The obligation to maintain process documentation really affects every tax‑liable company – from small craft businesses to international corporations. It makes no difference whether you operate as a sole trader, a GmbH or an AG. As part of a tax audit, the tax authorities expect complete and comprehensible procedural documentation in accordance with the GoBD – regardless of the size or legal form of the company. What process documentation is, which companies are required to prepare it and how to implement it successfully is explained in this article.
What does process documentation mean?
According to the Principles for the Proper Management and Retention of Books, Records and Documents in Electronic Form and for Data Access (GoBD), the following definition is provided for the term procedural documentation:
“The process documentation describes the organisationally and technically intended process, for example for electronic documents, from the creation of the information through indexing, processing and storage, unambiguous retrieval and machine readability, safeguarding against loss and manipulation, and reproduction.”
Who is required to prepare process documentation?
The GoBD applies to every company, regardless of whether it is a large corporation, a medium‑sized enterprise or a sole business. As soon as tax‑relevant processes are mapped using IT systems or tax‑relevant documents (e.g. receipts, contracts or payroll records) are stored electronically, comprehensive process documentation is mandatory.
The obligation to ensure the correctness and compliance of electronic books and other required electronic records lies solely with the taxpayer. This responsibility remains in place even if parts of, or all, tasks are outsourced to third parties, such as tax advisers or data centres.
3 reasons why process documentation is important
For the audit-proof archiving of tax-relevant documents, comprehensible and detailed process documentation in accordance with the GoBD is mandatory. Within a company, it fulfils several key functions:
- Compliance with data protection laws: Under the General Data Protection Regulation (GDPR), companies are required to implement appropriate technical and organisational measures to ensure the security of personal data. Detailed process documentation is a key component of these measures and helps to ensure compliance with numerous legal requirements.
- Transparency and traceability: A transparent, documented process environment makes it easier for companies to understand, monitor and optimise their workflows. In particular, during audits or data protection inspections, process documentation enables companies to demonstrate that they have taken all necessary measures to ensure the security of personal data.
- Risk management: By identifying and documenting risks in the context of data processing, companies can take targeted action to minimise or eliminate these risks. Process documentation allows potential weaknesses to be identified at an early stage and appropriate countermeasures to be implemented.
Implementing the mandatory process documentation: Here’s how!
If you take a closer look at the principles for the proper management and retention of books, records and documents in electronic form and for data access (GoBD) and examine the 184 marginal numbers in detail, the term process documentation appears no fewer than 27 times. This is reason enough to take a look at the most important requirements:
- Process documentation is required to ensure the verifiability of the books and other mandatory records.
- The controls carried out within the processes (the internal control system) must be described in the documentation.
- The documentation must show how electronic documents are, among other things, captured, received and retained.
- For an audit of traceability and verifiability, meaningful and up-to-date process documentation is required, which fully documents all system or process changes in terms of content and time without gaps.
- For each data processing system, a clearly structured process documentation must be available from which the content, structure, workflow and results of the processes can be fully and coherently understood.
- In addition, the process documentation must be comprehensible and therefore verifiable within a reasonable period of time by a knowledgeable third party, such as auditors or tax consultants.
Which 5 elements must process documentation contain?
1. A general description of the company
This section provides a high-level description of your company: How is it organised? Which processes are to be documented? Where is relevant data stored? And: are external service providers involved in these processes?
2. User documentation
This part contains all the information required to operate the IT systems in use correctly. Who is responsible for which tasks within the process? Are there work instructions, training courses or briefings? And who is responsible for system administration?
3. Technical system documentation
The technical documentation focuses on the IT infrastructure: Which systems are used? How is the IT environment structured? This section describes the technical basis of the bookkeeping-relevant processes.
4. Operating documentation
This section covers all regulations relating to IT operations and IT security – from emergency plans and backup strategies to security policies.
5. The internal control system (ICS)
The internal control system ensures quality and security within your processes. Here, you document how organisational measures and regular – ideally documented – controls are used to ensure that all processes are carried out correctly.
How to use references correctly – and what you must not forget
Within the documentation, it is also possible to refer to other existing documents, provided they are available. However, it must be ensured that both the process documentation and the referenced documents are kept up to date at all times. In addition, document versioning is required so that historical processes can also be reviewed.
The following GoBD principles must be addressed in the process documentation:
- Traceability and verifiability
- Truthfulness
- Clarity and continuous recording
- Completeness
- Individual record-keeping requirement
- Accuracy
- Timely postings and records
- Order and immutability
Digital processes without mandatory process documentation? A costly risk
Mandatory process documentation becomes a legal requirement for your company as soon as tax-relevant processes are handled using IT systems or tax-relevant documents are stored electronically. It is therefore essential for companies to ensure that they create correct mandatory process documentation and update it on a regular basis in order to meet the requirements of the digital world.
Project Guide | Successful Introduction of Digital Dossiers in 3 Phases
Frequently asked questions and answers about mandatory process documentation
Why is mandatory process documentation required?
Mandatory process documentation is a key element in complying with the GoBD (Principles for the Proper Management and Retention of Books, Records and Documents in Electronic Form and for Data Access). It enables the tax authorities to ensure the traceability and verifiability of bookkeeping. Without it, the proper maintenance of accounting records cannot be guaranteed.
Who is required to comply with mandatory process documentation?
The requirement for mandatory process documentation generally applies to all taxable companies – regardless of their size or legal form. As soon as tax-relevant processes are mapped digitally or documents are stored electronically, the GoBD applies, and with it the obligation to maintain mandatory process documentation.
What must mandatory process documentation contain in order to meet the requirement?
Complete mandatory process documentation includes, among other things, a general company description, user documentation, technical system documentation, operating documentation and an internal control system (ICS). These components must be clearly structured, up to date and version controlled.
What happens if mandatory process documentation is ignored?
If proper mandatory process documentation is missing, this can lead to estimated assessments or even tax disadvantages during a tax audit. Responsibility always lies with the taxable entity – even if processes are outsourced to third parties.