The GoBD are no mystery, they are a clear catalogue of requirements. Anyone who reads them as a mandatory checklist and works through every requirement in their own DMS builds an archive that holds up in an audit.
What the GoBD actually are
The German principles for the proper keeping and retention of books in electronic form (GoBD) are an administrative directive of the Federal Ministry of Finance. Important: "GoBD-compliant" is not something a vendor can claim about itself, it is the outcome of a Betriebsprüfung (German tax audit). That is why we say aligned with GoBD: implemented technically so that the requirements can be met.
The ten requirements in detail
1. Non-alterability
Once a document has been posted, it must not be possible to change it without leaving a trace. Practical lever: versioning with an unalterable audit trail. Every change becomes a new version, never a hard overwrite.
2. Completeness
The invoice register has to contain every document received, cancelled ones included. Practical lever: gap-free capture at intake across all channels, each with an arrival stamp.
3. Traceability
Every journal entry must be traceable without gaps, from the document through to the report. Practical lever: bidirectional links between document and posting in the ERP, plus an audit trail per document.
4. Orderly filing
Documents have to be filed in a system of order that an outsider can follow. Practical lever: clear case file structures per document type, consistent metadata upkeep.
5. Timeliness
Documents must be captured promptly. For non-cash transactions, capture within ten days is regarded as unobjectionable (GoBD margin no. 47); cash transactions daily. Practical lever: an intake workflow with reminder mechanics.
6. Retention periods
Books and annual financial statements: 10 years. Accounting vouchers and invoices: eight years since 2025 (§ 147 AO, § 14b UStG). Business correspondence: 6 years. Practical lever: retention periods maintained per document class in the DMS, with a deletion block until the period expires.
7. Access protection
Only authorised people may read or change a record. Practical lever: a role matrix, the four-eyes principle, an audit trail of read and change actions.
8. Verfahrensdokumentation
A Verfahrensdokumentation describes how your processes meet the other requirements. In a Betriebsprüfung it is often the first thing asked for. Practical lever: keep it as a living document and review it actively once a year.
9. Migration
When you change DMS, the data has to be migrated in a way that stays aligned with GoBD. Practical lever: document the migration plan, validate the results before the old system is switched off.
10. Deletion policy
The GDPR says: keeping too much is forbidden as well. Practical lever: an automated deletion routine with an audit entry once the retention period has expired.
Three typical mistakes
Mistake 1: "We have a DMS, so we are GoBD-compliant." A DMS is only the tool. What is aligned with GoBD is the process that uses the tool properly.
Mistake 2: treating the Verfahrensdokumentation as a one-off project. It has to live and be updated with every process change.
Mistake 3: ignoring deletion obligations. Art. 17 GDPR requires erasure. A defined deletion policy is mandatory.
The practical checklist
- A Verfahrensdokumentation exists and is up to date (rule of thumb: updated annually)
- Incoming invoices are recorded in the invoice register without gaps
- Retention periods are defined per document type (6, 8 or 10 years)
- A deletion policy exists and is applied
- The audit trail records all read and change events
- Roles and permissions are documented and reviewed quarterly
FAQ
What is the difference between GoBD-compliant and aligned with GoBD? "GoBD-compliant" is a statement that can only be verified after a Betriebsprüfung. Reputable vendors say "aligned with GoBD".
How long do I have to keep documents? Invoices and accounting vouchers: eight years since 2025 (§ 147 AO, § 14b UStG). Books and annual financial statements: 10 years. Business correspondence: 6 years. The period starts at the end of the calendar year.
Do I need my own Verfahrensdokumentation? Yes, as soon as documents are processed electronically.
Conclusion
GoBD is no black art, but it is not done on the side either. The biggest lever, in our experience, sits with the invoice register, the Verfahrensdokumentation and the deletion policy. As at September 2026
This article provides general information on legal requirements and is no substitute for legal or tax advice in an individual case.
Further reading
Ready for your next Betriebsprüfung?
The GoBD audit checklist sums up twelve checkpoints for a self-audit, in plain language.