Bookkeeping Document Retention: How Long, Where, and What Counts as a Faithful Copy

The Israeli bookkeeping instructions define that a computerised accounting system is retained on computerised storage media, and also set a periodic backup requirement and a storage location the taxpayer has notified in writing to the assessing officer. The definition of "computerised accounting system" is broader than the data alone.

This is a technical description of archive structure, not tax, legal or accounting advice. Retention periods and binding conditions are those in the current official text, which should be confirmed there and with your accountant.

What is actually retained, beyond the files

The common design error is to treat only the data. In the Tax Authority's document on bookkeeping in a computerised environment, the definition is broken into three components: software, meaning the command set and the database created by using it; auxiliary tables, such as salary withholding tables and a foreign exchange rate table; and computerised storage media.

The design consequence: an archive holding only an export of business tables is not retaining everything the definition enumerates. The exchange rate table in force on the date of a document is part of the story, because without it you cannot reconstruct how the amount printed on it was arrived at.

• The business data itself, in a format readable without the original system.
• The auxiliary tables as they stood in that period, not as they stand today.
• The identity and edition of the software that produced the records.
• The storage medium the material sits on, because it is part of the definition.
• The files that were actually produced and handed over, exactly as handed over.

What the instruction says about backup and where it is kept

The Tax Authority document quotes instruction 25(f), under which in the first week of each quarter of the tax year a computerised backup is taken of the computerised documents and of the computerised accounting system, excluding the software that manages the accounting system. That backup, per the same wording, is kept in a place the taxpayer notified in writing to the assessing officer, different from the place where the taxpayer's computerised accounting system is held.

The explanatory text in that document notes that the duty is to perform ongoing backups, and that since software cannot back itself up, the ongoing backup covers only the data managed through it - without removing the need to retain the software by computerised means. It also notes that performing the backup is not the job of the accounting software.

What makes a copy readable six years from now?

That question decides whether the archive is worth anything, and it is an engineering question rather than a regulatory one. A file saved in the proprietary format of software nobody licenses any more is a file that cannot be opened, however carefully it was backed up.

• An open, readable format, not an export that requires the system that produced it.
• Documented character encoding, because Hebrew in a legacy encoding is a common cause of an unreadable file.
• A checksum per file, so a silent change over time is detectable.
• The field mapping stored alongside the data, so somebody can tell what each column holds.
• A periodic restore test, because a backup nobody has restored is an assumption rather than an asset.

Older systems add real difficulty here. If the data sits in an aging Access file, readability years from now depends on being able to open the file at all. That is covered in safely recovering an Access database that will not open.

A scanned document versus one born digital

The instructions distinguish documentation created by computerised means in the first place from external documentation that was scanned. An appendix to the instructions deals with document scanning and a digital archive and sets conditions for marking and certifying a scanned document. These are two different routes, and a system that mixes them produces an archive nobody can explain.

• A document born digital is retained in its original form, not as a printout scanned back in.
• A paper document that was scanned follows a separate route with its own requirements.
• Every item in the archive needs a field saying which route it arrived through.
• Two copies of the same document on two routes is a data fault, not a backup.

The exact conditions for each route are in the text of the instructions, not in a summary. Whether a given route suits your business is a question for your accountant.

Who is responsible for the backup when nobody was named?

The Tax Authority document states explicitly that performing the backup is not the job of the accounting software. That is a short line with a large operational consequence: buying software did not buy a backup, and assuming the vendor handles it is the assumption that breaks on the day a restore is needed.

In a small business that turns into four questions that need a person's name as the answer:

• Who actually runs the backup, and what happens when they are away.
• Who checks that it finished, not only that it started.
• Who is responsible for the second storage location and access to it.
• Who confirms, at least annually, that a restore genuinely works.

The common answer to all four is "the system", and that is not an answer. A dashboard row with no human owner is a row nobody checks until it is late.

What the retention clock looks like in a database

A retention period is not a single date column. It is a calculation starting from an event, and it differs by document type. The practical implementation holds the starting event and the rule, not a deletion date somebody typed in.

• The starting event: end of the tax year, the filing date, or another event depending on the item type.
• The rule the period derives from, with a reference to the wording it came from.
• A computed date, explicitly flagged as computed rather than entered.
• A status: active, eligible for destruction, frozen because of a request or proceeding.
• Who approved a destruction, when, and exactly what was deleted.

Deletion is part of the system rather than its absence. An archive that cannot delete accumulates personal data beyond need, which is an entirely separate problem described in mapping personal data in a small business.

Sources

• Bookkeeping in a computerised environment, Computerised Audit Department, Israel Tax Authority
• Israel Tax Authority - official site