---
title: Audit-Proof Archiving
date: 2026-06-01T17:19:00+02:00
author: Hannes Heckel
canonical_url: "https://www.fast-lta.de/en/glossary/audit-proof-archiving"
section: Glossar
---
Audit-proof archiving is not an optional IT requirement but a statutory obligation. The legal foundations are the German Commercial Code (HGB §§238, 239, 257), the German Fiscal Code (AO §§146, 147) and the GoBD (Principles for the Proper Management and Storage of Books, Records and Documents in Electronic Form). Merchants are required to store tax-relevant documents immutably for 6 or 10 years — invoices, accounting documents, commercial books, annual financial statements.

Audit-proof archiving is, however, more than immutability. An audit-proof archive meets ten cumulative criteria: proper retention of all mandatory documents, completeness without information loss, earliest possible archiving, assignment to the business transaction, technical immutability (WORM), protection against loss, findability through systematic indexing, reproducibility in readable form throughout the entire retention period, traceability through complete access logs, and auditability through complete procedural documentation. All ten criteria must be met simultaneously — partial compliance is insufficient.

The most common errors in practice: file servers without technical immutability are operated as archives, software WORM is used without the required organizational measures, procedural documentation is completely absent, retention periods are not systematically managed, or readability over the entire retention period is not ensured.

### GoBD

The GoBD (Principles for the Proper Management and Storage of Books, Records and Documents in Electronic Form as well as Data Access) is a German Federal Ministry of Finance letter that specifies how tax-relevant documents must be archived electronically in Germany — particularly regarding immutability, completeness and auditability.

[Mehr erfahren →](https://www.fast-lta.de/en/glossary/gobd)

### WORM

WORM (Write Once, Read Many) refers to a storage principle in which data is written once and can technically no longer be altered or deleted — in hardware WORM, this immutability is a physical property of the storage controller, independent of software, operating system or user privileges.

[Mehr erfahren →](https://www.fast-lta.de/en/glossary/worm)

### WORM

WORM (Write Once, Read Many) refers to a storage principle in which data is written once and can technically no longer be altered or deleted — in hardware WORM, this immutability is a physical property of the storage controller, independent of software, operating system or user privileges.

[Mehr erfahren →](https://www.fast-lta.de/en/glossary/worm)

 

## Frequently asked questions

 #### What happens if my archive is not audit-proof?

The tax authority can reject the regularity of the accounts under §158 AO. The consequence is an estimated tax assessment — typically to the detriment of the taxpayer. Fines may also apply. In serious cases involving deliberate manipulation, criminal prosecution for tax evasion (§370 AO) is possible.

#### What is procedural documentation under GoBD?

Procedural documentation (GoBD sections 151–155) describes the complete archiving process: which documents are captured, how they are processed (indexing, format conversion), where they are stored, how immutability is ensured, who is responsible. The GoBD requires that a qualified third party can trace the entire process in a reasonable time. Without procedural documentation, no archive is audit-proof — regardless of the technology used.

#### Does a cloud archive suffice for audit-proof archiving?

In principle yes — if the cloud service offers WORM functionality, the procedural documentation is complete and the organizational measures are documented and enforced. However, software WORM in the cloud can be circumvented by users with admin rights. Hardware WORM provides a more robust position, as no software can override immutability. GDPR compliance of the cloud provider must also be ensured.