TÜV NORD offers testing and certification of document management systems (DML) to ensure audit-proof archiving. We examine technical and organizational aspects to meet legal requirements such as unalterable archiving and process traceability.
Users of document management solutions (DMS) are subject to legal requirements for the audit-proof storage of documents. Typical core requirements are unalterable archiving, traceability of process flows and long-term formats. These are often accompanied by questions: Can the paper originals be destroyed after archiving? Does the archiving process run properly and on time? Can an archived document still be reproduced true to the original after 10 years?
TÜV NORD carries out technical and organisational tests and certifications tailored to the respective context in order to answer these and other questions about the revision security of your document management system.
Partial solutions - such as scanning processes or archiving systems - can also be certified, provided that the interfaces and functional delimitations are clearly documented.
The test criteria for document management solutions (AC-DMS) were developed jointly by the VOI (Association of Organisation and Information Systems) and TÜV NORD. They cover all legal and non-legal requirements for a document management solution.
The focus of the AC-DMS is on the legally compliant and audit-proof handling of digital documents of all kinds. They consider whether a DML fulfils the following criteria:
If necessary, further regulations, guidelines and standards supplement the test basis.
The current, revised 5th edition of the PK-DML from 2019 can be ordered via the VOI website.
Certification in accordance with AC-DMS is particularly suitable for:
A document management system (DMS) is a specialised software solution that enables digital documents to be captured, managed, stored, retrieved and archived in an audit-proof manner. Modern DMS solutions integrate seamlessly into existing business processes and support companies in their digital transformation.
For successful PK-DML certification, DMS software should offer the following functions:
These functions are essential for meeting criteria such as traceability, compliance and availability in accordance with PK-DML.
The certification can be applied to all digital document management processes and the associated IT solutions.
Partial solutions can also be certified, e.g. just the scanning process, the management and processing of files and documents, or an archive.
In the case of partial solutions, the interfaces and functional boundaries must be clearly described in the procedural documentation.
If your DMS solution and the capture process meet the requirements for proper, complete and traceable digitisation in accordance with PK-DML and GoBD, paper documents can generally be destroyed after scanning. This is also referred to as ‘replacement scanning’ (BSI TR-03138 Replacement Scanning (RESISCAN)). An audit by TÜV NORD provides you with legal certainty in this regard.
It consists of
and certification.
Time required:
The basis of every PK-DML certification is the procedural documentation, which must clearly demonstrate how the IT solution meets the relevant assessment criteria. The documentation may also refer to other documents containing more detailed information, such as security concepts, process descriptions or work instructions.
A full document review is carried out for initial and recertification audits. During an on-site audit lasting several days, the implementation of the measures described in the documentation is verified.
As part of the surveillance audit, no full document review takes place; approximately 50% of the requirements of the PK-DML are checked on-site. The focus is on changes since the last audit.
The GoBD (Principles for Proper Accounting and the Retention of Digital Records) form a key legal basis for electronic archiving in Germany. A PK-DML audit assesses whether your DMS meets the requirements of the GoBD – for example, through audit-proof storage, logging and comprehensive procedural documentation.
The scope of the audit and certification is determined in consultation with the client; for example, sub-processes or all relevant workflows throughout the document lifecycle may be examined, e.g.:
This involves assessing whether these processes are documented, technically secured and implemented in an audit-proof manner.
The certificate is issued by the certification body of TÜV NORD CERT GmbH.
The certificate is valid for three years. Initial certification takes place as part of an initial audit in year 1, followed by one surveillance audit in each of years 2 and 3, during which changes to the initial documentation are reviewed.
The document review comprises a maximum of two rounds, with the second version of the document being eligible for review and certification. The on-site audit comprises a maximum of one round eligible for review and certification.
