Paperless document management: what to audit before go-live

The invisible risk is not technical: it is that the warehouse manager can delete an invoice, or that a payslip is filed without a valid signature because nobody tested the integration with the payroll system. Most document management implementations fail not on the technology, but on the segregation of duties that nobody validates, on the integrations that work in the demo but stall in production, or on the regulatory compliance that is only discovered during an internal audit. This guide offers a checklist of 18 controls that you can execute in 4-5 days, without stopping production, and which avoids the post-implementation collapses that we regularly observe in the Portuguese market.

Before you begin: the invisible map

Do not start the audit without this. Gather in a spreadsheet:

• Current document process map — who creates, validates, signs, files each type.
• Inventory of documents in circulation: invoices, payslips, contracts, production orders, certificates of conformity, etc.
• Permissions matrix: who can access, edit, approve, delete each type.
• Retention periods by type (invoicing: 4 years; payslips: 10 years; contracts: duration + 3 years).
• Applicable compliance: DL 28/2019, eIDAS, GDPR, Law 93/2021.
• Systems that feed or consume documents: ERP, payroll, quality system.
• Cutover schedule: paper switch-off date, dual-circulation period, date for destruction of originals.

Step 1: Regulatory compliance — the foundation

Start here. Without this, the rest is cosmetic. Most Portuguese companies that fail at this stage end up discovering, 6 months after go-live, that their invoices do not comply with the mandatory structure or that the signatures are not legally valid.

Electronic invoicing (DL 28/2019). Check whether the software is certified by the AT for issuing and storing. It is not enough to keep PDFs — the platform must comply with the mandatory data structure and submit SAF-T monthly. Test: create a test invoice in the system, export it in SAF-T format, validate against the AT's official XSD. If there are schema errors, the system is not ready.

Qualified signature (eIDAS). If the system uses a digital signature, confirm that it is qualified (the highest level) and that the signature provider is on the European trusted list (QTSP). This is not optional — an "advanced" signature may not be valid in court. Test the complete cycle: sign a document, verify the validity of the signature after 6 months, after 2 years. The chain of trust must remain intact.

Legal retention. Map each type of document to its retention obligation. Invoicing: 4 years (Law 8/97). Payslips: 10 years (Labour Code). Contracts: duration + 3 years. Configure the system to block deletion before the deadline — this is critical in an audit.

GDPR. Document who has access to personal data (names, NIF, IBAN on payslips). Create a record of processing activities. Test the function to anonymise or delete personal data after the retention period. If the system cannot delete personal data automatically, it is non-compliant.

Access audit. The system must record who accessed, when, and what. Export a 30-day audit report. Check whether it includes IP, timestamp, action (viewing, download, printing, deletion). If a user can access a confidential document and the system does not record this, there is no proof of who did what.

Step 2: Permissions and segregation of duties — where they fail silently

A textile company in the Vale do Ave discovered, 3 months after go-live, that the warehouse manager could delete invoices in the document management system. Nobody had tested it. The risk? Someone could have deleted an invoice from an important customer, leaving a hole in the accounts that would only be discovered in an audit. This is where implementations fail silently — nobody notices until there is an internal audit or a discrepancy in figures. Define and test each combination.

Create a table with each type of document (invoice, payslip, contract, production order, etc.) on the horizontal axis and each action (create, view, edit, approve, sign, delete, file, export) on the vertical axis. Assign permissions by role: Finance Manager, Production Manager, HR, Director, Auditor. Then test each combination with a test user — do not trust the vendor's documentation, test it.

Nobody can be simultaneously the creator and approver of a financial document. Nobody can be creator and deleter. Configure the system to prevent this automatically — it is not a suggestion, it is a segregation-of-duties rule that any auditor will check.

Who sees salaries? Who sees contracts with suppliers? Who sees confidential communications? Test the access of a user at each level and confirm that they see ONLY what they are permitted to. If a factory worker can see a colleague's salary, there is a serious security problem.

During dual-circulation (paper + digital), define who has access to the digital archive. Normally: Finance Manager + Director + Auditor. Nobody else. Test this with an operational user who should NOT have access — confirm that they receive a permission error, not that they can access it "by mistake".

Step 3: Integrations and data flow — the most neglected test

Document management does not live alone. It has to communicate with the ERP, with payroll, with the quality system. Each integration is a point of failure. Test each connection before go-live — not after.

Invoicing. If the ERP issues invoices, confirm that they are captured automatically in the document archive. Create a test invoice in the ERP, wait 5 minutes, look for it in the archive. Check that the series number, date, value and customer are correct. If there is a delay >10 minutes, there is a performance or processing-queue problem.

Payslips. If the payroll system issues digital payslips, confirm that they are signed automatically and filed with the signature. Test a complete pay period: create payslips, verify the signature, access the archive, download a payslip and validate the signature offline. If the signature fails, the payslip is not legally valid.

Quality documents. If the quality system generates certificates of conformity, material tests, or non-conformity reports, confirm that they are captured and that the approval flow works. Create a test document, route it for approval, confirm that the approver receives a notification. If the approver does not receive a notification, the document remains stuck indefinitely.

Contracts and orders. If the ERP or the sales force generates contracts or orders, confirm that they are captured. Test the end-to-end connection: create an order in the ERP, confirm that it appears in the document archive, sign it, confirm that the signature returns to the ERP. If the signature does not return to the ERP, there is a bidirectional integration failure.

Data rejection. Configure the system to reject documents that do not comply with the mandatory schema (e.g. an invoice without the customer's NIF). Test this: try to import an incomplete invoice and confirm that it is rejected with a clear message. If the system accepts invalid data, data quality degrades rapidly.

Step 4: Performance and capacity — the reason nobody uses the system

A slow document management system is a system that nobody uses. Users go back to paper because it is faster. Test under load before go-live.

Load 10,000 documents into the system (or use test data). Measure the search time by criterion: customer, date, series number. Acceptable: <2 seconds. If it is >5 seconds, there is an indexing or database problem — contact the vendor before go-live, not after.

Calculate the expected volume of documents over the next 3 years. Example: 150 invoices/month + 50 payslips/month + 20 contracts/year = ~2,000 documents/year. Over 3 years: 6,000 documents. If each document averages 500 KB (PDF + metadata), that is ~3 GB. Confirm that the server has space and that the backup policy covers this. If the server fills up in the middle of an invoicing period, the system fails.

Test with 10 simultaneous users accessing and downloading documents. Does the system maintain <3 seconds response time? If not, there is a licensing or architecture problem — this is critical in September/October when there is a peak in invoicing.

Make a full backup. Simulate a failure: delete a test document. Restore from the backup. Does the document reappear? In how long? If the recovery time is >1 hour, there is a serious RTO (Recovery Time Objective) problem.

Step 5: Approval flows and notifications — lost documents

A document that gets stuck in an approval is a lost document. The purchasing manager forgot, the director is on holiday, nobody knows there is a pending contract. Test this before go-live.

Define the flow for each type of document. Example: Contract > Purchasing Manager > Director > Archive. Create a test contract and route it. Confirm that the Purchasing Manager receives a notification (email, SMS, or in-app notification). Approve. Confirm that the Director receives a notification. Reject. Confirm that the document returns to the creator with the reason for rejection. If the rejection does not include a reason, the creator is left confused.

Configure automatic escalation: if a document has been in approval for >3 days, notify the approver's manager. Test this: create a document, leave it pending, wait 3 days (or simulate the date). Confirm that the escalation notification is sent. Without escalation, critical documents get lost.

If a notification email fails (email server unavailable), does the system record this? Can it resend? Test: temporarily disable the email server, create a document that requires approval, confirm that the system tries to resend the notification when the email comes back online. If notifications fail and the system does not attempt to resend, the user never finds out that they have a pending approval.

Step 6: Search and retrieval — 30 seconds or back to paper

If the user cannot find a document in <30 seconds, they will go back to paper. This is not an estimate — it is what we observe in real implementations.

Test searching by metadata: document number, date, customer/supplier, value, status (approved, rejected, pending). Each search should return results in <2 seconds. If the user has to wait >5 seconds, they abandon the search.

If the system indexes the content of the PDFs, test it: search for a word that you know is inside a document. Does the document appear? This requires OCR (optical character recognition). Confirm that it is enabled. OCR disabled = full-text search does not work = users go back to paper.

Test advanced combinations: "invoices from customer X between date Y and Z with value > 1,000 EUR". Is the result correct? If the filters do not work well, users do not trust the results.

Can the user export the results of a search to Excel? Test this and confirm that the data is complete and correct. If the export is empty or truncated, it is a serious usability problem.

Step 7: Physical and logical security — digital documents are as valuable as originals

Digital documents are as valuable as paper originals. A forged invoice or an altered contract can cost tens of thousands of euros. Protect them.

Confirm that the communication between the client and the server uses HTTPS (TLS 1.2 or higher). Test: access the system, open the browser's developer tools, go to the Network tab, confirm that all requests are HTTPS. If there is an HTTP request (unencrypted), there is a serious security problem.

Are the documents stored on the server encrypted? This is especially important if the server is in the cloud. Confirm with the vendor. If they are not encrypted, anyone with physical access to the server can read the documents.

Configure multi-factor authentication (MFA) for all users. Test: log in, confirm that a second factor is requested (SMS code, authentication app, etc.). If MFA is not enabled, an attacker who steals the password can gain access.

Configure session timeout (e.g. 30 minutes of inactivity). Test: log in, leave the session inactive for 35 minutes, try to access a document. Does the system request re-authentication? If not, someone can access the computer of an inattentive user and view confidential documents.

If users access the system from outside the corporate network (home office, travel), confirm that they use a VPN or that the system is protected by a firewall and MFA. Without this, an employee's home network is an entry point for an attacker.

Step 8: Compliance with automation — the real impact

Automating document processing reduces costs significantly. Processing an invoice manually costs on average around 13 dollars; automation reduces this to around 3 dollars, according to 2022 data from Ardent Partners and IOFM. This represents a 77% reduction in the unit cost of processing. But this only works if the integration is well tested and if the quality of data extraction is high.

Confirm that the system can automatically capture data from documents (OCR + field extraction): invoice number, date, customer, value, IBAN. Test: import an invoice in PDF, confirm that the fields are extracted correctly. If extraction fails in >5% of documents, there is an OCR quality problem.

Configure automatic validation: if a mandatory field is empty or invalid, the document is rejected with a clear message. Test: try to import an invoice without the customer's NIF. Does the system reject it?

Configure automatic routing: if the invoice is from a pre-approved supplier, it goes straight to payment; if it is new, it goes to manual approval. Test this with an invoice from a new supplier and one from a known supplier. Is the routing correct?

The transition to electronic and automated invoicing reduces processing costs by 60% to 80% compared with paper, with a return on investment in 6 to 18 months, according to Billentis (2025). This means that a company with 5,000 invoices/year (manual cost: ~65,000 EUR/year) can recover the investment in a platform in less than a year.

Final checklist — the 4-5 days before go-live

Day 1. Regulatory compliance (DL 28/2019, eIDAS, GDPR, legal retention). Test each requirement with real data. Document any deviation.

Day 2. Permissions and segregation of duties. Test each user-document-action combination. Create a permissions report and review it with the Director and the Finance Manager.

Frequently asked questions

What is DL 28/2019 and why is it critical for document management?

Decree-Law 28/2019 requires structured electronic invoicing in Portugal. The system must be certified by the AT, comply with the mandatory data structure and submit SAF-T monthly. Without this, invoices are not legally valid. Test by exporting an invoice in SAF-T format and validating it against the AT's official XSD before go-live.

What is the difference between a qualified signature and an advanced signature?

The qualified signature is the highest level of legal validity and is recognised in court. The advanced signature may not carry the same legal weight. In document management, use only a qualified signature from providers on the European trusted list (QTSP). Test the validity of the signature after 6 months and 2 years to ensure that the chain of trust remains intact.

How long should I keep invoices and payslips?

Invoices must be retained for 4 years (Law 8/97). Payslips must be kept for 10 years (Labour Code). Contracts must be retained for their duration plus 3 years. Configure the system to automatically block deletion before these deadlines — this is critical in an audit.

How should I test permissions before go-live?

Create a matrix with each type of document (invoice, contract, production order) against each action (create, view, edit, approve, delete). Test each combination with real users from each role. Check that nobody can be simultaneously the creator and approver, or creator and deleter. Also test that users without permission receive an access error and cannot access "by mistake".

What should I check in the integration between the ERP and document management?

Create a test invoice in the ERP and confirm that it appears in the document archive within 5 minutes. Check that the series number, date, value and customer are correct. Also test the integration with the payroll system — each generated payslip must be captured automatically with a valid signature. If there are delays of more than 10 minutes, there is a performance problem.

How should I document GDPR compliance in document management?

Create a record of processing activities for personal data (names, NIF, IBAN on payslips). Test the function to anonymise or automatically delete personal data after the retention period. Export a 30-day audit report to check who accessed personal data, when and from where (IP). If the system cannot delete data automatically, it is non-compliant.

What is the risk of not testing segregation of duties?

A textile company discovered 3 months after go-live that the warehouse manager could delete invoices — nobody had tested this. The risk is that someone could delete an important invoice, leaving a hole in the accounts that would only be discovered in an audit. This is where implementations fail silently. Test each combination of permissions with real users before go-live.

Sources

• Decree-Law no. 28/2019, of 15 February — Legal regime for electronic invoicing and archiving of fiscal documents
• Regulation (EU) 2014/910 (eIDAS) — Electronic identification and trust services for electronic transactions in the internal market
• Law no. 8/97, of 28 February — Obligations for the retention of invoicing documents
• Regulation (EU) 2016/679 (GDPR) — Protection of personal data and privacy
• Law no. 93/2021, of 20 December — Legal regime for the advanced and qualified electronic signature in Portugal