Every entry in the books should be traceable to a source document that proves the transaction happened: an invoice, receipt, contract, bank record, payslip or approved journal with workings. The audit trail is the chain that lets someone follow a figure in the accounts back to that evidence and forward again. HMRC and auditors both accept digital records, including scanned copies, provided the information is complete, legible and can be reproduced when asked, but a few documents must still be kept in their original form.

What is a source document, and what is the audit trail?

A source document is the first record of a transaction, created or received when it happens. The audit trail is the set of links between that document, the entry in the books of prime entry, the posting to the ledgers and the figure in the accounts. A good trail works in both directions: from a line in the profit and loss account down to the invoices behind it, and from any invoice up to where it was posted.

The legal duty to keep accounting records for companies is in section 386 of the Companies Act 2006, covered in the duty to keep accounting records. For sole traders and partners the equivalent duty is explained in record keeping rules for the self employed. This page looks at the evidence behind individual entries and how it can be kept.

The auditing standards use a broad definition. ISA (UK) 500, paragraph 5(a), defines accounting records as the records of initial accounting entries and supporting records, such as cheques and records of electronic fund transfers, invoices, contracts, the general and subsidiary ledgers, journal entries and other adjustments, and the work sheets and spreadsheets supporting cost allocations, computations, reconciliations and disclosures. In other words, the spreadsheet behind an accrual is part of the records.

What evidence should support each type of entry?

Entry Primary evidence Supporting evidence
Credit sale Copy sales invoice Order, contract or delivery note
Cash or card sale Till record or card settlement report Daily takings summary and bank deposit
Purchase or expense Supplier invoice or receipt Purchase order, goods received note, approval
Payment or receipt Bank statement Remittance advice, payment approval
Payroll Payroll report and payslips Contracts, timesheets, Full Payment Submission
Fixed asset Purchase invoice Fixed asset register entry, title documents
Stock Stocktake sheets Valuation workings
Journal Journal with narrative and approval Calculation or schedule showing the figures

GOV.UK guidance for limited companies lists the kinds of records needed to prepare accounts and the Company Tax Return: receipts, petty cash books, orders and delivery notes for money spent; invoices, contracts, sales books and till rolls for money received; and other documents such as bank statements and correspondence. Journals are the entries most often missing evidence; see journal entries for what each one should record.

What does a purchase invoice need to show for VAT?

For VAT, the supplier’s invoice is more than evidence of cost. HMRC’s Notice 700/21 says the VAT invoices you receive are the primary evidence for recovering input tax, and lists the details a full VAT invoice must show, including a sequential number, the time of supply, the date of issue if different, the supplier’s name, address and VAT registration number, the customer’s name and address, and a description sufficient to identify the goods or services. For retail supplies of £250 or less including VAT, a simpler invoice is allowed.

HMRC’s VAT Input Tax manual at VIT31200 explains that the right to deduct depends on holding a VAT invoice that meets regulation 14 of the VAT Regulations 1995, or a C79 certificate for import VAT. Under regulation 29, HMRC has discretion to accept alternative evidence, but it must be satisfied that VAT was due, charged by the supplier and paid. A card receipt or a bank statement line alone will rarely be enough, so a missing invoice should be requested from the supplier rather than replaced with a note.

Can records be kept digitally instead of on paper?

Generally yes. HMRC’s Compliance Handbook at CH13100 says a person can meet the duty to preserve records either by keeping the original documents or by preserving the information in them. Paper may be discarded once the information is transferred electronically, provided the storage method captures all the information needed for a correct and complete return and can reproduce it in a legible form. CH13400 adds that scanned or imaged copies must be full and complete copies, including anything relevant on the reverse, and that if software is upgraded or a licence lapses, the business must still be able to reconstruct the data.

For VAT, Notice 700/21 gives two examples. If a business keys selected data from an invoice into its software, it must keep the invoice, because the software data is not a copy of it. If the software scans the invoice and the image is retained with all the detail needed for VAT, the original need not be kept unless required for another purpose. The notice also says some records must be kept in original form, giving the C79 import VAT certificate as an example.

CH13300 lists other documents to keep in the original, including written statements showing tax deducted from a payment, statements of payments and deductions under a construction contract, and records needed to claim credit for foreign tax.

What do auditors look for in the evidence?

Auditors judge evidence on its source and nature. ISA (UK) 500, paragraph A35, sets out general principles: evidence from independent sources outside the entity is more reliable; internally generated evidence is more reliable when the related controls are effective; documentary evidence is more reliable than oral; and original documents are more reliable than copies or digitised documents, whose reliability may depend on the controls over their preparation and maintenance.

Paragraph A16 recognises that source documents may exist only electronically, or be discarded after scanning, and paragraph A17 notes that some electronic information may not be retrievable after a period, so the auditor may ask for it to be retained. In practice that means a scanning process with clear controls (every document scanned, nothing altered, images linked to the ledger entry) supports the trail as well as paper does, while a folder of unnamed phone photos does not.

What does a working audit trail look like?

Illustration only. An auditor picks a £1,800 charge in the repairs account. The trail runs as follows:

  1. The nominal ledger shows the entry with a transaction reference and supplier name.
  2. The reference opens the purchase invoice image in the accounting software, showing the supplier’s VAT number, the date and £1,500 plus £300 VAT.
  3. The invoice is stamped with the approver’s initials and linked to a purchase order.
  4. The supplier’s account shows the invoice paid in a payment run, and the payment appears on the bank statement.

If any link is missing, for example the invoice is an unsigned PDF with no order and the payment cannot be found, the auditor has to do more work, and an HMRC officer in a VAT compliance check may question the input tax.

How long must the evidence be kept, and what if it is not?

Section 388 of the Companies Act 2006 requires accounting records to be preserved for three years from when they are made for a private company, and six years for a public company. Tax rules usually require longer: GOV.UK guidance says company records must be kept for 6 years from the end of the last company financial year they relate to, or longer in some cases, and Notice 700/21 says VAT business records must generally be kept for at least 6 years. GOV.UK also warns that a company can be fined £3,000 by HMRC, or a director disqualified, for not keeping accounting records. The full retention picture is in how long companies must keep records.

Under Making Tax Digital for VAT, the trail also has to survive between software products: Notice 700/21 requires digital links where data moves between products that make up the electronic account, and says copy and paste is not a digital link. See Making Tax Digital for VAT.

What mistakes break the audit trail?

  • Bank feed only bookkeeping. Coding bank lines straight to expense accounts without attaching the invoice leaves no evidence of what was bought or of the VAT.
  • Journals without workings. A journal saying only “adjustment” cannot be checked.
  • Losing access to old systems. Cancelling a subscription can lock away six years of attached documents unless they are exported first.
  • Partial scans. Scanning only the front page of a multi page invoice or contract fails the complete copy test.
  • Editing after posting. Overwriting an entry instead of reversing and reposting it destroys the record of what was originally recorded.

Solar Protect provides tax investigation insurance for businesses and fee protection schemes for accountancy practices. Read how our cover works or get a quote.

Related Accountapedia entries

Sources

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 8 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.