Outsourcing bookkeeping: risks for GmbH managing directors

Many companies outsource bookkeeping to specialised accounting firms, tax advisers, group service centres or affiliated companies. Cloud systems and foreign servers may also be used for electronic accounting data.

For managing directors of a German GmbH, the key question is:

Does management remain responsible if the actual bookkeeping work is carried out by employees, group companies or external providers?

The answer is yes. Managing directors do not have to perform every bookkeeping task personally. They may delegate. The legal responsibility for proper bookkeeping and appropriate controls remains with management.

Key points

• The GmbH must maintain proper books and records.
• Bookkeeping may be delegated internally or outsourced.
• Delegation does not eliminate overall or residual management responsibility.
• The competence, reliability and organisational suitability of the person or provider must be assessed.
• Bookkeeping must be monitored appropriately.
• Management must retain access to the records and be able to intervene.
• An outsourcing agreement should regulate services, deadlines, reports, access, security and correction rights.
• Moving electronic bookkeeping abroad may require special tax-law conditions and approval.
• Errors may lead to civil, tax, regulatory and criminal consequences.

1. What does proper bookkeeping mean?

Proper bookkeeping requires the company to maintain the books and records required by law and by the German Principles of Proper Bookkeeping (GoB).

The relevant rules are found in particular in the German Commercial Code, the German Fiscal Code and the principles developed in commercial practice and accounting law.

Records should be complete, accurate, timely, organised and understandable. A knowledgeable third party should be able to obtain an overview of the company’s transactions and financial position within a reasonable time.

The requirements include both formal bookkeeping and accounting techniques and substantive principles concerning recognition, measurement, classification and presentation.

2. Delegation within management

Section 41 GmbHG requires managing directors to ensure proper bookkeeping. It does not require every managing director to carry out all bookkeeping personally.

In a multi-director management board, responsibility may be allocated to one managing director, such as a CFO. This is generally permissible and often practically necessary in larger companies.

However, the other managing directors retain overall and residual responsibility. They should:

• assess the competence and reliability of the responsible director,
• establish appropriate supervision,
• maintain an overview of the company’s financial position,
• create reporting and escalation routes,
• intervene when warning signs appear, and
• retain access to the bookkeeping records.

The scope of supervision depends on the company’s size, business, complexity and risk profile.

3. Delegation to employees

Bookkeeping may be delegated to suitable employees. Management should select the employee carefully and supervise the work through a proportionate, risk-based control system.

Possible controls include written procedures, four-eyes approval, reconciliations, plausibility checks, access restrictions, periodic reports, sample testing and documented correction procedures.

The company does not need to eliminate every possible error, but it should be able to identify and correct material errors in a timely way.

4. Outsourcing to service providers or group companies

Bookkeeping may be outsourced to accounting firms, tax advisers, specialised providers, shared-service centres or affiliated companies.

Selection and instruction

Management should assess the provider’s qualifications, staffing, experience, systems, security, continuity arrangements, availability and ability to meet deadlines.

Replacing the employment instruction right

Management does not have the same direct employment instruction right over an external provider as it has over an employee. The outsourcing agreement should therefore provide clear contractual rights to:

• access the records and work product at any time,
• request corrections,
• set deadlines,
• receive reports,
• intervene in case of errors or delay,
• obtain the data promptly, and
• impose contractual consequences for breaches.

Data security and access

The company should ensure that electronic records are preserved, access rights are controlled, activities are logged, backups exist, recovery procedures are available, data transfers are protected and the German tax authorities can obtain the required access.

Intra-group outsourcing

The same organisational and supervisory requirements apply where the bookkeeping is transferred to a group company. In addition, the terms should generally comply with the arm’s-length principle.

5. Moving electronic bookkeeping abroad

Cross-border relocation of accounting records is particularly sensitive. Under the legal position in 2017, books and required records of a German company generally had to be maintained and retained in Germany.

An exception could apply to electronic books and records if the statutory requirements were met and the competent tax office approved the arrangement. A distinction applied between electronic records and paper bookkeeping and paper invoices, which were required to remain in Germany under the position at the time.

Application and conditions

The application to the German tax office was expected to describe the records to be moved, the procedure, the foreign data-processing location and the name and address of any external provider. Changes had to be reported promptly.

The company also had to have complied with its cooperation, bookkeeping, record-production and information duties. Access for a digital tax audit had to remain unrestricted and taxation could not be impaired.

Withdrawal and relocation back to Germany

If the tax office discovered that taxation was impaired, approval could be withdrawn and the company could be required to move the electronic bookkeeping back to a German server. Failure to comply or unauthorised relocation could trigger further tax consequences and a delay penalty under the legal framework in 2017.

The current statutory requirements and administrative practice must be checked before implementing a cross-border or cloud-based structure.

6. Consequences of bookkeeping breaches

Civil liability

Managing directors who culpably breach their bookkeeping duties may be liable to the company for resulting damage, including losses, incorrect tax payments, surcharges, delay penalties, costs of correcting accounts and financing or insolvency-related disadvantages.

A director responsible for the finance function may seek to show that the responsible person was carefully selected and supervised and that there were no warning signs. Other managing directors may be liable where they culpably breached their own organisational or supervisory duties.

Criminal risks

In an insolvency context, breaches may constitute offences relating to bankruptcy or violation of bookkeeping duties. Incorrect presentation or concealment of the company’s position and the falsification or concealed alteration of commercial books may also be criminally relevant.

Tax liability and sanctions

Bookkeeping also has tax significance. Depending on the facts, personal tax liability, tax-related regulatory offences, negligent tax reduction or tax evasion may arise under the relevant provisions.

7. What should the control system achieve?

Management should establish information, control, intervention and sanction mechanisms appropriate to the company’s size and complexity.

Information: regular reports, deviation reporting, open-item reports, deadline monitoring and escalation procedures.

Control: four-eyes principle, approvals, reconciliations, plausibility checks, samples, bank and ledger reconciliation and review of the completeness of supporting documents.

Intervention: immediate access, correction rights, emergency access, retraining or replacement of the provider and the ability to bring the function back in-house.

Sanctions: cure obligations, service levels, contractual penalties for defined breaches, damages, termination rights and transition support.

The selection, instruction, supervision and corrective action should be documented.

8. Minimum content of an outsourcing agreement

An outsourcing agreement should address:

• the services transferred,
• division of responsibilities,
• delivery of supporting documents,
• monthly, quarterly and annual deadlines,
• reports and deviation notices,
• access and audit rights,
• data location and subcontractors,
• backups and recovery,
• encryption and security,
• handover and retention,
• correction and intervention rights,
• liability and contractual penalties,
• tax-authority access,
• cross-border processing and approval requirements.

9. Practical checklist for managing directors

Before outsourcing:

• assess the provider’s qualifications and systems;
• define responsibilities and deadlines;
• identify the location of storage and processing;
• establish emergency and replacement arrangements;
• sign a sufficiently detailed agreement.

During outsourcing:

• receive and review regular reports;
• reconcile bank, receivables, payables and general ledger data;
• monitor tax and accounting deadlines;
• maintain access and intervention rights;
• document errors and corrections;
• monitor security and continuity.

For cloud or foreign arrangements:

• identify the locations of servers and backups;
• determine whether tax-office approval is required;
• ensure access for a digital tax audit;
• keep paper originals available in Germany where required;
• prepare a relocation-back and provider-change plan.

If problems arise:

• activate the escalation route;
• secure immediate access to records;
• correct or recover data;
• require remediation or replace the provider;
• assess tax, civil and criminal risks.

Legal notice

This article provides general information based on the law and practice as at 15 November 2017. It is not a substitute for a current review of the applicable commercial, tax, data-protection and technical requirements. Cloud services, cross-border processing, electronic archiving and external providers require a current assessment before implementation.