Audit-proof bookkeeping: what the Swiss GeBüV actually requires — and why a backup isn't enough

«Our accounting is digital, and we have a backup.» That sentence is said in many Swiss SMEs — and it sounds reasonable. The problem: it has almost nothing to do with audit-proofness. A backup protects you against loss. The law, however, asks for something different: protection against unnoticed change.

That distinction decides what happens in an audit. Whoever doesn’t know it considers their archive safe — until the fiduciary or the tax authority asks a question that a folder full of PDFs cannot answer: How do we know that nothing in this data was modified after the fact?

Let’s look at what Swiss regulation actually requires — and how to tell whether your accounting holds up.

The most common misconception: a backup is not audit-proofness

A backup answers «Is the data still there?». Audit-proofness answers «Is the data still the same?». A file on Dropbox, SharePoint or a server can be opened, changed and saved again — and nothing signals that this happened. That is exactly the point: the criterion is not storage, but the provability of immutability.

What the law requires — properly placed

The basis is the Swiss Code of Obligations (OR/CO) and the Business Records Ordinance (GeBüV, SR 221.431). Four points are central for SMEs.

Retention: ten years

Business books, accounting vouchers and the business report must be retained for ten years (OR Art. 958f). Electronic retention is in principle permitted — but tied to conditions.

Bookkeeping: traceable and supported by evidence

The CO requires proper bookkeeping (OR Art. 957a): business transactions must be recorded completely, truthfully and systematically, supported by vouchers, clearly presented and verifiable. Verifiability is not a side clause here, it is the core.

Integrity: the real benchmark (GeBüV Art. 3)

The heart of the matter sits in Article 3 of the GeBüV under the heading «Integrity (authenticity and resistance to falsification)». The ordinance requires that books and vouchers be kept and stored in such a way that they cannot be changed without that change being detectable.

Read that sentence twice. It does not require data to be unchangeable. It requires every change to be detectable. That is a decisive, often misunderstood difference — and exactly the point that separates a good solution from one that only looks good.

Mutable media are allowed — under conditions (GeBüV Art. 9)

Many believe a database is unfit for retention because it is mutable. That is not true. GeBüV Art. 9 explicitly allows mutable information carriers — provided that technical procedures guarantee the integrity of the stored information (the law cites digital signature procedures as an example) and the moment of storage is verifiable in an unfalsifiable way (example: time stamps).

An important and welcome detail: the law is technology-neutral. It prescribes no particular technique. Digital signature and time stamp are examples, not duties. What matters is the outcome — integrity and a verifiable moment — not the path to it.

On top of that come the complementary duties of the GeBüV: the procedures must be documented (Art. 4), the records must be carefully kept (Art. 5) and they must remain available and readable for the entire retention period (Art. 6) — including after a change of software.

The five criteria of audit-proof software

When you evaluate a solution — existing or new — check these five points:

1. Integrity: is every subsequent change to a posting detectable? Or can an old entry be silently overwritten?
2. Verifiable moment: can it be shown when a transaction was stored?
3. Gap-free logging: are corrections and cancellations recorded, instead of data being simply replaced?
4. Availability over ten years: does the data remain readable, even when you change systems?
5. Documented procedure: is it described how integrity is ensured?

The first three points are the ones on which standard solutions most often fail.

Where ordinary archives reach their limits

Most «audit-proof» offerings on the market concern the archiving of already-filed documents — they make sure a PDF, once filed, is no longer changed. That is useful, but it covers only half of the truth.

Because the integrity question doesn’t arise only with the archived voucher, but with the living booking data itself: with every journal entry, every payment, every cancellation, every payroll run. The decisive question is not «Is my PDF unchanged?», but «Can someone adjust a three-year-old booking without anyone noticing?».

One way to solve this provably

hegyon.ai tackles this question at the root. Every booking-relevant event — posting, payment, credit note, payroll run, stocktake — is sealed in a cryptographic hash chain (SHA-256). Each entry carries the signature of the previous one; a subsequent change to a historical record breaks the chain at exactly that point. A verification button in the settings runs the chain and reports OK or BROKEN. In addition, every voucher PDF carries an audit-hash imprint in the footer, with which a printed voucher can be checked against the chain.

This delivers precisely what GeBüV Art. 3 demands at its core: a change can be detected. Technically, the hash chain is a procedure within the meaning of Art. 9 — one of the technology-neutral paths the law allows to guarantee integrity on mutable media.

An honest placement belongs with this: such a procedure provides the technical integrity proof — but it does not replace the remaining duties. The procedure documentation (Art. 4), the careful retention (Art. 5) and the lasting availability (Art. 6) remain the responsibility of your company and your organisation. Audit-proofness is always an interplay of technology and process. Anyone promising you «compliance at the push of a button» oversimplifies.

Conclusion

Audit-proofness is not a backup topic and not a question of storage size. It is a question of integrity: is every change detectable, and is the moment verifiable? The law deliberately leaves you room in implementation — but it requires a result that a folder full of PDFs does not deliver.

If you want to see what an integrity proof feels like on real bookings: in the hegyon.ai demo tenant, you can try the verify function yourself — changing a posting and watching the chain break says more than any explanation.

This article is for general orientation and does not constitute legal or tax advice. References to OR Art. 957a and 958f as well as GeBüV Art. 3, 4, 5, 6 and 9 (SR 221.431) reflect the state of June 2026 and are not exhaustive. The authoritative source is the official publication by the Federal Chancellery. For the concrete assessment of your retention, please consult your fiduciary or qualified advice.