Auditable leasing: What constitutes a standardized process

Problem: Many property managers are unable to seamlessly substantiate their leasing process to third parties because documentation, signatures, and data storage are scattered across folders, inboxes, and individual minds.

Cause: The procedure depends on the diligence of individual employees rather than a process design that defines and logs verification checks at the right moment.

Thesis: A leasing process only becomes auditable through four fundamentals: audit-proof documentation, signature compliance according to Section 126a of the German Civil Code (BGB), GDPR-compliant data storage, and release processes at compliance checkpoints.

What constitutes an auditable leasing process

Direct answer: An auditable leasing process documents every step in a traceable manner, defines clear responsibilities, and ensures that decisions do not depend on individuals. It meets four criteria: documentation depth (audit-proof capture), signature compliance (Section 126a BGB), GDPR-compliant data storage, and approval workflows at compliance checkpoints (energy certificate details prior to listing, rent cap disclosures prior to the tenant's contractual declaration, sanctions list screening prior to contract conclusion).

What “standardized” really means

Standardization in the industry is often equated with uniformity: all teams use the same tenancy agreement, the same template, the same checklist. This is a necessary first step, but not a sufficient one.

An auditable process meets three conditions that go beyond formal uniformity.

2.1 Reproducibility. Every person who enters this process executes the exact same procedure, regardless of prior experience, length of service, or day-to-day form. This is not achieved through training alone, but through a process design that does not permit alternative routes in the first place.

2.2 Third-party auditability. An auditor, an investor, or a data protection authority can understand the documentation without needing someone from the company present to explain it. If traceability requires the presence of insiders, the process is not auditable, merely explainable.

2.3 Independence from individuals. Illness, resignation, and holiday absences must not cause a process breakdown. Knowledge and responsibility must reside in the system, not in the heads of individual employees. How this can be structurally achieved is described in Spoke A7.

The precise difference between a documented and a standardized process is explained in the first question of the FAQ section at the end of this article.

Why auditable processes are no longer optional today

Three developments have turned process quality in property management from a nice-to-have into a competitive factor.

Cost pressure and employee turnover. According to the 2025 VDIV Industry Barometer, 70 percent of property managers feel overburdened by day-to-day operations. 98 percent expect an ever-increasing need for team qualification. When long-standing employees leave the company and their knowledge was stored exclusively in their heads, gaps emerge that manifest as liability-relevant errors during audit situations. Processes that depend on individual persons are processes on borrowed time.

Investor requirements. Institutional owners now only mandate property managers who can demonstrate property-level reporting, traceable process documentation, and audit capability. An informally managed leasing process structurally excludes certain client groups. More on this in Section 5 and Spoke A5 on institutional owners.

Regulatory tightening. The obligations triggered by a leasing process have grown significantly in recent years: mandatory energy performance certificate details in listings according to Section 87 GModG, rent cap and disclosure obligations according to Section 556g (1a) BGB, sanctions list screening pursuant to EU Regulation 269/2014, and data protection-compliant credit checks under GDPR, as outlined in the DSK guidance (V2.0, January 2026). Those who do not systematically integrate these checkpoints into their workflow rely on individual attention rather than system design.

How this pressure affects the overall optimization of the leasing procedure is shown in the cornerstone article Optimizing the leasing process. For an additional perspective on how efficiency and process quality are linked in daily practice, see Increasing efficiency in property management.

The four fundamentals of an auditable process

a. Audit-proof documentation

The term “audit-proof” (revisionssicher) is derived from the GoBD (BMF circular on the principles for the proper management and storage of books, records, and documents in electronic form). Audit-proof means: stored unalterably, complete, traceable in origin, and machine-readable.

For everyday leasing operations, this specifically means: A scanned PDF in a local folder does not meet these requirements. Neither does an email thread with a contract attachment. Storing leasing records in an audit-proof manner requires a central repository where every version is kept with its date and nothing is overwritten.

GDPR Art. 5(2) (Accountability) and Art. 24 (Responsibility of the controller) further require that property managers not only act correctly, but are also able to demonstrate this at any time. The burden of proof rests with the controller, not the supervisory authority. Spoke A4 covers the GoBD and GDPR documentation requirements in detail.

b. Signature compliance

Not every tenancy agreement requires a qualified electronic signature (QES). However, for certain contract types, it is mandatory by law because the written form or its electronic equivalent is required.

Section 126a BGB defines electronic form as equivalent to the written form, provided a QES is used. This is relevant in the following scenarios:

• Fixed-term tenancy agreements under Section 575 BGB: The term clause requires the written form. When processed digitally, a QES is therefore mandatory.

• Stepped rent agreements under Section 557a BGB: subject to formal written requirements.

• Index-linked rent agreements under Section 557b BGB: likewise bound to the written form.

The QES makes the signature legally secure in these scenarios pursuant to Section 126a BGB. A simple or advanced electronic signature is not sufficient here. Deploying digital processes without verifying the signature requirements of the respective contract types creates a systematic compliance risk. Spoke A3 explains the distinction between signature types and when each type is required in the leasing context.

c. GDPR-compliant data storage

A leasing transaction generates a substantial volume of personal data: ID copies, credit reports, SCHUFA data, income statements, self-disclosure forms. GDPR Art. 30 mandates a record of processing activities for these operations. Art. 32 requires technical and organizational measures appropriate to the processing risk.

The practical problem: Many property managers use isolated point solutions. Documents sit on various employees' local hard drives or in email inboxes. A consistent deletion concept does not exist. During a data protection audit, it is impossible to demonstrate where specific data is located, how long it has been stored, or who had access to it.

The requirements of Art. 30 GDPR are not a theoretical risk: State data protection supervisory authorities have issued fines to companies in the real estate sector as well. Spoke A2 addresses the specific GDPR requirements for leasing processes.

d. Release workflows at compliance checkpoints

The critical element in process design is knowing when each check must occur. What matters is not just that all checks are carried out, but that they are embedded at the right moment in the workflow and that their results are documented.

Energy certificate data

• Timing: Prior to listing

• Obligation: Mandatory information in listings and exposés

• Legal basis: Section 87 GModG

Rent cap status and disclosure obligation

• Timing: Prior to contract signing

• Obligation: Verification of whether the rent cap applies; anyone relying on an exemption under Section 556e or Section 556f must proactively inform the tenant in text form before the tenant makes their contractual declaration; without this disclosure, the exemption cannot be invoked

• Legal basis: Section 556d, Section 556g (1a) BGB

Sanctions list check

• Timing: Prior to contract conclusion

• Obligation: Screening the prospective tenant against EU sanctions lists

• Legal basis: EU Regulation 269/2014, Section 18 AWG

Credit assessment

• Timing: Staged according to the stage of the procedure

• Obligation: Collect only the required data; the DSK guidance outlines up to three possible time intervals for this

• Legal basis: Art. 5(1)(c) and Art. 6 GDPR; Interpretation: DSK Guidance V2.0, January 2026

Every single one of these checkpoints must not only be performed, but also documented. “We always check that” is not an auditable statement. A dated record filed with the process is. Spokes A9, A10, A11, and A12 explore the legal requirements of the individual checkpoints in greater depth.

How auditable is your property management already? You can find the Compliance Maturity Check here: Compliance Maturity Check.

Checks in the system, not on a checklist

EverReal runs the leasing process in structured steps in one system. Instead of checklists that are ticked off by hand, checks are set up in EverReal. Starting with the Pro edition, you determine which checks must be completed for selected applicants prior to contract conclusion: sanctions screening, credit check (SCHUFA), and approval by an authorized user. As long as any of these are pending, “Start contract conclusion” remains locked. If the landlord invokes an exemption from the rent cap, EverReal guides the tenant through confirming the disclosure prior to the digital signature for contracts with the confirmation enabled; this confirmation is recorded with date and time in the contract audit log.

Anchoring checkpoints in the workflow

For property managers, this specifically means: The checks you define are part of the workflow, not a piece of paper sitting next to it. The knowledge of what must be checked and when resides in the system's process design, not in the clerk's head.

Translating requirements into process steps

EverReal is the digital foundation for 450+ real estate companies managing portfolios between 200 and 2,000 units. Individual leasing checks and approvals are mapped in EverReal. The result is a workflow that is reproducible and scales alongside the portfolio.

Conclusion

Anyone who cannot retrace their leasing process at all times and substantiate it to third parties does not have a compliance problem, but a system design problem. Documentation alone does not create auditability. Only when checkpoints are defined in the system, signatures are captured in compliance with the law, and data is stored in accordance with the GDPR does a process emerge that scales and withstands audits.

The retention periods under Section 257 of the German Commercial Code (HGB) (six years for business correspondence, eight years for accounting records, ten years for commercial books and annual financial statements) illustrate how long-lasting process decisions are: What is not cleanly documented today will be missing years later in a legal dispute or tax audit. The effort to build auditable processes is incurred once. The effort to cope without them is permanent.

Learn what the leasing process for your portfolio looks like in EverReal.

Request a demo | Discover system logic

What institutional owners demand today

The expectations of institutional owners regarding their property managers have fundamentally changed in recent years. Funds, insurance companies, and family offices manage properties subject to SFDR and CSRD reporting obligations. This means: They require data at the property level that goes far beyond traditional operating cost statements.

When awarding mandates, the following evidence is routinely expected: a documented process manual for new lettings, complete audit trails for all contract modifications, evidence of completed compliance training within the team, as well as system proof of sanctions list checks and credit screenings.

Property managers wishing to grow into this market segment must treat auditability not as an optional add-on, but as a foundational requirement. Informally run processes structurally exclude property managers from institutional client groups, often without this ever being explicitly stated. Spoke A5 covers the specific requirements of institutional owners and what property managers need to demonstrate to secure mandates.

All topics at a glance: The 12 spokes of the auditable leasing process

The following overview highlights all articles in this topic cluster. Each spoke explores an aspect relevant to an auditable leasing process in greater depth. Across all spokes, the anchor text “auditable leasing process” links back to this cornerstone article.

A1

• Article: Process standards in leasing

• Topic: Process standards

• Brief description: What property managers need to make workflows repeatable and auditable

A2

• Article: GDPR in the leasing process

• Topic: GDPR

• Brief description: Data protection requirements from prospect intake to contract conclusion

A3

• Article: Electronic signatures and QES in leasing

• Topic: Electronic signature / QES

• Brief description: When simple, advanced, or qualified electronic signatures are required

A4

• Article: Audit-proof documentation for property managers

• Topic: Audit-proof documentation

• Brief description: GoBD requirements, immutability, retention, and machine readability

A5

• Article: Institutional owners: Requirements for property management

• Topic: Institutional owners

• Brief description: SFDR, CSRD, and property-level reporting as prerequisites for mandate allocation

A6

• Article: Scalability in property management

• Topic: Scalability

• Brief description: How process design enables growth without a proportional increase in personnel effort

A7

• Article: People-independent processes in property management

• Topic: Independence from individuals

• Brief description: Why knowledge must reside in the system, not in the heads of individual employees

A8

• Article: Federal Court of Justice ruling on brokerage commission: What applies to property managers?

• Topic: BGH ruling on commission

• Brief description: What the ruling means for property managers providing letting services

A9

• Article: Rent cap: Obligations and documentation

• Topic: Rent cap

• Brief description: Scope, disclosure obligation, and documentation requirements under Section 556g BGB

A10

• Article: Energy performance certificates under GModG: What applies to property listings?

• Topic: Energy performance certificate GModG

• Brief description: Mandatory listing information under Section 87 GModG and risks of administrative fines in case of non-compliance

A11

• Article: Sanctions list check in leasing

• Topic: Sanctions lists

• Brief description: Screening pursuant to EU Regulation 269/2014 and Section 18 AWG: when, how, and with what proof

A12

• Article: Credit assessment: Applying the DSK multi-stage logic correctly

• Topic: Credit assessment

• Brief description: DSK Guidance V2 (January 2026) and its implications for the workflow

We do not provide legal advice. Property managers are best advised to clarify specific legal questions with a specialized attorney or their industry association (VDIV, IVD).

Q: What is the difference between a standardized process and a documented process?

A: A documented process describes how something should be done. A standardized process ensures that it is actually done that way, regardless of who handles the transaction. The decisive difference lies in reproducibility and system integration: standardized processes are designed so that deviations are prevented by the system or at least comprehensively logged. Documentation alone is not enough for auditability. A process is only auditable if a third party can fully trace it without the creator needing to provide explanations.

Q: When must I use a qualified electronic signature as a property manager?

A: A qualified electronic signature (QES) is always required by law whenever a contract is subject to the statutory written form requirement and is entered into digitally. Specifically, this applies to fixed-term tenancy agreements under Section 575 BGB, stepped rent agreements under Section 557a BGB, and index-linked rent agreements under Section 557b BGB. Under Section 126a BGB, a QES is considered the electronic equivalent of a handwritten signature. For open-ended tenancies without statutory written form requirements, a simple or advanced electronic signature is sufficient, provided there is no contractual written form clause.

Q: What do institutional owners expect from their property management in terms of process quality?

A: Institutional owners such as funds, insurance companies, and family offices are themselves subject to reporting obligations under the SFDR and CSRD. From their managers, they require property-level reporting, seamless audit trails for contractual amendments, and verifiable compliance records for sanctions screenings and credit checks. When awarding mandates, a documented process manual and proof of system-supported compliance checks are commonly expected. Property managers lacking auditable processes structurally shut themselves out of this market segment.

Q: How long do I need to retain tenancy records?

A: Retention periods depend on the nature of the specific document. Commercial correspondence such as contractual records and letters must be retained for six years pursuant to Section 257 HGB. Accounting vouchers, operating cost statements, and receipts have been subject to an eight-year retention obligation since 1 January 2025 (Section 257 (4) HGB, Section 147 (3) AO). A ten-year period applies to commercial books, inventories, and annual financial statements. The period begins at the end of the calendar year in which the document was created or the commercial letter was received or sent (Section 257 (5) HGB). At the same time, GDPR erasure obligations apply as soon as the processing purpose ceases to exist, such as when a tenancy has ended and no further claims remain. A legally compliant deletion concept must coordinate both sets of obligations.