HR-Glossar
ITSG-Zertifizierung (ITSG system audit for payroll software)
What the ITSG system audit means, why it is the precondition for German social security reporting and what to watch when choosing software.
1. What is ITSG-Zertifizierung (ITSG system audit for payroll software)?
The ITSG certification – more precisely, the system audit – is the proof that a payroll program meets the requirements of the social security reporting procedure. It is carried out by the Information Technology Service Centre of the statutory health insurance funds (ITSG) on behalf of the social security institutions.
Its practical significance is unusually far-reaching: only audited programs may take part in the reporting procedure. A payroll program without a system audit may calculate as well as it likes – it may not submit notifications. Businesses with no audited program of their own are left with the approved data entry aid, the social security reporting portal, or a service provider. For a group consolidating onto one global HR platform, this is regularly the point at which Germany does not fit.
The basis is the common principles under Section 28b SGB IV. What is audited is whether the program produces the prescribed data records correctly, reflects contribution calculation and reporting reasons properly, and transmits in conformity with the rules. The audit is not a one-off: because calculation figures, reporting reasons and procedural rules change annually, it has to be renewed regularly.
To be distinguished from this is the transmission certificate, with which the employer authenticates itself when sending. Both are needed and they are not the same thing.
2. Origin and development
When the reporting procedure moved to electronic transmission, a question arose: how do you ensure that millions of data records from hundreds of programs are built uniformly and correctly? The answer was the system audit – quality assurance in advance instead of error correction afterwards.
For the software landscape that had a considerable effect: it has limited the number of providers and set the barrier for newcomers high. For businesses it means reliability – and a choice restricted to a defined set of audited products.
3. Core principles and how it works
A condition of participation, not a distinction
No system audit, no reporting procedure. It is not a quality badge but the entry ticket.
Regular renewal
Because calculation figures and procedural rules change, the audit recurs.
The program and the transmission certificate are two things
One concerns the software, the other authentication when sending.
The data entry aid as an alternative
Businesses with no audited program of their own report through the social security reporting portal – or through a service provider.
Responsibility stays with the employer
An audited program relieves technically, not legally. The business is responsible for the correctness of the data.
4. Who is ITSG-Zertifizierung (ITSG system audit for payroll software) relevant for?
- Businesses choosing software – the system audit is an exclusion criterion, not an extra feature. - Payroll – they work within this frame every day. - IT leads – certificates and transmission routes sit with them. - Payroll service providers – for them the audit is the basis of the business.
5. How it differs from related terms
- System audit and DEÜV – the DEÜV governs the procedure; the system audit establishes that a program complies with it. - System audit and transmission certificate – software against authentication. - System audit and certification of payroll service providers – individual procedures have their own approvals; they are not the same as the audit of the program. - System audit and general software certificates – ISO certificates or test marks say nothing about participation in the reporting procedure.
6. Variants and adaptations
- An audited payroll program – the standard case in businesses running their own payroll. - The approved data entry aid – the social security reporting portal, for businesses with no program of their own. - Payroll through a service provider – its program is audited; the business needs none. - Additional procedures – individual electronic procedures have their own audits and approvals.
7. Advantages and challenges
Advantages
- Uniform, machine-checkable data records across all employers
- Whole classes of error are excluded before they arise
- A reliable basis for businesses choosing software
- Legal changes arrive through program updates
Challenges
- It limits the choice to audited products
- In-house development is practically ruled out
- The cost of the audit is reflected in software prices
- Delayed updates at the provider have an immediate effect on the business
- The audit says nothing about usability or functional depth
8. Best practices for implementation
Treat the system audit as an exclusion criterion
In choosing software this is not a matter of weighting but of pre-selection.
Check the provider's update cycle
How quickly do legal changes arrive? At the turn of the year that is the decisive point.
Monitor certificate validity
An expired transmission certificate stops submissions – however good the software is.
With outsourced payroll, ask
Which audited program is used, and how are legal changes applied?
9. Tips for employers and employees
For employers
- **No system audit, no notifications** – this is not a comfort feature but a precondition
- **In-house development is not an option** – not for the reporting procedure, at least
- **Responsibility for the data stays with you** – an audited program checks the format, not your input
For employees
- **The audit protects your entitlements indirectly** – it ensures notifications arrive correctly built
10. Conclusion
The ITSG system audit is not a distinction but the entry ticket to the German social security reporting procedure: without it a program may not report. For businesses that means a clear pre-selection of software – and a question that matters more in choosing than the audit itself: how quickly the provider applies the annual legal changes.
For a group planning to consolidate onto one global HR platform, this is the point where Germany regularly does not fit: a platform without a system audit may run the calculation but may not submit the notifications, and in-house development is practically ruled out. What the audit does not take away is responsibility for the correctness of one's own data.
Sources
- Section 28b SGB IV – Common principles for notifications and contribution statements (German original; no official English version) (opens in a new tab)
- Section 1 DEÜV – Scope (German original; no official English version) (opens in a new tab)
- System audit of payroll programs (opens in a new tab)
Related terms
Our promise
Software supports. People take responsibility.
Let us talk about your payroll – no strings attached, specific, and with a dedicated contact from day one.