67 lines
2.8 KiB
Markdown
67 lines
2.8 KiB
Markdown
|
---
|
|||
|
|
id: RISK-POL-0009
|
|||
|
|
type: legal-policy
|
|||
|
|
title: "Commercial and tax retention"
|
|||
|
|
regime: "HGB §257, AO §147"
|
|||
|
|
status: active
|
|||
|
|
activates_when: "the estate keeps commercial books or issues and receives invoices — already true"
|
|||
|
|
owner: risk-nexus
|
|||
|
|
written: "2026-08-20"
|
|||
|
|
cadence: instant
|
|||
|
|
clean_streak: 0
|
|||
|
|
last_checked: "2026-08-20T21:30:00Z"
|
|||
|
|
next_check: "2026-08-20T21:30:00Z"
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
# RISK-POL-0009 — commercial and tax retention
|
|||
|
|
|
|||
|
|
**Active now.** This is the one policy in the set that does not wait for a
|
|||
|
|
context: the estate already invoices, holds bank records and keeps books.
|
|||
|
|
|
|||
|
|
## What the sources require
|
|||
|
|
|
|||
|
|
| Class | Period | Source |
|
|||
|
|
| --- | --- | --- |
|
|||
|
|
| Books, inventories, opening balance sheets, annual accounts, management reports | 10 years | §257(1) no. 1, (4) HGB; §147(1) no. 1, (3) AO |
|
|||
|
|
| Accounting vouchers (*Buchungsbelege*) | **8 years** | §147(3) AO, shortened from ten by the Fourth Bureaucracy Relief Act with effect from 2025 |
|
|||
|
|
| Commercial and business letters received and sent | 6 years | §257(2), (4) HGB; §147(1) nos. 2–3 AO |
|
|||
|
|
|
|||
|
|
Periods run from the **end of the calendar year** in which the last entry was
|
|||
|
|
made or the document created — not from the document's own date. That detail
|
|||
|
|
is the one most often got wrong, and it always extends the period rather than
|
|||
|
|
shortening it.
|
|||
|
|
|
|||
|
|
**The eight-year figure is recent and this repo has not verified it against the
|
|||
|
|
current text.** Confirm before relying on it for a deletion decision; ten years
|
|||
|
|
is the safe reading if nobody has.
|
|||
|
|
|
|||
|
|
## What it requires of systems
|
|||
|
|
|
|||
|
|
- Records in these classes must be **retrievable for the whole period**, not
|
|||
|
|
merely undeleted. A backup nobody can restore from does not satisfy a
|
|||
|
|
retention duty — the same standard `RISK-F-0006` applies to `apps-pg`.
|
|||
|
|
- Immutability of content: they must not be silently rewritable.
|
|||
|
|
- Deletion must be **possible and deliberate** at the end of the period.
|
|||
|
|
Retention duty is a floor, not a licence; `RISK-POL-0002` supplies the
|
|||
|
|
ceiling.
|
|||
|
|
|
|||
|
|
## Where it collides
|
|||
|
|
|
|||
|
|
With erasure (`RISK-POL-0002`, `RISK-F-0008`). An erasure request touching a
|
|||
|
|
record inside a statutory retention period does not defeat the duty — Art
|
|||
|
|
17(3)(b) GDPR covers exactly this. But **the exemption is per record, not per
|
|||
|
|
system**: it covers the invoice, not the entire event log the invoice passed
|
|||
|
|
through.
|
|||
|
|
|
|||
|
|
That distinction is where "we keep audit because it is audit" fails, and it is
|
|||
|
|
why `RISK-REG-0001` states periods per category rather than one figure.
|
|||
|
|
|
|||
|
|
## Evidence that would show this is met
|
|||
|
|
|
|||
|
|
A retention schedule per record class; a demonstrated restore from the oldest
|
|||
|
|
retained period; a deletion routine that actually runs at expiry.
|
|||
|
|
|
|||
|
|
None of those exist yet. This policy is `active` in the sense that the duty
|
|||
|
|
applies, not in the sense that it is demonstrably satisfied — and the register
|
|||
|
|
says which.
|