Electronic invoice records: 3 audit checks

Key takeaways

• Keep invoice details together, including voided and corrected records.
• Check who can add, change, or delete invoices.
• Test an export and keep a separate copy.

This post walks through three rules drawn from California's sales and use tax regulation. California is one state, and the rules are not the same everywhere. If you sell in another state, check that state's rules before you rely on anything here. Nothing in this post is tax or legal advice. It is a practical starting point for owners and bookkeepers who want their invoice files to be easy to defend.

Before the rules, one idea: an audit is about trust. The person checking your books wants to see that each invoice is what it claims to be, that it was not changed after the fact, and that the totals on your returns come from those invoices. A spreadsheet with clean formulas and an app with a tidy dashboard are both fine. What matters is whether you can show the evidence behind the numbers.

Busy routines can leave gaps in invoice records. Invoices get fixed in a hurry, files get renamed, and a deleted row gets forgotten. The goal of the steps below is to make your normal routine leave a trail, so that you do not have to reconstruct it later from memory.

Rule 1: treat electronic invoices as real records

You might think of an invoice in an app as a convenience copy, and treat the PDF you emailed to the customer as the "real" one. California's regulation does not draw that line. It says electronic records are considered records under two sections of the Revenue and Taxation Code, sections 7053 and 7054. California Department of Tax and Fee Administration, "Regulation 1698" In other words, your electronic invoice file is part of your books, not a backup of them.

The regulation also defines what an electronic record is. It describes it as "a collection of related information in an electronic, machine-sensible format." Regulation 1698 A spreadsheet of invoices fits that description. So does an app's invoice list with customer names, dates, amounts, and tax lines. Each row holds related information, and the whole file is stored in a form a computer can read and process.

Seeing your files this way changes how you handle them. You stop asking whether a file is official enough and start asking whether it is complete and whether it can be explained. A few habits follow from that:

• Keep every invoice you issue in the system, including the ones you later voided or corrected. A missing number is harder to explain than a voided one.
• Keep the fields that matter together. Invoice number, date, customer, items, amounts, and the tax charged should live in the same record. If a detail lives somewhere else, such as a separate payment tracker, make sure you can link it back to the invoice.
• Number invoices in order and do not reuse numbers. If there is a gap, write down why it exists rather than hoping nobody notices.
• Do not rely on one screenshot or one printed summary as your only record of an invoice. A summary is useful, but the detail behind it should still exist and be easy to reach.

If your invoices live in an app, ask whether the app keeps a full history of each invoice, and whether a voided invoice stays visible in reports. Check whether your app hides voided items. That is convenient for daily work, but an auditor may want to see them.

Matching is a useful habit as well. Each month, compare your invoice totals to your bank deposits and to the totals on your returns. When the numbers agree, you have evidence that the records are complete. When they do not, you find the problem while it is still small and the people involved still remember what happened. For a matching routine, see Reconcile bank statements in software: 4 matching steps.

If your invoices live in a spreadsheet, the file itself is the record. Save it in a clear, dated way. Keep one working copy that you edit and a separate saved copy at each month or quarter end, so that an old version cannot disappear when someone saves over it. Name files so a stranger could understand them. "Sales final v3 NEW" will not help you in a conversation with an examiner.

Rule 2: control who can change or delete invoices

Holding a record is not enough. You also need to show that the record has not been changed without a trace. The regulation refers to "the internal controls used to prevent unauthorized addition, alteration, or deletion of retained records." Regulation 1698 In practice, that means you should be able to say who can add records, who can change them, and who can remove them.

Internal controls do not need to be complicated for a small business. Here are common steps that fit most owners and bookkeepers:

• Limit access. Give each person their own login. Only people who need to create or edit invoices should have permission to do so. A shared password on a shared account makes it impossible to say who made a change.
• Separate duties where you can. The person who issues invoices should not be the only person who reviews changes to them. If you have only one person doing everything, a monthly review by an outside bookkeeper or a second owner can serve the same purpose.
• Use an audit trail. Choose an app that logs edits and deletions with a user and a date. If your spreadsheet tool offers version history, turn it on and leave it on.
• Void instead of delete. When an invoice is wrong, mark it void and issue a corrected one. Deleting the original removes the evidence that it ever existed, and a missing record invites questions that are hard to answer after the fact.
• Lock closed periods. Once you file a return or close a month, make it hard to change the invoices behind it. Check whether your app supports locking a period. If a correction is needed later, record it as a new entry with a note explaining why, rather than editing the old one.
• Keep backups. Store a copy somewhere separate from the working file, and check that you can open the copy. A backup you have never opened is a guess.

Write down what you do. A one-page note that describes who has access, how changes are logged, how corrections are handled, and where backups are kept can help an auditor understand your process quickly. It also shows that your controls are deliberate, not accidental. Update the note when something changes, such as a new employee or a new app, and date the update.

Be honest about the gaps. If your spreadsheet has no history and two people share one file, say so. Then explain what you do to compensate, such as keeping monthly copies, or having a second person spot-check the totals each month. An honest explanation builds more trust than a claim you cannot back up.

Controls also protect you from yourself. A bookkeeper who corrects a mistake at midnight, or an owner who deletes a duplicate without checking, can create a problem that looks worse than the original error. Logs, locks, and voids make those moments visible, and visible mistakes are easier to explain than hidden ones.

Rule 3: be able to get your records out in a usable form

Records you cannot read are not much help. The regulation expects the systems used for records to be able to export them. It says the taxpayer's "computer hardware or software shall accommodate the extraction and conversion of retained electronic records to a standard magnetic record format." Regulation 1698 The wording is technical, so the practical question for you is simpler: can you pull your invoice data out of your system, in a form someone else can open, without help from the vendor?

A quick test answers most of that question. Here are some things to check:

• Test an export now. Export a month of invoices and open the file on a different computer. If it opens only in the app that made it, you have a problem to solve before an audit, not during one.
• Check the format. A file with all the fields, clear headings, and consistent columns is easier to work with than a printout or a set of screenshots. Confirm that the export includes the tax amounts, not only the totals.
• Ask your vendor. Find out whether they can export full data, including voided invoices and the edit history. Ask how long it takes and whether there is a cost. Get the answer in writing if you can.
• Save copies of the exports. A recent export, stored safely, is a useful fallback if your app changes its plans, changes its export tools, or shuts down. Store it with your other records, not only in the app.
• Plan for a system change. Moving from one app to another can put invoice history at risk. Export the old data first, confirm that it opens, and keep it with your records for the period it covers. Do not assume the new system will import everything.

Think about the person on the other side of the table. An auditor may want to choose a sample of invoices, match them to bank deposits or returns, and trace totals from one report to another. If the data is easy to sort and filter, that work goes faster and the questions stay focused. If the data is locked inside a screen or a format only one program can read, the auditor may need to ask for more information, and that usually slows things down for everyone.

Illustrative example: check an export

Check whether the missing invoice was voided and hidden by a filter. Export again with voided records included, compare the records, and save the export separately. This illustrative check tests completeness, not tax compliance.

Common mistakes that cause trouble

Ordinary habits can create recordkeeping problems. Check your routine for these mistakes:

• Editing old invoices without a trace. Changing last quarter's amounts to match a later bank statement may feel like cleanup. Without a log or a note, it looks like the original records were rewritten.
• Relying on memory. An owner who says "I always charge the same tax on that product" may be right, but the invoices should show it. Memory does not survive a long audit. For related checks, see Sales tax on invoices: 6 state rules to check.
• Mixing personal and business records. A spreadsheet that holds both personal purchases and customer invoices is hard to defend. Keep business invoices in a separate file or app.
• Storing records in one place. A single laptop, a single USB drive, or a single personal email account is a fragile setup. If it fails or is lost, the records go with it.
• Assuming the vendor has you covered. Your app vendor may host your data, but that does not guarantee you can get it back in the form you need. Check what you can export and when.
• Waiting for a notice. Waiting until a letter arrives can leave records disorganized when you need them. By then, the easiest fixes are gone. Start the checks now, while the records are still fresh and the people who made them are still around.

If you recognize two or three of these in your own routine, you are in good company. Pick one to fix this month, and add another next month. Steady progress beats a big cleanup done once a year.

If you find a gap

Finding a gap in your records is not the end of the world. It is useful information, and the way you respond to it matters more than the gap itself. Start by writing down exactly what is missing or wrong: which invoices, which months, which fields, and what you think caused it. A short, specific description is far more credible than a vague sense that something is off.

Next, try to rebuild the missing piece from sources that were created at the time. A bank deposit, a payment confirmation, a customer's email, or a shipping record can often show what was sold and when. Save those sources alongside your notes. Do not create new invoices that look like they were issued earlier, and do not edit old entries to make the numbers line up. If a correction is needed, record it as a new entry dated when you made it, and explain the reason in the note.

Then fix the process that let the gap happen. If a gap came from a shared password, add individual logins. If it came from a deleted row, turn on version history or switch to voiding. If it came from an export that would not open, test a new export every month until you trust the routine. A fix to the process is the part that protects you next time.

Finally, keep the explanation. A one-page memo that describes the gap, what you found, what you did, and what changed is worth far more than silence. Auditors deal with imperfect records all the time. What they look for is whether the business noticed the problem, understood it, and acted on it in a sensible way.

A quick self-check you can do this week

You do not need a special tool to see where you stand. Set aside an hour and answer these questions honestly:

1. Can I find every invoice I issued in the last year, including voided and corrected ones?
2. Does my system show who created and changed each invoice, and when?
3. Can only the right people add, edit, or delete invoices?
4. Have I locked the periods that are already filed?
5. If I export this month's invoices today, will the file open on another computer?
6. Do I have a copy of my records that is stored apart from the working file?
7. Could I explain, in one page, how my invoice records are kept and corrected?

Every "no" is a task. Start with the one that would hurt most if an auditor asked about it tomorrow. Question 5 could be a priority, because an export that cannot be opened is a problem that gets worse under pressure.

If you find yourself unable to answer several of these, that is a sign to get help. A bookkeeper or accountant who works with your state's rules can review your setup and point out gaps faster than you can find them alone.

Where to read the rules

The rules quoted in this post come from California's sales and use tax regulation, which is the main source for the three rules above. The Publication 116 page on detailed records also points readers to that regulation for more on electronic records. California Department of Tax and Fee Administration, "Detailed Records - Publication 116, Sales and Use Tax Records" It says: "For more information on requirements for records kept in electronic form or on film storage media, see Regulation 1698, Records."

If you are unsure which rules apply to your business, ask a tax professional who works in your state before you rely on any general guide, including this one.

Today, export this month's invoices, open the file on another computer, and note any missing fields or records before saving a separate copy.

Common questions

Does California recognize electronic invoice records?

Yes, California's regulation treats electronic records as records under sections 7053 and 7054. That recognition alone does not establish compliance.

What if an export will not open?

Check its format and ask your vendor how to extract usable data. Keep a note of the problem and test the replacement export.