Auditable leasing: What constitutes a standardized process

Problem: Many property management companies cannot fully verify their leasing process to third parties because documentation, signatures, and data storage are scattered across folders, inboxes, and individuals' heads.

Cause: The workflow depends on the diligence of individual employees rather than a process design that enforces and logs checks at the right moment.

Thesis: A leasing process only becomes auditable through four fundamental pillars: audit-proof documentation, signature compliance according to §126a BGB, GDPR-compliant data storage, and approval processes at compliance checkpoints.

What constitutes an auditable leasing process

Direct answer: An auditable leasing process documents every step traceably, establishes clear responsibilities, and ensures that decisions do not depend on individuals. It fulfills four criteria: depth of documentation (recorded in an audit-proof manner), signature compliance (§126a BGB), GDPR-compliant data storage, and approval processes at compliance checkpoints that ensure no lease agreement is concluded without energy performance certificate data, a rent control check, and a sanctions list screening.

What “standardized” really means

Standardization is often equated with uniformity in the industry: all teams use the same lease agreement, the same template, the same checklist. That is a necessary first step, but not a sufficient one.

An auditable process fulfills three conditions that go beyond formal uniformity.

2.1 Reproducibility. Every person who enters this process executes the exact same procedure, regardless of prior experience, tenure, or daily form. This cannot be achieved through training alone, but through a process design that does not permit alternative paths in the first place.

2.2 Third-party auditability. An auditor, an investor, or a data protection authority can follow the documentation without requiring someone from the company to stand by and explain it. If traceability requires the presence of insiders, the process is not auditable, merely explainable.

2.3 Independence from individuals. Illness, resignation, and holiday absences must not cause a process breakdown. Knowledge and responsibility must reside within the system, not in the heads of individual employees. How to establish this structurally is described in Spoke A7.

The exact difference between a documented and a standardized process is explained in the first question of the FAQ section at the end of this article.

Why auditable processes are no longer optional today

Three developments have turned process quality in property management from a nice-to-have into a competitive factor.

Cost pressure and staff turnover. According to the VDIV Industry Barometer 2025, 70 percent of property managers feel overburdened by day-to-day operations. 98 percent expect an increasing need for qualification within the team. When long-standing employees leave the company and their knowledge was stored exclusively in their heads, gaps emerge that become visible as liability-relevant errors during audit situations. Processes that depend on individual people are processes on borrowed time.

Investor requirements. Today, institutional owners only hire property managers if they can demonstrate property-level reporting, traceable process documentation, and audit readiness. An informally managed leasing process structurally excludes certain client groups. More on this in Section 5 and Spoke A5 on institutional owners.

Regulatory density. The obligations triggered by a leasing process have grown significantly in recent years: mandatory energy certificate disclosures in advertisements under §87 GModG, rent control limits and disclosure requirements under §556g (1a) BGB, sanctions list screening under EU Regulation 269/2014, and data-protection-compliant credit checks under DSK Guidance V2 (January 2026). Those who do not systematically integrate these checkpoints into their workflow are relying on individual attentiveness rather than system design.

How this pressure affects the overall optimization of the leasing workflow is illustrated in the cornerstone article Optimizing the leasing process. For insights into how efficiency and process quality are linked in day-to-day operations, Increasing efficiency in property management offers a supplementary perspective.

The four fundamentals of an auditable process

a. Audit-proof documentation

The term “audit-proof” (revisionssicher) is derived from the GoBD (principles for the proper keeping and storage of books, records, and documents in electronic form issued by the German Federal Ministry of Finance). Audit-proof means: stored immutably, complete, traceable in its creation, and machine-readable.

In day-to-day leasing operations, this specifically means: A scanned PDF in a local folder does not meet these requirements. An email thread with a contract attachment does not either. Anyone storing leasing records in an audit-proof manner requires a platform that logs changes, secures versions, and applies an immutable timestamp to documents.

Furthermore, GDPR Art. 5(2) (Accountability) and Art. 24 (Responsibility of the controller) demand that property management companies not only act correctly, but are also able to prove it at any time. The burden of proof lies with the controller, not the supervisory authority. Spoke A4 covers the GoBD and GDPR requirements for documentation in detail.

b. Signature compliance

Not every lease agreement requires a qualified electronic signature (QES). However, for certain contract types, it is legally mandatory because written form or its electronic equivalent is prescribed.

§126a BGB defines the electronic form as equivalent to the written form, provided a QES is used. This is relevant in the following scenarios:

• Fixed-term leases under §575 BGB: The term agreement requires written form. For digital execution, a QES is therefore required.

• Stepped rent agreements under §557a BGB: subject to statutory formal requirements.

• Index-linked rent agreements under §557b BGB: likewise bound to written form.

The QES makes the signature legally secure in these scenarios pursuant to §126a BGB. A simple or advanced electronic signature is insufficient here. Implementing digital processes without reviewing the signature requirements of the respective contract types creates a systematic compliance risk. Spoke A3 explains the distinctions between signature types and which type is required when in the leasing context.

c. GDPR-compliant data storage

A leasing transaction generates personal data on a considerable scale: ID copies, credit checks, SCHUFA records, proof of income, self-disclosure forms. GDPR Art. 30 mandates a record of processing activities for these operations. Art. 32 requires technical and organizational measures appropriate to the risk of processing.

The practical issue: Many property managers rely on siloed solutions. Documents sit with various employees on local hard drives or in email inboxes. A consistent deletion concept does not exist. During a data protection audit, it becomes impossible to prove where specific data is located, how long it has been retained, or who had access to it.

The requirements of Art. 30 GDPR are not a theoretical risk: State data protection authorities have repeatedly imposed fines on real estate companies. Spoke A2 covers the specific GDPR requirements for leasing processes.

d. Approval processes at compliance checkpoints

The critical point in process design is determining when which check must take place. What matters is not just that all checks are carried out, but that they are anchored at the right moment in the workflow and that their outcomes are documented.

Energy performance certificate data

• Timing: Prior to listing

• Obligation: Mandatory information in the advertisement and exposé

• Legal basis: §87 GModG

Rent control status and disclosure obligation

• Timing: Prior to contract signing

• Obligation: Verification whether rent control applies; anyone invoking an exemption under §556e or §556f must inform the tenant unsolicited in text form before the tenant enters into the contract; without this disclosure, the landlord cannot invoke the exemption

• Legal basis: §556d, §556g (1a) BGB

Sanctions list check

• Timing: Prior to lease conclusion

• Obligation: Screening of the prospective tenant against EU sanctions lists

• Legal basis: EU Reg. 269/2014, §18 AWG

Credit check

• Timing: After viewing

• Obligation: Tiered request following the DSK tiered logic

• Legal basis: DSK Guidance V2, January 2026

Each of these checkpoints must not only be carried out, but also documented. “We always check that” is not an auditable statement. A timestamped system log is. Spokes A9, A10, A11, and A12 explore the legal requirements of the individual checkpoints in greater depth.

How auditable is your property management already? You can find the compliance maturity assessment here: Compliance Maturity Assessment.

The system guides, not the checklist

A guided workflow system like EverReal structures the leasing process so that compliance checkpoints do not depend on the diligence of individual employees. Instead of manually ticked-off checklists, the system takes the lead: It requests missing documents and blocks subsequent steps until required checks are complete. This creates a complete audit trail that can be traced at any time without third-party intervention.

Anchoring checkpoints in the workflow

For property managers, this specifically means: no listing without energy certificate data, no contract dispatch without completed sanctions list screening, no signing step without documented credit checks in accordance with the DSK tiered approach. The knowledge of what must be checked and when resides in the system's process design, not in the administrator's head.

Translating requirements into process steps

EverReal is the digital foundation for 450+ real estate companies managing portfolios between 200 and 2,000 units. The guided workflow system translates the requirements of German tenancy law, the GoBD, and the GDPR directly into process steps. The result is a workflow that is reproducible, remains auditable, and scales alongside the portfolio.

Conclusion

Anyone unable to trace their leasing process at all times and substantiate it to third parties does not have a compliance problem, but a system design problem. Documentation alone does not create audit readiness. Only when checkpoints are enforced by the system, signatures are captured in compliance with the law, and data is stored in accordance with the GDPR does a process emerge that scales and withstands audits.

The retention periods under §257 HGB (six years for commercial correspondence, eight years for accounting records, ten years for commercial books and annual financial statements) show how long-lasting process decisions are: What is not properly documented today will be missing years later in a legal dispute or tax audit. The effort to build auditable processes is a one-off. The cost of operating without them is permanent.

Learn how EverReal guides the leasing process across your portfolio and ensures it is fully auditable.

Request demo | Explore system logic

What institutional owners expect today

The expectations institutional owners place on their property managers have fundamentally changed in recent years. Funds, insurance companies, and family offices manage real estate subject to SFDR and CSRD reporting obligations. This means: They require data at the property level that extends far beyond traditional utility billings.

When awarding management mandates, the following verifications are regularly expected: a documented process manual for new leases, complete audit trails for all contract modifications, proof of completed team compliance training, and system logs verifying sanctions list checks and credit checks.

Property managers wishing to expand into this market segment cannot treat audit readiness as an optional add-on; it must be established as a structural prerequisite. Informally managed processes structurally exclude property managers from institutional client groups without this ever being explicitly stated. Spoke A5 covers the specific requirements of institutional owners and what property managers must demonstrate to secure a mandate.

All topics at a glance: The 12 spokes of the auditable leasing process

The following table provides an overview of all articles in this topic cluster. Each spoke explores an aspect relevant to an auditable leasing process in greater detail. From all spokes, the anchor text “auditable leasing process” links back to this cornerstone article.

A1

• Article: Process Standards in Leasing

• Topic: Process standards

• Summary: What property managers need to make workflows repeatable and auditable

A2

• Article: GDPR in the Leasing Process

• Topic: GDPR

• Summary: Data protection requirements from prospective tenant capture to contract signing

A3

• Article: Electronic Signatures and QES in Leasing

• Topic: Electronic signature / QES

• Summary: When simple, advanced, or qualified signatures are required

A4

• Article: Audit-Proof Documentation for Property Managers

• Topic: Audit-proof documentation

• Summary: GoBD requirements, immutability, storage, and machine-readability

A5

• Article: Institutional Owners: Requirements for Property Management

• Topic: Institutional owners

• Summary: SFDR, CSRD, and asset-level reporting as prerequisites for mandate allocation

A6

• Article: Scalability in Property Management

• Topic: Scalability

• Summary: How process design enables growth without proportional staffing increases

A7

• Article: People-Independent Processes in Management

• Topic: Independence from individuals

• Summary: Why knowledge must reside in the system, not in the heads of individual employees

A8

• Article: Federal Court of Justice (BGH) Ruling on Broker Commission: What Applies to Property Managers?

• Topic: BGH ruling on commission

• Summary: What the ruling means for property managers providing leasing services

A9

• Article: Rent Control: Obligations and Documentation

• Topic: Rent control

• Summary: Scope of application, disclosure obligations, and documentation requirements under §556g BGB

A10

• Article: Energy Certificates under GModG: What Applies to Advertisements?

• Topic: Energy certificate GModG

• Summary: Mandatory disclosures in advertisements under §87 GModG and penalty risks for non-compliance

A11

• Article: Sanctions List Screening in Leasing

• Topic: Sanctions lists

• Summary: Screening according to EU Reg. 269/2014 and §18 AWG: when, how, and with what evidence

A12

• Article: Credit Check: Correctly Applying the DSK Tiered Logic

• Topic: Credit check

• Summary: The DSK Guidance V2 (January 2026) and its impact on workflow

We do not provide legal advice. Specific legal questions are best clarified by property managers with a specialized attorney or their industry association (VDIV, IVD).

Q: What distinguishes a standardized process from a documented process?

A: A documented process describes how something should be done. A standardized process ensures that it is actually executed that way, regardless of who handles the case. The critical difference lies in reproducibility and system anchoring: Standardized processes are designed so that deviations are prevented by the system or at least logged without gaps. For auditability, documentation alone is insufficient. A process only becomes auditable when a third party can fully trace it without explanations from the person who created it.

Q: When must I, as a property manager, use a qualified electronic signature?

A: The qualified electronic signature (QES) is legally required whenever a contract is subject to statutory written form and is concluded digitally. Specifically, this applies to fixed-term leases under §575 BGB, stepped rent agreements under §557a BGB, and index-linked rent agreements under §557b BGB. Under §126a BGB, the QES serves as the electronic equivalent of a handwritten signature. For open-ended tenancies without statutory written form requirements, a simple or advanced electronic signature suffices, provided there is no contractual written form clause.

Q: What do institutional owners expect from their property management regarding process quality?

A: Institutional owners such as funds, insurance companies, and family offices are themselves subject to reporting obligations under SFDR and CSRD. From their managers, they require property-level reporting, seamless audit trails for lease modifications, and traceable compliance records for sanctions list screenings and credit checks. During mandate tenders, a documented process manual and proof of system-supported compliance checks are frequently demanded. Managers without auditable processes are structurally excluded from this market segment.

Q: How long must I retain leasing records?

A: Retention periods depend on the nature of the respective document. Commercial correspondence such as contract documents and letters must be retained for six years pursuant to §257 HGB. Accounting vouchers, operating cost statements, and records serving as receipts have been subject to an eight-year retention period since January 1, 2025 (§257 (4) HGB, §147 (3) AO). Ten years apply to commercial ledgers, inventories, and annual financial statements. The retention period begins at the end of the calendar year in which the document was created or the commercial letter was received or dispatched (§257 (5) HGB). Concurrently, data protection erasure obligations under the GDPR apply as soon as the processing purpose ceases to exist—for instance, when a tenancy has ended and no further claims remain. A legally compliant deletion concept must reconcile both sets of statutory duties.