VAT Compliance
Prepared. Reachable. Able to answer.
The first 72 hours after an unannounced inspection or search decide more than many months after — not because verdicts fall then, but because the course is set. This check shows in three minutes whether your organisation would be prepared: leadership, procedure, data access, records, insurance, communication, liquidity. A stocktake of crisis readiness — not legal advice, not a prediction — evaluated entirely in your browser.
How the check works
You answer eight questions on your emergency organisation with Yes, No or Don’t know — ideally off the cuff, because that is how the emergency would arrive. Your result appears immediately as a traffic light, computed locally in your browser; “don’t know” counts like “no”, because a rule nobody knows is no rule. Depending on the colour, the next step follows: readiness checklist, call-back or emergency line. In three minutes you know whether your organisation would be ready.
The traffic light rates your answers, not your company. It does not replace a review of your individual case.
What the result means
Green means: your readiness stands — leadership, procedure and records are settled. The task now is maintenance: review annually, update after personnel changes, occasionally rehearse. A plan that has slept through two promotions and a change at reception is no longer a plan.
Amber means: building blocks exist, but with gaps — typically the written procedure, the insurance notification route or the 72-hour file. Closable methodically within weeks; what matters is the order, because in an emergency the weakest link counts. A short call-back clarifies which one that is for you.
Red means: an emergency would find your organisation largely unprepared — like most businesses never asked this question before. No reason for drama, but a reason to act while nobody is at the door: settle leadership, the external number and data access first, then the rest — in order, not in haste.
Why these questions
The eight questions follow the chronology of the emergency — each rests on a sober legal or practical observation.
The starting point: VAT inspections and searches arrive unannounced; that is their statutory purpose. Preparation is a question of organisation — leadership, a written procedure and a reachable external adviser (questions 1 to 3) decide whether the first hours run in order or chaos. Compliance literature counts dawn-raid rules and emergency planning among a compliance management system’s mandatory components — basic equipment, not a corporate luxury.
Data access (question 4) has a double logic: what leaves the building uncoordinated is later missing for the defence — and its interpretation can hardly be recaptured; logged handovers protect both sides.
The 72-hour file (question 5) is the core — here the circle closes with the Kittel case law: constructive-knowledge cases are decided on evidence, and the authority reconstructs indications backwards — while under the Mahagében line it bears the burden of proof and may not demand unreasonable precautions. An orderly check path produced within three days — checks, approvals, payment and delivery records — changes the starting position of the entire proceedings; that is what the Evidence Pack is built for. The documented check path is also what the German administration itself recognises as an indication against intent and recklessness.
Insurance, communication and liquidity (questions 6 to 8) form the economic flank. Defence literature is sober about the stakes: in carousel-suspicion situations, security measures and liability notices can hit a business economically long before anything is legally decided — banks, credit insurers and partners often react faster than courts. Missed notification deadlines cost cover at the most expensive moment; unmanaged communication damages credit lines; how the business would respond to an enforceable assessment or a frozen account needs thinking through before it is asked. Not alarmism — procedural reality, and why the first 72 hours in an emergency have a page of their own.
Source box
Legal status: 7 July 2026. Full citations for the legal statements made in the text.
- Section 27b German VAT Act (unannounced VAT inspection); Section 324 Fiscal Code (asset freeze); Section 361 AO, Section 69 FGO (suspension of enforcement).
- ECJ, judgment of 16 October 2019 — C-189/18, Glencore Agriculture Hungary, ECLI:EU:C:2019:861 (rights of defence and file access).
- ECJ, judgment of 6 July 2006 — C-439/04 and C-440/04, Kittel and Recolta Recycling, ECLI:EU:C:2006:446, para. 56 et seq.; ECJ, judgment of 21 June 2012 — C-80/11 and C-142/11, Mahagében and Dávid, ECLI:EU:C:2012:373, para. 61 et seq. (evidence question; burden of proof and reasonableness limit).
- Federal Ministry of Finance circular of 23 May 2016 — IV A 3 - S 0324/15/10001, BStBl I 2016, 490 (internal control system as indication against intent and recklessness).
- Quedenfeld/Füllsack, Verteidigung in Steuerstrafsachen, 6th ed. 2025, paras 24, 1115 f. (early defence; Section 324 AO as a “sharp sword”; economic pre-effects).
- Bay/Hastenrath (eds.), Compliance-Management-Systeme, 4th ed. 2026, §§ 4, 6 (dawn-raid rules and emergency planning as mandatory components).
When the servers ride along: data resilience
A search rarely takes only ring binders. What is carried off, or secured for review, regularly includes servers, notebooks, phones, entire accounting and ERP systems — and with them precisely the data from which your own exculpation would emerge. The bitter point: without your own data, there is no defence. A business that can no longer reconstruct what was checked, booked and approved, and when, has nothing to set against the investigators’ narrative — and its operations grind to a halt on top.
Data resilience is therefore a fixed part of crisis preparedness — with three building blocks. First, the backup: geo-redundant, audit-proof copies of the evidential and accounting data outside the company’s seizable sphere — for instance with an external trustee, or in a cloud under a proper data-processing agreement (Article 28 GDPR), compliant with the German GoBD record-keeping principles and time-stamped. Second, the restore: documented, tested restore processes that work under stress as well — a backup nobody can play back is no backup. Third, the rights: during a review of data under Section 110 of the German Code of Criminal Procedure (StPO), the data is not yet seized, and the claim to data copies for ongoing business operations must be asserted actively — proportionality requires that the business be left, or mirrored, the data it needs to operate, rather than being shut down de facto by a total seizure.
The sequence is decisive: the backup architecture must be standing before anyone rings the bell — afterwards it can be neither built nor credibly claimed. Storage locations, responsibilities, the restart plan and prepared applications for copies therefore belong in the 72-hour playbook and in the crisis-preparedness agreement — named, rehearsed, kept current.
FAQ
Is this check legal advice?
No. It is a non-binding stocktake of your crisis organisation — disclosed logic, no assessment of your case, no mandate. What your result means for your situation we clarify, on request, in a conversation — confidential and without obligation.
Are my answers transmitted or stored?
No. The evaluation runs entirely locally in your browser; no answer leaves your device. Only with your explicit consent in the contact form is your result (traffic-light level and score) sent along — individual answers only after a separate tick. Both are off by default.
What happens if my result is red?
Red means: build, do not panic. The first three steps are almost always the same — leadership with a deputy, the external number known in the building, data access accompaniment defined. Via the emergency line we prioritise this confidentially; if a measure is already under way, go straight to the emergency page.
Does the check replace an audit and dawn raid playbook?
No. The check measures whether the blocks exist — the playbook is the rehearsed plan behind them: roles, reception instructions, data access rules, communication line, external numbers, briefed into the team. The check shows whether you need one; the playbook delivers it. The evidence filing is the Evidence Pack; the liquidity flank the asset freeze under Section 324 Fiscal Code.
Start the readiness check. Eight questions, three minutes, result immediately — evaluated in your browser only. Fast. Specific. Confidential. Start the readiness check →
Close the gaps methodically?
Arrange a call-back — we tell you which gap to close first. Response within 24 hours on working days. Form directly below the result. Arrange a call-back →
Inspection, search or asset freeze already under way?
Emergency line in the page header — response today. (Emergency-line number to be confirmed before go-live.)