Audit-proof archiving: the GeBüV for SMEs

Audit-proof archiving is not a term used in the law: neither the Code of Obligations (CO, OR) nor the Ordinance on Accounting Records (GeBüV) uses the phrase. It means a filing system that meets the legal requirements for accounting records and vouchers. Documents must remain genuine and unaltered, stay legible and retrievable throughout the whole retention period, and the procedure must be described. This guide explains these requirements for an SME. It is a basis for your own operating procedure, but not a certificate of conformity for any particular software or filing system.

Which documents and which form are permitted

Under Art. 957a CO, para. 3, a voucher is any written record on paper or in electronic or comparable form that is needed to understand the business transaction or circumstance underlying a posting. Under Art. 958f CO, para. 1, accounting records, vouchers, the annual report and the audit report must be retained for ten years; the period starts at the end of the financial year. Under para. 2, the annual report and the audit report must be retained in writing and signed.

Under para. 3, accounting records and vouchers may be retained on paper, electronically or in a comparable way. Two conditions apply: correspondence with the underlying business transactions and circumstances must be ensured, and the documents must be capable of being made readable again at any time. The details are set out in the GeBüV on behalf of the Federal Council (para. 4). If you keep your books electronically, Art. 2 GeBüV, para. 2 additionally requires compliance with the principles of proper data processing.

The same applies to value added tax: for the transmission and retention of paperless vouchers, Art. 122 of the VAT Ordinance (MWSTV) refers to Art. 957–958f CO and the GeBüV. The Federal Tax Administration (FTA) states in VAT Info 16 (no. 1.4.1, as from 5 January 2024) that books and vouchers retained exclusively in electronic form have the same evidential value as those that can be read without aids, provided all the requirements of the GeBüV are met. For bookkeeping in general, see the guide Bookkeeping obligations for SMEs.

Genuine and unaltered: changes must be detectable

Art. 3 GeBüV requires accounting records and vouchers to be kept, recorded and retained so that they cannot be changed without the change being detectable. The ordinance therefore does not prohibit corrections; it requires that they remain visible. A corrected copy of an invoice must not silently overwrite the previous file. Record what is new, who changed it and when, and what the new version refers to.

A checksum (hash) shows whether the content of a file has changed since it was filed. It says nothing about whether the voucher was complete and correct when it was captured. A wrongly scanned voucher remains wrong with a valid checksum. Completeness, correctness of content and protection against unnoticed alteration therefore each need their own controls.

Alterable media: four conditions

Art. 9 GeBüV distinguishes two kinds of information carrier. Unalterable carriers include paper, image carriers and unalterable data carriers. Under para. 2, alterable data carriers are those on which information can be changed or deleted without this being detectable on the carrier itself; the ordinance names fixed and removable disks and solid-state memory, among others. The storage of an ordinary server using hard disks or SSDs therefore generally counts as an alterable carrier.

For alterable carriers, all four conditions under para. 1 let. b must be met:

• Technical procedures ensure the integrity of the stored information (the digital signature procedure is given as an example).
• The time of storage can be proved without falsification (the time stamp is given as an example).
• The further rules on the use of these technical procedures that apply at the time of storage are complied with.
• The workflows and procedures are defined and documented, and auxiliary information such as logs and log files is also retained.

The ordinance prescribes no file format and no product. What matters is whether the entire procedure meets the four conditions. A hash chain can support the first condition; it does not replace proof of the storage time. For each system, therefore, ask to be shown which of the four conditions is met by what, and which are not.

Documenting the procedure

Under Art. 4 GeBüV, para. 1, depending on the nature and scale of the business, the organisation, responsibilities, workflows, procedures and the infrastructure used (machines and programs) must be documented in work instructions so that the accounting records and vouchers can be understood. Describe the actual path from receipt through checking to retention and later inspection, including error cases: who checks an incomplete scan? Who assesses a reported discrepancy?

Under para. 2, work instructions must be updated and retained on the same principles and for as long as the books kept in accordance with them. Keep earlier versions, then: only this makes it possible to explain later how an older year was processed.

Organising the archive: access, log, availability

Art. 5–8 GeBüV lay down the organisation:

• Care (Art. 5): Books and vouchers must be retained carefully, in an orderly way and protected from harmful influences.
• Availability (Art. 6): An authorised person must be able to inspect and check them within a reasonable time until the end of the retention period; the personnel and aids needed for this must be kept available. On request, accounting records must also be made readable without aids.
• Organisation (Art. 7): Archived information must be kept separate from current information or labelled so that it can be told apart; responsibility must be regulated and documented.
• Archive (Art. 8): Information must be systematically inventoried and protected against unauthorised access. Accesses and entries must be recorded, and these records are subject to the same retention obligation as the data carriers.

A backup alone does not fulfil these tasks. Also decide how access logs are preserved and made understandable in an audit.

Checking and migrating data

Art. 10 GeBüV requires information carriers to be checked regularly for integrity and legibility. The ordinance does not say how often; set a fixed rhythm and record the results. In a data migration, that is transfer to another format or another carrier, completeness and accuracy must be preserved and availability and legibility must remain sufficient. The transfer must be logged, and the log must be retained together with the information. Test a system change with real document types from your business before you switch off the old system.

Practical example: correcting a scanning error traceably

The fictional manufacturer Auenwerk AG closes its financial year on 31 December. In October 2026 it scans a batch of 24 supplier invoices and files them. In the batch, 20 invoices have one page and 4 invoices have two pages, so 20 + 4 × 2 = 28 pages are expected. The archive contains 24 files, which matches the 24 invoices. But the monthly comparison with the batch list shows that the archived files comprise only 27 pages: the back page of one two-page invoice is missing. The same number of files and invoices does not prove complete capture.

The responsible person rescans the complete invoice, checks the page count and order, and files it as a new version referring to the earlier one. They record the reason for the correction. The first version remains and is not overwritten (Art. 3 GeBüV). Both versions are part of the voucher evidence: financial year 2026 ends on 31 December 2026, and the period under Art. 958f CO, para. 1 runs for ten years, that is until 31 December 2036.

The case shows two separate controls: completeness is checked against the paper batch, and later integrity against the archived state. An integrity check would not have added the missing page. For how to digitise and file incoming invoices, see the guide Digitising incoming invoices.

Checklist for your archiving procedure

• Document types, authoritative versions and retention periods are determined.
• Receipt and completeness are checked traceably (page count, back pages).
• Changes remain detectable; corrections are explainable and recorded with a reason (Art. 3).
• For each system it is clear how the four conditions for alterable carriers are met, in particular proof of the storage time (Art. 9).
• Work instructions describe the procedure as actually practised and are retained together with earlier versions (Art. 4).
• Accesses are recorded, and the records are subject to the same retention obligation (Art. 8).
• Integrity and legibility are checked regularly, and the results are recorded (Art. 10).
• Migrations are checked for completeness and logged (Art. 10).
• The annual report and the audit report are available in writing and signed (Art. 958f CO, para. 2).

Sources

• Code of Obligations (OR, SR 220), Art. 957a, para. 3 and Art. 958f, paras. 1–4, as at 1 October 2026: fedlex.admin.ch (German original), accessed on 27.10.2026.
• Ordinance on Accounting Records (GeBüV, SR 221.431), Art. 2–10, as at 1 January 2013: fedlex.admin.ch (German original), accessed on 27.10.2026.
• VAT Ordinance (MWSTV, SR 641.201), Art. 122, as at 1 January 2025: fedlex.admin.ch (German original), accessed on 27.10.2026.
• FTA: VAT Info 16 Accounting and invoicing, no. 1.4.1 Form of retention (in German), as from 5 January 2024, accessed on 27.10.2026.

This guide does not replace legal or tax advice. Information as at 27.10.2026.