The reliable audit trail (la piste d'audit fiable, or PAF) is the most common way to secure invoices in France. When a business does not use either a qualified electronic signature or electronic data interchange (EDI), the PAF is what guarantees the evidentiary value of its invoices to the tax authorities. Indeed, when a company issues or receives a paper invoice or an unsecured electronic invoice, it must be able to demonstrate – with supporting documentation – that the document corresponds to a genuine business transaction and has not been altered. This requirement is key, as it invariably arises during tax audits; a lack of documentation can lead to one's right to deduct value-added tax (VAT) being challenged.

This topic is becoming increasingly important, as electronic invoicing reform goes into effect on 1 September 2026, placing renewed emphasis on the audit trail and encouraging businesses to ensure the reliability of its processes without delay. Businesses must understand what authorities expect of them, which businesses are impacted, and how to implement controls without using excess resources.

This article covers the fundamentals of a reliable audit trail: its objective, the resulting obligations for businesses, how to create a reliable audit trail, and the penalties for non-compliance.

Key takeaways

• A reliable audit trail (PAF) makes it possible to demonstrate that an invoice corresponds to an actual transaction by linking it to supporting documents such as the quote, purchase order, delivery slip, or payment.
  
• PAF requirements apply to businesses that issue or receive invoices without using a qualified electronic signature or electronic data interchange (EDI), particularly for paper, PDF, or unsecured electronic invoices.
  
• The reliable audit trail aims to guarantee the authenticity of origin, the integrity of contents, and the readability of invoices throughout their required retention period.
  
• PAF implementation relies on documented, ongoing internal controls tailored to the company's organisational structure, in order to secure every step of the invoicing process.
  
• If the audit trail is insufficient, the company risks having its VAT deduction challenged, even though electronic invoicing reform is gradually changing the role of the audit trail for certain transactions.
  

What is a reliable audit trail?

A reliable audit trail (PAF) is a set of documented, ongoing controls that a company implements to ensure three qualities for each of its invoices: authenticity of origin, integrity of contents, and readability. As a legal requirement, it enables an invoice to be linked to the business transaction that supports it, from the quote through to payment.

The PAF is one of three accepted methods for ensuring these three qualities, as set out in Article 289 VII 1° of the General Tax Code (CGI); the other two methods are qualified electronic signature and EDI. This framework stems from the European Directive 2010/45/UE of 13 July 2010, on invoicing rules. In France, this requirement has been in effect since 1 January 2013, following the implementation of the directive by the Amended Finance Act for 2012.

The three accepted approaches are not mutually exclusive. A business can use EDI for some customers, electronic signatures for others, and a PAF for the remainder of its workflows (e.g., unsecured electronic invoices and paper invoices). In practice, the PAF remains the most widely used, as it requires no specific technical infrastructure.

What's the difference between a reliable audit trail and an accounting review path?

A reliable audit trail has a broader scope than an accounting review path. An accounting review path traces a bookkeeping entry back to its supporting document, following a purely accounting-based approach. A reliable audit trail, on the other hand, establishes a traceable link in both directions between the invoice and the actual underlying business transaction.

Why was the reliable audit trail established?

The reliable audit trail was established to combat VAT fraud and ensure the security of electronic invoicing. By allowing businesses to transmit their invoices by any electronic means, the EU sought to prevent the risk of an invoice being falsified or disconnected from an actual transaction.

The objectives of the PAF, as set out in Directive 2010/45/UE and French tax law, are as follows:

• Prevent VAT fraud and false invoices
  This is the rationale behind the introduction of the reliable audit trail: the system aims to prevent fraud risks and secure the invoicing process. Tax authorities require a traceable link between each invoice and the underlying transaction to detect bogus invoices, fictitious transactions, and schemes designed to improperly recover VAT. An isolated invoice, without a corresponding purchase order or delivery slip, immediately raises suspicion.

• Encourage the secure use of electronic invoicing
  The EU directive aimed to remove barriers to digitisation. Rather than imposing a single technology, which would be restrictive, it opened the door to any transmission method, provided that the business can guarantee its reliability through its own controls.

• Ensure the evidentiary value of invoices over time
  An invoice must retain its authenticity, integrity, and readability from the time of issuance until the end of its retention period. A reliable audit trail ensures this continuity.

• Make businesses accountable through internal controls
  The PAF shifts part of the burden of proof to the business. It is up to the business to show that its processes are reliable. In practice, this incentivises businesses to structure their invoicing, formalise their procedures, and identify their areas of risk.

• Facilitate tax audits
  Clear documentation describing who is responsible for audits, what items are audited, when, and under what conditions enables tax authorities to quickly grasp the company's organisational structure in the event of a tax audit. In accordance with Articles L. 13 D and L. 80 F of the Book of Tax Procedures (LPF), this documentation must be available for presentation, including in electronic form.

What are the requirements of a reliable audit trail?

The obligations associated with a reliable audit trail are based primarily on three requirements detailed in Article 289 VII of the CGI: guaranteeing authenticity of origin, ensuring integrity of contents, and preserving readability of each invoice. In addition, there is an obligation to document controls and retain records for the legally required period.

Here are the key requirements of the PAF:

• Guarantee authenticity of origin
  Businesses must be able to establish with certainty the identities of invoice issuers. For incoming invoices, this means verifying that the supplier named on the invoice is the one that carried out the delivery or provided the service. Reconciling the purchase order, delivery slip, and invoice – along with verifying the intracommunity VAT number or Business Directory Identification System (SIREN) number – constitute the minimum requirements for this obligation.

• Ensure integrity of contents
  The information on the invoice must not have been altered in any way between issuance and receipt, nor during the entire retention period. Required information, amounts, descriptions, contact information, and VAT rates – nothing must be modified without the knowledge of the parties involved. The controls put in place must be able to detect any inconsistencies or suspicious modifications.

• Preserve invoice readability
  The invoice must remain readable to the human eye, without complex processing, from the moment of issuance until the end of its retention period. An archiving format that becomes unreadable over time would not meet this requirement.

• Document controls in a permanent, written format
  According to the Official Public Finances Bulletin (Bulletin Officiel des Finances Publiques, or BOFiP), controls must be described, made available, and explained. The documentation must specify who checks the documents and data, when, and how. For very small businesses where controls rely on a single individual and the manual cross-referencing of invoices with sales documents, an oral presentation accompanied by a practical demonstration might suffice to describe the system. Nevertheless, the controls must have been documented in writing at the time of their implementation.

• Make controls organised and ongoing
  A reliable audit trail is not a one-time exercise conducted once a year. Controls must be integrated into the company's day-to-day operations and applied continuously and consistently across all relevant workflows.

• Retain invoices and control documentation
  Businesses must retain invoices for six years for tax audit purposes (Article L. 102 B of the LPF). From an accounting perspective, the Commercial Code also mandates the retention of ledgers and supporting documents for ten years. In practice, businesses often align their archiving policies with the longer retention period. The components of these controls and their supporting documentation must be retained under the same conditions and made available to the authorities, including in electronic format.

What control points should be considered?

In addition to the three legal requirements, there are several best practices that help create a truly robust audit trail: user identification, event logging, data integrity and retention, bookkeeping review and duplication checks, and defining internal control procedures.

Here's how to approach the process:

• User identification
  Every individual who creates, approves, modifies, or records an invoice must be identifiable. This requires user ID-authorised access to invoicing and accounting tools, with rights differentiated by role – specifically, who can issue an invoice, who approves it, and who authorises payment. In the event of an audit, the ability to describe each role reinforces the credibility of the PAF. It's recommended to avoid shared or generic accounts, which make traceability impossible.

• Event logging
  A log, or technical audit trail, records the actions performed on invoices and associated data: creation, modification, approval, issue, and archiving. Ideally time-stamped, this log enables the reconstruction of an invoice's complete history. Modern electronic platforms generate these records automatically, with a unique identifier for each invoice and a time stamp for each step.

• Data integrity
  This involves proving that an invoice has not been altered after it was issued. For electronic transactions, a cryptographic fingerprint makes it possible to verify at any time that a file is identical to the original. For digitised documents, BOFiP specifies that, in the event of annotations or modifications, only the corrected and redigitised version is accepted as valid evidence.

• Data retention
  In addition to the invoices themselves, businesses must retain all supporting documents related to transactions, including quotes, purchase orders, delivery slips, contracts, and bank statements. It is this set of documents – not the invoice alone – that provides a reliable and verifiable audit trail. For electronic transactions, legally admissible archiving with a digital signature ensures the integrity of the documents over time.

• Bookkeeping review and duplication checks
  The BOFiP includes, among the objectives of the audit trail, ensuring that an invoice is not subject to duplicate processing or recording. In practice, this means businesses must ensure that invoices are not recorded or paid twice, that transactions are recorded correctly in the accounts, and that archiving procedures are followed. This check also makes it possible to verify that transactions are recorded in chronological order and without breaks in sequence.

• Defining internal control procedures
  The company must formalise – in an accessible document – how its controls operate: which reconciliations are performed, by whom, and how often, as well as how discrepancies are handled. The procedure should also include how to identify risks specific to the invoicing system; for instance, misconfigured invoicing software can generate a series of inaccurate invoices – a risk that must be detected and managed proactively.

Who is subject to the reliable audit trail requirement?

The reliable audit trail requirement affects any business subject to VAT that issues or receives invoices without relying exclusively on qualified electronic signatures or EDI. In practice, this includes the vast majority of French businesses, regardless of their size, industry, or revenue.

PAF requirements make no exceptions for businesses due to size. The primary types of businesses impacted are as follows:

• Businesses that issue or receive paper invoices, digitised paper invoices, or unsecured PDFs
  Whenever a company does not use either a qualified electronic signature or EDI for a given transaction, that transaction must be covered by an audit trail. This applies to at least a portion of invoices from the majority of French companies, including very small enterprises, small and medium-sized enterprises (SMEs), intermediate-sized enterprises, and large enterprises.

• Microentrepreneurs and self-employed individuals subject to VAT
  The simplified microenterprise regime does not exempt businesses from the requirement to maintain a PAF. Self-employed individuals who invoice customers by PDF or on paper must be able to link each invoice to an actual service provided. However, businesses operating under the VAT exemption regime have reduced obligations, although they're still subject to traceability requirements whenever they issue an invoice.

• Taxable associations and civil real estate companies (sociétés civiles immobilières, SCI)
  As soon as an entity issues invoices subject to VAT, it falls within the scope of the reliable audit trail requirement. Associations engaged in taxable economic activities and civil real estate companies subject to VAT must therefore document their audit trail in the same manner as a commercial business.

• Businesses receiving invoices
  The PAF applies to both sales invoices and purchase invoices. For purchases, audit trails ensure the right to deduct VAT. If a supplier invoice doesn't have an audit trail, tax authorities could challenge the tax deduction, creating an immediate financial impact in the event of an audit.

Note: The authorities consider a business's size, invoice volume, and resources when determining documentation requirements. The BOFiP specifies that summary documentation might be sufficient for an SME, while more detailed documentation is expected from large companies.

How to establish a reliable audit trail

Establishing a reliable audit trail involves mapping a business's invoicing pathways, defining controls at each step, and then documenting everything in a written procedure. No complex technology is required; the key lies in organisational rigour and the ability to link each invoice to its supporting documents.

Here are the steps to follow:

• Map all invoicing pathways
  Identify each invoicing pathway: customer sales, supplier purchases, credit notes, expense reports, and intercompany invoices. For each type, list the related documents, from quotes to bank statements. This process helps identify areas of risk and the stages where controls are necessary. No pathway, no matter how minor, should be left out.

• Define controls at each stage
  Specify the verifications to be performed for each invoicing pathway. For sales, make sure that quotes, purchase orders, shipments, and invoices all match. For purchases, reconcile supplier invoices with their corresponding purchase orders, verifying the SIREN and VAT numbers, and confirming actual delivery. A good rule of thumb is that any discrepancy should trigger a manual review before approval or payment.

• Assign responsibilities
  For each control, designate the person or department responsible for validating orders, approving invoices, and authorising payments. This clear designation of roles, along with user ID-authorised access to tools, strengthens the reliability of the audit trail.

• Document procedures in writing
  Draft a document describing transaction pathways, controls, responsible parties, and rules for handling discrepancies. The document should be clear enough for a third party to understand the organisational setup. The document should be dated and revised any time the procedure changes.

• Create a reliable, sustainable archiving system
  Implement an archiving system that ensures the preservation, readability, and integrity of invoices and their supporting documents for the duration of the statutory retention period. For electronic transactions, an archiving system with probative value is preferred. This is a system that timestamps each document and associates it with a digital fingerprint so that any subsequent modification is detectable and the invoice remains enforceable for the entire retention period.

• Train teams and perform regular audits
  A PAF is effective only if the people implementing it understand it. The parties involved must be trained, and periodic internal checks should be done to ensure that procedures are being followed correctly. Likewise, it's important to correct deviations from procedure before they become vulnerabilities that could be exploited during an accounting audit.

What are the penalties for failing to maintain a reliable audit trail?

The main penalty for failing to provide a reliable audit trail is the denial of the right to deduct VAT. Without a PAF, electronic signature, or EDI, an invoice might lose its evidentiary value. Other penalties provided for in the General Tax Code (CGI) apply to distinct infractions, such as false invoices or missing mandatory information.

The main consequences to consider are as follows:

• Denial of the right to deduct VAT
  For an invoice to qualify for a VAT deduction, it must comply with Article 289 of the CGI and must be linked to a genuine transaction. Without a PAF to demonstrate that a transaction actually took place, the tax authorities can decline the VAT deduction on the purchase, resulting in a tax reassessment, plus late-payment interest. Note: A simple omission of a required detail does not automatically result in this denial if the reality of the transaction is otherwise demonstrated.

• 50% fine for false invoices or concealment
  Article 1737, I of the CGI imposes a fine equal to 50% of the amount involved for serious violations: invoices that do not correspond to an actual transaction, concealment of a supplier's or customer's identity, or the use of a proxy.

• 50% fine for failure to invoice; reduced fine of 5% if the transaction can be verified through records
  Failure to issue an invoice and record the transaction exposes the business to a penalty of 50% of the transaction amount, capped at €375,000 per fiscal year. However, if a business can prove that the transaction was recorded, the fine is reduced to 5%, capped at €37,500.

• €15 fine for each missing or inaccurate detail
  Article 1737, II of the CGI states that each omission or inaccuracy in mandatory information on an invoice is punishable by a fine of €15, capped at 25% of the invoice amount.

Example of a reliable audit trail

A reliable audit trail links each invoice to the underlying transaction, from the initial quote to the final payment. Let's look at a concrete example in which an agency invoices an SME €8,000 for consulting services:

• The agency (i.e., the customer) approves a quote for €8,000 and sends a purchase order to the SME. These documents act as proof that the service was requested. The assignment itself also creates a paper trail (e.g., reports, deliverables, emails) demonstrating that the work was actually carried out.
  
• The invoice displays the same amounts, description, and contact information as the quote. If the invoice shows €8,500 while the order was for €8,000, the discrepancy triggers a verification process before payment. The consistency between the purchase order, documentation of the work performed, and the invoice itself establishes the authenticity of origin. Securing the approved document preserves the integrity of its contents, and long-term archiving preserves its readability over time.
  
• The bank statement is the final link in the chain, providing evidence of payment. As a result of the reliable audit trail, the agency can recreate the entire transaction, from initial contact to payment.
  

Each document that makes up a PAF corroborates the next, and this linkage is sufficient to prove that a given invoice corresponds to an actual transaction. In the event of an audit, the ability to link every invoice to a specific sale or service helps prove the business's right to a VAT deduction.

E-invoicing reform and PAF: What does the future hold?

Beginning 1 September 2026, all businesses subject to VAT must be capable of receiving electronic invoices. The obligation to issue electronic invoices will apply first to large and intermediate-sized enterprises (starting 1 September 2026), followed by SMEs and microenterprises starting 1 September 2027. Ultimately, businesses will no longer be able to exchange paper invoices or PDF invoices by email; any B2B invoice must be in structured electronic format (e.g., Factur-X, UBL, or CII) and be transmitted through a government-approved platform.

Electronic invoicing reform doesn't eliminate the PAF, but instead repositions it. Starting 1 September 2026, domestic B2B invoices will be transmitted through approved platforms, which will guarantee authenticity and integrity through a mandated technical framework—similar to what EDI or electronic signatures already provide. In these cases, audit trails become less central, as the technical process itself fulfils that function.

However, many transactions fall outside this system and must continue to rely on the use of the PAF. This is particularly the case for invoices received from foreign suppliers not established in France, as well as transactions subject to e-reporting, such as sales to private individuals or international transactions. For all of these transactions, the business must still be able to demonstrate the link between the invoice, the commercial transaction, and the payment.

Note: While the reliable audit trail remains in effect, its legal basis is gradually shifting from the General Tax Code (CGI) to the Code of Taxes on Goods and Services (CIBS). Ordinance No. 2025-1247 of 17 December 2025 repeals Articles 289 and 289 bis of the CGI as of 1 September 2026, and transfers VAT rules, including those on invoicing, to Book II of the CIBS. The substance of the obligations—including the reliable audit trail—remains unchanged; only the numbering of the provisions is changing. Section VII of Article 289 is being retained on a transitional basis until it is incorporated into the CIBS under Articles L. 216-41 et seq.

Consequently, while the e-invoicing reform automates and secures invoice transmission, it does not absolve companies of the need to manage their end-to-end processes and ensure the authenticity, integrity, and readability of invoices. Audit trails remain necessary to ensure traceability and consistency throughout the process.

How Stripe Invoicing can help

Stripe Invoicing simplifies your accounts receivable (AR) process – from invoice creation to payment collection. Whether you're managing one-time or recurring billing, Stripe helps businesses get paid faster and streamline operations:

• Automate accounts receivable: Easily create, customise and send professional invoices – no coding required. Stripe automatically tracks invoice status, sends payment reminders and processes refunds, helping you stay on top of your cash flow.

• Accelerate cash flow: Reduce days sales outstanding (DSO) and get paid faster with integrated global payments, automatic reminders and AI-powered dunning tools that help you recover more revenue.

• Enhance the customer experience: Deliver a modern payment experience with support for 25+ languages, 135+ currencies and 100+ payment methods. Invoices are easy to access and pay through a self-serve customer portal.

• Reduce back-office workload: Generate invoices in minutes and reduce time spent on collections through automatic reminders and a Stripe-hosted invoice payment page.

• Integrate with your existing systems: Stripe Invoicing integrates with popular accounting and enterprise resource planning (ERP) software, helping you keep systems in sync and reduce manual data entry.

Learn more about how Stripe can simplify your accounts receivable process or get started today.