: which documents are captured, how they are processed (indexing, format conversion), where they are stored, how immutability is ensured, who is responsible. The GoBD requires that a qualified third party can trace the entire process in a reasonable time. Without procedural documentation, no archive is audit-proof — regardless of the technology used.
In principle yes — if the cloud service offers WORM functionality, the procedural documentation is complete and the organizational measures are documented and enforced. However, software WORM in the cloud can be circumvented by users with admin rights. Hardware WORM provides a more robust position, as no software can override immutability. GDPR compliance of the cloud provider must also be ensured.