GoBD: What It Is and Its Implications

GoBD applies to all data related to taxes. These include, among others:

• Books and records, inventories, financial statements, management reports, balance sheets, and working instructions necessary to understand them, as well as other organizational documents,
• Incoming commercial or business letters,
• Copies of outgoing commercial or business letters,
• Accounting records, and
• Other documents of financial importance.

Additionally, all correspondence related to the preparation, execution, completion, or cancellation of a transaction, such as invoices, orders, complaint letters, payment receipts, and contracts, can be added. All this data must be archived in accordance with the law, even if sent via email. Email attachments should also be archived if the emails without them would be incomprehensible or incomplete.

How Did GoBD Emerge?

GoBD was introduced by the German Ministry of Finance through a letter dated November 14, 2014. The letter outlines the requirements of financial authorities regarding computer-based accounting systems. The principles came into effect on January 1, 2015, replacing the GDPdU ("Data Access and Auditability Principles for Digital Documents") and GoBS ("General Acceptance Principles for Computer-Based Accounting Systems"). They were recently updated here and became effective on January 1, 2020.

What Is GoBD?

As mentioned at the beginning of this article, GoBD is often given a legal status. However, a typical feature of legislation is its generalized nature: it is designed to cover a wide range of cases and individuals with abstract expressions.

There is a distinction made between:

• Formal legislation, understood as any decision enacted by the parliament as part of the legislative procedure
• Material legislation, which includes any legal norm regulating legal relations between citizens, between citizens and public authorities, or between public authorities (the legal relations between a state and its citizens).

In addition to legislation, there are decisions taken according to circumstances, primarily administrative rules. According to Article 108(7) of the Basic Law (Constitution of the Federal Republic of Germany), such administrative rules can be issued by the Federal Government with approval of the Federal Council, provided that they are managed by the state's revenue authorities or local governments. General administrative rules aim to ensure consistent application of the law by authorized officials, although they are directed primarily at these officials rather than citizens.

GoBD is such an administrative rule. The administrative notice by the German Ministry of Finance dated November 14, 2014, explains the norms of the German Tax Code (AO) and Value Added Tax Act (UStG), and explains how digital documents should be stored to ensure they are easily accessible in case of an audit by the tax office.

Therefore, simply put, GoBD can be considered as operational procedures for tax authorities. For a company, this means that the likelihood of a tax office not accepting its books and records is low, provided it complies with GoBD regulations. Failure to comply with GoBD does not necessarily mean that any law has been violated - but it could soon bring a tax inspector to the door.

What Does This Mean in Terms of Audit Compliance?

The term audit compliance often comes up in discussions involving GoBD and digital archiving solutions such as MailStore Server. In simple terms, a technical solution (software product) should be designed to meet the requirements of a tax audit. In such situations, certain features of the solution suddenly become highly relevant, for example:

• The immutability and completeness of the documents in question
• Protection against tampering
• Transparent storage guidelines
• Logging capability
• Export options to standard formats
• Access options for external auditors

Even for a non-expert, it quickly becomes clear that a backup is not sufficient.

The expression "legally compliant" is subject to debate. Although the two terms are often used interchangeably, especially when discussing "legal compliance," the focus can be slightly broadened and expanded. The proper processing of personal data has become a fundamental requirement for such a system since the introduction of GDPR, although it was not much different under the German Federal Data Protection Act (BDSG). Data protection is essentially a process issue, but it still requires a number of functional IT system requirements.

Source: Germany: Is GoBD legislation? - Post Office Store (mailstore.com)