Practice

Audit-ready: closing your archive for year-end

20 March 2026 · 7 min read · DeSnipperaar

Every year the moment comes when the accountant rings the doorbell. Cabinet open, cabinet shut, where is the purchase ledger of the previous financial year, and why is there still a box from 2014 behind the rack? A well-organised archive makes year-end faster, cheaper and less stressful. A poorly organised archive costs you hours of search time and saddles you with consultation work with the accountant that you could have filled differently. This article gives a rhythm and checklist to close your archive audit-proof every year.

Target audience: administrators, office managers, SME entrepreneurs and controllers.

Why an annual ritual?

Without a fixed moment, your archive grows without bound. Paper boxes pile up, HDDs stay in cabinets, USB sticks disappear under desks. The GDPR (art. 5) requires storage limitation. The tax law (AWR art. 52) requires that relevant documents stay available. An annual rhythm reconciles both. You always know which material is still legally needed and which can go.

An archive without an annual destruction moment becomes a system without control. You retain too long, you do not know what is there, and you run GDPR risk.

The annual cycle in five phases

Phase 1: inventory (January)

After year-end you walk through the archive. What is there? Per box label you note the financial year, type of content and retention period. No labels? Start now. A box without a label is a box you cannot clear out.

Useful categories during inventory:

• Tax (7 years, AWR art. 52)
• Payroll administration (5 years after end of employment)
• Contracts (7 years after termination, sometimes longer)
• Client correspondence (2 to 3 years)
• HR files (see retention periods cheatsheet)
• Wwft documents (5 years, see Wwft 5 years)
• Technical documentation (per own policy)

Phase 2: retention check (January/February)

Per box you determine whether the retention period has expired. Two columns on a list: "can go" and "stays". Have a second pair of eyes sign off the list, preferably someone with decision authority (financial manager, DPO).

Phase 3: bookkeeping year-end (February/March)

Your accountant closes the previous financial year. The newest year now goes into the archive. Only when the annual accounts are final can you assume that no-one needs to go back to a document from that year. After this you can definitively destroy the oldest set (financial year X-8 now X-1 + 7).

Phase 4: destruction moment (March/April)

Plan a mobile destruction round. Gather the "can go" boxes, the operator shows you, the shredder runs, the certificate comes out. See mobile versus offsite shredding.

Phase 5: administration and labels (April)

Store the certificate in the GDPR file. Update the retention register. Vacated archive places are reserved for the next financial year.

Checklist for the accountant's audit

The accountant looks not only at numbers but also at your administrative process. Make sure you have ready:

1. General ledger, balance sheet, profit-and-loss for the past year
2. Debtor and creditor cards
3. Bank statements and cash documents
4. Wage tax returns and payroll statements
5. Contracts of new relationships
6. Inventory count records
7. Certificates of destruction (evidence that old financial years are gone)
8. Updated records of processing
9. Any data breach notifications from the past year

A complete folder saves hours of consultation time at the audit.

ISO audit and NEN 7510

If your organisation holds ISO 27001 or NEN 7510 (healthcare), archive management is part of the annual audit. The auditor looks at:

• Are retention periods set in procedures?
• Are they enforced?
• Is destruction documented?
• Is there a processor agreement with the destruction party?
• Are media disposed of in a controlled way?

At an NEN 7510 audit for healthcare institutions, destroying medical data is an explicit item. See WGBO 20 years.

The pre-audit weekend

In the week before the audit many organisations do a clean-up round. What often happens: the cabinet is emptied, found boxes are immediately shredded in an office shredder. Wrong. Reason: no certificate, no documentation, no audit trail.

Better: plan the destruction professionally with a certificate, ideally at least a month before the audit. Then at the audit you can show: "On 15 February we destroyed financial year 2018, certificate X, in line with DIN 66399 P-5."

Digital side

The audit often also checks digital archive practice:

• Backup tapes older than the retention period: gone. See clearing out LTO tapes.
• Phased-out laptops in the cupboard: destroy. See HDD wipe vs destroy.
• Old USB sticks: destroy. See disposing of USB and SD.

Each of these clean-up actions can run in the same mobile shredder round as paper, provided you pick a service that does both.

What to do if you have fallen behind?

Have you skipped years and is there a huge backlog? No panic. The approach:

1. Roughly inventory what is there. Not per document, per box is enough.
2. Mark all boxes older than 8 years as "to assess".
3. Plan a one-off large clean-up round with a mobile shredder.
4. After the clean-up: introduce the annual rhythm.

No shame about a one-off big action. Better now than putting it off any longer.

Collaboration with accountant and DPO

Plan an annual meeting: accountant, DPO, administrator. Discuss:

• Which periods changed in legislation?
• Which new processing activities are there?
• How is the records-of-processing register running?
• Which files will expire in the next 12 months?
• When do we plan the next destruction round?

An hour of annual meeting saves dozens of hours of follow-up.

---

Set up an annual rhythm? Call us or request a quote via desnipperaar.nl. We schedule fixed destruction moments, including a reminder system.