The grant notice arrives, the project runs, the final payment lands — and for many applicants the matter is closed. That is a mistake that, when things go wrong, costs five to seven figures. The audit clock does not start at the project's start but at the last payment. And, depending on the national or European basis, it keeps running for five, seven or ten years — during which the European Court of Auditors, the ministry, the project management agency, OLAF or the tax office can inspect every timesheet, every payroll record and every invoice. In the most recently reported ECA sample, around one in four research transactions drawn shows at least one quantifiable error[1][2]. Two thirds of those errors fall on a single cost category: staff costs[2]. This piece describes what actually has to be kept for ten years, where the legal deadlines diverge, and what a finding triggers in concrete terms.
What is subject to audit
What is subject to audit is not only what was billed in the proof of use. The term covers the whole body of evidence from which the use of funds has to be reconstructable — regardless of whether an individual item found its way into the accounts. Article 20 of the Horizon Europe Annotated Grant Agreement (AGA) expressly requires "records and other supporting documentation" over the whole project period and the retention period that follows; Article 25 secures access to those documents for the Court of Auditors, the Commission services, OLAF and the European Public Prosecutor's Office[3].
Five categories of evidence are affected in practice. First, personnel records: employment contracts, payroll and wage journals, social security certificates, time records with project and work package attribution, records of leave and sickness, evidence of additional remuneration and bonuses. Second, material costs: procurement processes, quotations, comparison quotations, invoices, delivery notes, payment records. Third, travel costs: travel requests, rail and air tickets, hotel invoices, expense claims, the link to the relevant project work package. Fourth, depreciation on assets usable by the project: the asset register, evidence of useful life, the calculation of the project share. Fifth, overhead documentation, unless a flat rate has been chosen.
In Horizon Europe as in national project funding, the technical level is also subject to review: milestone reports, deliverables, scientific publications, software repositories and lab notebooks are drawn on to establish whether the work was actually carried out as the project provided. Financial audits and technical reviews run formally separately, but they draw their evidence from the same body of documents[3]. Anyone who cannot keep the time records consistent with the work package report fails on two review tracks at once.
A ten-year minimum: national vs EU
There is no uniform "ten-year rule" in the wording of funding law. What applies in practice wherever federal funds, EU funds and processes recorded for tax purposes come together follows from the cumulation of several legal bases operating in parallel. Anyone who confuses the end of the project with the end of the retention obligation underestimates the relevant period by years.
The EU Financial Regulation sets the central framework. Article 132 of Regulation (EU, Euratom) 2018/1046 obliges grant recipients in principle to retain all documents until five years after payment of the balance; for amounts below €60,000 the period shortens to three years[4]. Article 20 of the Horizon Europe AGA takes this period over unchanged and makes it more precise: the clock starts at the payment of the balance, not at the end of the project[3]. In parallel, Article 25 AGA secures audit access for Commission bodies, OLAF and the ECA for at least the same period; where audits, investigations or court proceedings are ongoing, the obligation extends until those proceedings are finally concluded[3].
In national grant law, point 6 of the General Ancillary Provisions for Grants for Project Funding (ANBest-P) applies. It obliges the recipient to retain original vouchers and all other documents connected with the grant for five years after submission of the proof of use, unless tax or other rules prescribe a longer period[6]. In BMBF project funding, the Special Ancillary Provisions (BNBest-BMBF 98) impose a practically identical obligation[7].
The decisive point lies in the clause "unless … a longer period". The tax deadline that regularly applies comes from section 147(3) of the Fiscal Code: ten years for books and records, inventories, annual accounts, management reports, opening balance sheets and the working instructions and other organisational documents needed to understand them; six years for commercial and business correspondence and other documents insofar as they matter for taxation[8]. Section 257 of the Commercial Code lays down a parallel ten-year commercial retention period for books, inventories and annual accounts[9].
Invoices, wage journals and payslips — precisely the class of document that plays the central role in a funding audit — fall under section 147(1) no. 4 of the Fiscal Code and therefore regularly under the ten-year period[8]. Taken together that means: even once the five years of EU or federal funding have formally elapsed, tax law still requires retention. In sum, a company that has claimed grant-financed staff costs must remain able to access them for ten years — including the ability to reconstruct the link between payroll run, timesheet and work package.
From an audit perspective the period is open-ended at the top: ongoing proceedings, suspected irregularities or tax field audits with open years extend the retention obligation in practice with no fixed end date[4][3]. The common rule of thumb, "ten years after the final payment", is a sensible guide in practice — not an upper limit.
Staff costs — error source number one
In research and innovation projects, staff costs are not only the largest block of the budget — they are also error source number one. ECA special report 28/2018 quantifies the distribution: 68 per cent of all subsequent corrections in Horizon 2020 audits related to the improper recording and declaration of staff costs. Of that, 65 percentage points came from calculation errors — incorrect annual productive hours, wrong hourly rates, missing or reconstructed timesheets, inadmissible additional remuneration — and a further 3 percentage points from incorrect declaration as unit costs[2].
"Personnel costs remain a principal major source of error."— European Court of Auditors, special report 28/2018 on simplification measures in Horizon 2020[2]
The reasons are structural, not individual. In research-funded projects, staff costs are made up of several layers, each of which has to be auditable in itself. Basic salary has to be evidenced by employment contract and wage journal. Since simplification decision C(2022) 9700, the hourly rate under Horizon Europe has in principle to be formed via a fixed daily rate per calendar month[10]. The actual project-related working time has to be evidenced by time records that meet the AGA's audit standards[3]. Leave, public holidays and sickness have to be correctly excluded from the numerator. Additional remuneration — project bonuses, performance-related components, overtime compensation — is subject to its own ceilings and must not structurally raise the regular salary.
Each of these steps is trivial on its own and error-prone in combination. An employee with variable weekly hours, a sabbatical month and a bonus paid quarterly produces, over twelve months, a data situation from which the auditable hourly rate can only be cleanly reconstructed with consistent primary documentation. That is exactly where the ECA findings bite: the data exist, but they are scattered across the HR system, payroll accounting, project management and the timesheet tool, and in many cases have never been brought onto a single auditable basis.
For internal assurance, then, a pragmatic test applies: if the company can produce, for any billed project hour of any employee at any point in time, the complete chain of evidence — employment contract, payroll run, social security, time record with work package attribution, absence record — within a few minutes, the documentation is audit-ready. If there is a break in the chain — the personnel system of a lapsed HR software licence that no longer runs, say — the risk begins.
The ECA error rate in detail
The European Court of Auditors publishes an annual report on the implementation of the EU budget, giving an estimated error rate for each budget heading. For heading 1, "Single market, innovation and digital", which covers Horizon Europe, residual Horizon 2020 cases and the Connecting Europe Facility, the estimated error rate in the 2023 financial year lay above the materiality threshold of 2 per cent. The error analysis rests on a randomly drawn sample of audited transactions; the errors found are quantified and extrapolated[1].
Within this heading the finding concentrates further on research and innovation spending: in the sample for the annual report chapters on heading 1, research and innovation is the spending category in which the ECA finds the most quantifiable errors. The Court regularly puts it to the effect that "Horizon 2020 / Horizon Europe spending remains high risk and is the main source of errors detected"[1]. In the published sample this corresponds to an order of magnitude in which around one in four research transactions drawn shows at least one quantifiable error.
That figure — one in four research transactions with a measurable error — is not evidence of carelessness among applicants but the arithmetical result of two factors. First, the high share of staff costs, which experience shows has the highest error density. Second, the fact that even minor deviations in the hourly rate formula, the time record or the cut-off for accounting are classified as "errors" — even where the substance of the expenditure is not in dispute. The ECA's concept of error is document-based, not substantive[2].
For applicants this yields a sobering but stable expectation: for research and innovation projects of medium or high complexity, being drawn for audit has to be assumed. Whether the accounts stand does not depend on the audit failing to happen — but on the documentation withstanding it.
A practical documentation minimum
From the interplay of the legal bases, the ECA findings and the review practice of the project management agencies, a documentation minimum emerges that holds regardless of the specific funding directive. The list below is not exhaustive, but it names the points whose absence leads to objections in almost every audit.
First: time records with project and work package attribution, kept contemporaneously — not retrospectively — and confirmed by the employee. The AGA puts this as "reliable records" linked to the "declared time"; for Horizon Europe daily granularity is not strictly required, but at least monthly reconciliation is effectively indispensable to close the annual productive hours calculation[3].
Second: a complete payroll and salary journal for the whole calendar year for everyone involved in the project, including the breakdown of social security contributions, the income tax certificate and evidence of additional remuneration. Without the full-year picture, the daily or hourly rate under simplification decision C(2022) 9700 cannot be reconstructed in an audit-proof way[10].
Third: absence documentation — records of leave, sickness and other time off. These are the single most frequent cause of hourly rate corrections, because failing to account for those days artificially raises productive hours and thereby lowers the hourly rate[2].
Fourth: procurement and tendering documentation for material costs and subcontracts. For federal grants, the procurement rules in ANBest-P no. 3 apply; within the Horizon Europe framework, the AGA's best-value-for-money procurement requirements[6][3]. Quotation and decision notes have to carry the reasons for the selection, not just the outcome.
Fifth: electronic retention in line with the principles for the proper keeping and retention of books, records and documents in electronic form (GoBD). Scanned or digitally originated vouchers have to be kept unalterable, machine-readable and accessible over the whole retention period[11]. A PDF folder without an index regularly fails the requirements; so does an HR or ERP system whose access was deactivated at the end of the project.
Sixth — frequently underestimated — the technical chain of evidence tied to the project and work package: the content the declared hours were actually spent on. Lab notebooks, git history with project-related commits, ticket history from Jira or comparable systems, versions of the deliverables, design and review minutes. In a technical review this is the basis; in a financial audit it is the last resort when the attribution of an hour to a work package is disputed.
What an audit finding actually triggers
An audit finding is not a penalty — not at first. The audit report records the deviations found, quantifies them and gives the audited applicant a contradictory phase in which to respond within a set deadline. Only once that phase closes does the report move to implementation[3]. The consequences depend on what kind of finding was made, and on what scale.
The standard consequence of a quantifiable error is proportionate recovery of the cost item concerned. An example: if staff costs for an employee were billed across three project years at an hourly rate 8 per cent too high, those 8 per cent are taken out of the assessment base and recovered in line with the funding rate. At typical funding rates between 50 and 100 per cent and staff budgets of several hundred thousand euros, recoveries in the mid five figures are no exception in practice.
On top of recoveries, Article 25 of the Horizon Europe AGA and the provisions that follow it provide for graduated sanctions: liquidated damages, exclusion from participation in further calls, referral to OLAF and — where fraud is suspected — referral to the European Public Prosecutor's Office[3]. In national funding, the parallel instruments of sections 48 et seq. of the Administrative Procedure Act (revocation of the grant notice) and section 44 of the Federal Budget Code apply[5].
The far more critical consequence is extrapolation. Where errors are systemic — that is, where the cause lies not in the audited project itself but in a consistently faulty process design — the finding is extrapolated to all the applicant's other projects within the period concerned and settled there too. An hourly rate error from one audited project can therefore trigger recoveries across a double-digit number of further projects in the same organisation, even though those projects were never the subject of the original audit[2]. The leverage of extrapolation is the main reason why systematic process design around staff costs is not just a compliance question but a matter of commercial risk management.
In time, the sequence follows a typical pattern. The audit is announced several weeks in advance. The audit visit — usually on site, increasingly remote as well — lasts from several working days to two weeks, depending on the size of the project. The draft report reaches the applicant a few weeks later; in Horizon Europe projects the contradictory phase is limited to 30 days[3]. Once the final report and the recovery demand are served, the payment period runs, usually 30 to 45 days. From announcement to payment, four to six months regularly elapse — a period in which complete, consistent and immediately available evidence makes all the difference between a manageable audit and an escalation.
From the platform perspective the conclusion is clear: funding management does not end with the approval, nor with the final payment, but with the expiry of the last applicable retention period. The body of documents that arises during the project anyway has to be filed so that it can be produced years later — without the people originally involved, without access to lapsed HR systems and without any reconstruction effort. upsmart bundles the chain of evidence from the employment contract through the time record to the proof of use, holds the links between personnel master data, payroll run, time record and work package in an audit-proof form, and makes every declared euro traceable across the whole audit period.
- [1]Annual reports on the 2023 financial year — chapter 5, "Single market, innovation and digital"European Court of Auditors (ECA) · 2024Open source
- [2]Special report 28/2018: The majority of simplification measures brought into Horizon 2020 have made life easier for beneficiaries, but improvements are still possibleEuropean Court of Auditors (ECA) · 2018Open source
- [3]AGA — Annotated Model Grant Agreement Horizon Europe, Art. 20 "Record-keeping" and Art. 25 "Checks, reviews, audits and investigations", V2.0 / 01.04.2025European Commission, Directorate-General for Budget · 2025Open source
- [4]Regulation (EU, Euratom) 2018/1046 of the European Parliament and of the Council of 18 July 2018 on the financial rules applicable to the general budget of the Union, Art. 132 "Record-keeping"Publications Office of the European Union, EUR-Lex · 2018Open source
- [5]Federal Budget Code (BHO), section 44 "Grants, administration of funds or assets"Federal Ministry of Justice, gesetze-im-internet.de · 2024Open source
- [6]General Ancillary Provisions for Grants for Project Funding (ANBest-P), no. 6 "Proof of use"Federal Ministry of Finance, annex 2 to administrative provision no. 5.1 to section 44 BHO · 2019Open source
- [7]Special Ancillary Provisions for grants from the Federal Ministry of Education and Research for project funding on an expenditure basis (BNBest-BMBF 98), no. 4 "Eligible expenditure"Federal Ministry of Education and Research, provided via BAFA · 2019Open source
- [8]Fiscal Code (AO), section 147 "Rules on the retention of documents"Federal Ministry of Justice, gesetze-im-internet.de · 2024Open source
- [9]Commercial Code (HGB), section 257 "Retention of documents; retention periods"Federal Ministry of Justice, gesetze-im-internet.de · 2024Open source
- [10]Commission Decision C(2022) 9700 authorising the use of unit costs for personnel costs under Horizon EuropeEuropean Commission · 2022Open source
- [11]Principles for the proper keeping and retention of books, records and documents in electronic form and for data access (GoBD), Federal Ministry of Finance circular of 28 November 2019 as amended on 11 March 2024Federal Ministry of Finance · 2024Open source
The de minimis trap: when one funding programme blocks the next
The €300,000 threshold counts across three tax years — and across group boundaries. How to stop application B devaluing application A.
Horizon Europe more burdensome than H2020 — the interim evaluation in detail
32% of participants find Horizon Europe more burdensome than H2020, 48% report admin costs above 10%. What the EU documents itself.
Staff changes in the innovation team: 5 questions about keeping the knowledge
Before the innovation manager leaves: what has to be documented so that applications, evidence and audit trails don't leave with them?
From the analysis into the application.
We show the platform on a real case.