Ask a finance director how their business assures the authenticity and integrity of its invoices and you will usually get one of two answers. The confident answer names a technology. The honest answer is a pause, followed by something like "well, we match everything to a purchase order".
The honest answer is the right one. It is also, as stated, worth nothing in an audit, and the distance between those two facts is what this piece is about.
What the directive actually permits
The VAT Directive requires authenticity of origin, integrity of content and legibility to be assured, and expressly says that this may be achieved by any business controls which create a reliable audit trail between an invoice and a supply of goods or services.
Read that carefully, because two words are doing a great deal of work. Reliable means the trail has to be dependable, not merely present. Audit trail means it has to be followable by somebody else — an auditor, years later, without the institutional knowledge that makes it obvious to you.
There is no prescribed control, no certification, no approved list. The route is genuinely open, which is generous and which shifts the entire burden onto description. If you choose a method the law does not specify, you are the one who has to say what it is.
What the trail has to connect
The link is from the invoice to the supply. In practice that is a chain of records, and each join in it is a place the chain can fail.
| Link | What it establishes | Evidence that closes it | The break that recurs |
|---|---|---|---|
| Order to supplier | That the transaction was authorised and on agreed terms | Purchase order with approval, or a contract for recurring supply | Ad hoc purchases raised without an order and regularised later |
| Supply to order | That what was ordered actually arrived | Goods receipt, service acceptance, timesheet, delivery note | Services, where there is nothing to receive and acceptance is informal |
| Invoice to supply | That the document corresponds to what was received | Matching on quantity, price and reference | Partial deliveries, and invoices covering several deliveries at once |
| Payment to invoice | That the transaction completed as documented | Remittance detail identifying the invoices settled | Consolidated payments covering dozens of invoices with no breakdown |
| Ledger to invoice | That the accounting reflects the document | Posting reference linking entry to document | Manual journals adjusting a balance without reference to any document |
The recurring breaks in the last column have a pattern. They are all the cases where a normal process was bypassed for a good operational reason. Nobody sets out to buy without an order. It happens because something was urgent, and the exception is legitimate — but an exception with no compensating record is a gap in the trail regardless of how reasonable it was at the time.
Documenting a control so it can be evidenced
This is the part that gets skipped, and it is not long. A control description that is actually useful contains six things.
- What is being checked, stated as a specific comparison rather than as an intention
- Which records are compared, named as systems and fields rather than as concepts
- Who performs it, identified by role rather than by person, so it survives their departure
- How often it runs, and what the tolerance is before something counts as an exception
- What happens when it fails: who is told, what they do, and within what period
- Where the evidence that it ran is retained, and for how long
Six lines. The reason it is worth writing them is that every one corresponds to a question an auditor asks, and answering from memory produces answers that vary between the three people asked.
The sixth is the one that decides the outcome. A control with no retained evidence of operation cannot be distinguished from a control that was described and never run. Recording the outcome — including the outcome "no exceptions", which is the one everybody omits — is what converts a habit into evidence.
Where structured invoicing helps, and where it does not
A structured invoice makes the matching itself easier. Identifiers sit in known fields rather than in a reference line that somebody typed, so linking an invoice to an order becomes a lookup instead of a search. That genuinely improves reliability, and it means the control can run on every document rather than on a sample.
What it does not do is discharge the description obligation. The control still has to be described, still has to have an owner, and still has to leave evidence. A business that automated matching and never wrote down what the automation checks has replaced a documentable manual control with an undocumented automatic one, which is a step backwards evidentially even though it is a step forwards operationally.
There is a related trap on the receiving side. When accounts payable is redesigned around a document that arrives already structured, several steps that used to involve a person disappear. The control that person was exercising, often without anyone having called it a control, disappears with them unless it is deliberately re-established somewhere. Automation removes work. It does not remove the need for the check, and the check is what the trail depends on.
A frequent arrangement: matching is automatic, exceptions go to a queue, and the queue is worked when there is time. That is a control with an undefined frequency and no tolerance, which means its reliability is a function of workload. It will hold during a quiet quarter and fail during a busy one, and the failure will be invisible because nothing records how long items waited.
The reconciliation is part of the trail
There is a natural tendency to treat the audit trail as a document-level thing — this invoice, that delivery note. It is worth taking a wider view, because the aggregate checks are evidence too.
If the total of what you invoiced agrees with what you reported and with what you declared, that agreement is itself a reliable indication that the individual documents are what they claim to be. If it does not agree, no amount of document-level matching repairs the impression. This is why reconciling reported data against the return belongs in the same conversation: it is a control, it produces evidence, and it is the one an administration running continuous reporting can see the results of without asking you.
How this sits against the alternatives
Businesses reach for sealing because it feels like a definite answer to an uncomfortable question. It is a definite answer to a narrow question. What a seal establishes is origin and non-alteration; it establishes nothing about whether a supply occurred, which is what an assessment actually contests.
The business control route addresses the contested question directly and is weak exactly where the seal is strong — in demonstrating that a specific document is unaltered years later. That is an argument for using both where the stakes justify it, and it is an argument against believing that either one alone is a complete answer to the three properties.
What survives the archive
One last consideration that decides whether any of this holds. The trail has to be retrievable for as long as the invoice has to be kept, and the records at the far ends of it — the order, the goods receipt, the remittance — live in systems with their own retention rules, often shorter than the tax one and set by somebody who never considered this use.
An invoice preserved impeccably, whose supporting order was purged after three years by a policy nobody connected to the tax obligation, has a trail that stops in mid-air. That is why what is kept alongside the document is a question about the whole chain rather than about the invoice file, and why the answer has to be agreed with the people who own the other systems before, not after, their retention schedules run.
