Paperless Checklist

But before investing — there are 10 things agency executives should know. Without this knowledge, you may pick a system that "works" but "can't be proven" — which becomes a serious problem when documents need to serve as evidence in court or pass an audit by the Office of the Auditor General (OAG).

This article is a checklist drawn from over 20 years of experience implementing ERP systems for Thai government agencies, designed to help executives, procurement teams, and IT teams make the right paperless decision from the start.

10 Checklist Items for Paperless That Actually Works

✓ Checklist #1: Know the 2 Levels of Paperless

Many projects in Thailand "do paperless" without distinguishing which level — leading to problems in real use.

Level 1: Operational Paperless

• Reduce printing, sign online via mobile/app
• Send documents via email / workflow system
• Goal: faster, easier, less paper cost
• Legal standing depends on implementation — may not have legal force equivalent to paper

Level 2: Legally-Binding Paperless

• Digital documents with legal force equivalent to signed paper
• Retainable for the legally-required period (e.g., 10 years)
• Usable as evidence in court and during OAG audits
• Verifiable by external parties

Key question: Which level does the agency's project need? Budget and implementation time differ significantly. If Level 2 is required, tell vendors from the start.

✓ Checklist #2: Understand the Thai Laws Paperless Must Comply With

Government paperless must comply with multiple layers of laws and regulations — not just one.

Layer	Law / Regulation	Key Points
1	Electronic Transactions Act B.E. 2544	Sections 7-9 recognize electronic messages and signatures
2	Royal Decree on Secure Methods for Electronic Transactions B.E. 2553	Defines 3 levels of electronic signatures
3	Office of the PM Regulation on Document Management (No. 4) B.E. 2564	Recognizes electronic document systems + retention periods
4	MoF Regulation on Treasury Withdrawals B.E. 2562	Supports electronic disbursement documents
5	Government Procurement and Supplies Management Act B.E. 2560	Procurement docs must be retained 10 years and auditable
6	Internal agency regulations	Must issue regulations supporting paperless and electronic signatures

Common pitfall: Many agencies buy the system but don't issue supporting internal regulations — making the system usable in practice but missing legal foundation at the organization level. When OAG asks for the regulation document — there is none.

Key question: Does the vendor's system comply with all 6 layers? Do they provide internal regulation templates for the agency to issue?

✓ Checklist #3: Verify the Signature Level the System Uses

Not all signatures in PDF are equal — there are 4 standard levels + 1 non-standard level.

Level	Name	Properties	Retention
✗	Visual Signature	Signature image pasted on PDF, no cryptographic basis	No value
✓	PAdES B-B (Basic)	PKCS#7 + Cert chain	Per cert lifetime (1-3 years)
✓	PAdES B-T (+Timestamp)	+ TSA token from authority	2-5 years
✓	PAdES B-LT (+Long-Term)	+ CRL/OCSP embedded	10+ years
✓	PAdES B-LTA (+Archive)	+ Renewable archive timestamp	Unlimited

Common misconception: Many agencies think "the system shows a signature image in PDF, so paperless is complete" — but Visual Signature is the lowest level and cannot prove integrity.

Key question: Which level does the system use? Is it suitable for the document retention period required?

✓ Checklist #4: Know the Retention Period for Each Document Type

Before choosing the signature level, know how long each document type must legally be retained.

Document Type	Retention	Legal Basis
Accounting documents	10 years	Revenue Code Section 87
Tax invoices	10 years	Revenue Code Section 87/3
Government procurement	10 years	Procurement Act 2017
General contracts	10 years	Civil & Commercial Code Sec.193/30
Lease contracts	Lease term + 10 years	Civil & Commercial Code
Board meeting minutes	Permanent	Public Organization Act
Labor documents	2-5 years	Labor Protection Act
AML/KYC documents	10 years	AMLO Act

Why 10 years? This isn't a random number — it's the longest statute of limitations under Civil & Commercial Code Section 193/30. Within 10 years, anyone can sue you, and you must have evidence to prove your case in court.

5 scenarios requiring old documents:

1. OAG audit — requesting documents 5-10 years back
2. Revenue Department audit — taxes back 5 years (sometimes 10 years)
3. Litigation — 10-year statute of limitations
4. Internal board audit
5. M&A or audit by donors / sponsors

Key question: Which signature level should each document type use? Does the system support automatic retention policy by document type?

✓ Checklist #5: Verify the Signer's Identity

Good paperless must answer "who signed" reliably — not just "whose account pressed the button".

Identity Assurance Level:

Level	Method	Best For
Low	Username/Password	General internal systems
Medium	Username + OTP (MFA)	General administrative documents
High	ThaID (DGA Digital ID, IAL 3)	Important government documents
Highest	NDID	Important financial transactions

Things to check when an executive signs:

• Does the system re-authenticate at signing? Or just rely on the login session?
• Is there biometric or OTP confirmation before signing?
• Is IP, device, geolocation logged at signing?

Key question: When the executive presses sign, does the system re-authenticate? If not — the signed document will struggle to prove Sole Control in court.

✓ Checklist #6: Verify the Certificate Authority

The cert used to sign documents must come from a CA recognized by ETDA — otherwise the document may not meet standards.

ETDA-recognized CAs (in Thailand):

• Thailand National Root CA - G1 (NRCA) — operated by ETDA
• INET CA - G1 — Internet Thailand
• TDID CA — Thailand Digital ID
• Others on the ETDA Trust List

Correct Trust Chain structure:

Key question: Request the system's Certificate chain. Verify the chain in Adobe Acrobat — if the Root CA isn't NRCA or an ETDA-recognized CA, the document may have legal-evidence problems.

✓ Checklist #7: Does the System Support Long-Term Validation?

Long-Term Validation (LTV) is the ability to verify a signature even after the certificate has expired.

Why this matters:

Certificates typically last 1-3 years, but accounting and procurement documents must be kept 10 years — creating a gap that can render documents unverifiable.

Example scenario:

Techniques to fix:

• PAdES B-LT: embed CRL/OCSP responses in PDF
• PAdES B-LTA: + archive timestamp renewable every 3-5 years

Key question: Does the system use PAdES B-LT or B-LTA? Request a demo opening a sample document whose cert has expired — if it still verifies = the system genuinely supports LTV.

✓ Checklist #8: Audit Trail That Can Be Verified Retrospectively

Good paperless must record every action on a document — from creation, edit, forwarding, to signing — and store it tamper-proof.

Audit Trail must capture:

• Who signed (user ID + role)
• When (timestamp to the second)
• From which IP / Device / Location
• Through what workflow path
• How many times was the document edited, by whom

Techniques used:

• Hash chain — link logs together blockchain-style; any tampering breaks the chain
• Append-only logs — additions only; no edits/deletes, even by admin
• Tamper-evident storage — detect any modifications

Key questions:

• How many years can the system retain audit log?
• Can system admins delete/edit logs? (Correct answer: no)
• How is log integrity verified?

✓ Checklist #9: Have Internal Regulations Ready

No matter how good the system is, it can't be used fully without supporting internal organizational regulations — this is where many paperless projects fail.

Regulations the agency must issue or update:

1. Regulation on the use of the agency's electronic document system
2. Regulation on electronic signatures (specifying which document types use which level)
3. Authority Matrix announcement (approvers by amount and document type)
4. SOPs for each user role
5. Business Continuity Plan (BCP) when the system is down

Key questions:

• Does the vendor help prepare regulation and announcement templates? Or must we do it ourselves?
• Are there reference examples from other agencies that have deployed?

✓ Checklist #10: Public Verification — Outsiders Can Verify

Documents from government agencies — outsiders must be able to verify them.

Examples requiring external verification:

• Vendors receive quotations → want to verify authenticity
• Revenue Department audits documents the agency issues
• Courts accept as evidence → judges need to verify
• Citizens checking agency transparency
• Independent auditors needing verification

What the agency should have:

Key questions:

• Does the agency have or plan a Public Verification Portal?
• If yes — does it disclose how it works so outsiders can trust it?
• Can it use open standards like Adobe Acrobat verify directly?

5 Risks If Paperless Doesn't Pass the Checklist

If the paperless system fails to pass the above checklist completely — these are the risks when documents must serve as actual evidence:

Risk 1: Documents Fail in Court

Scenario: A vendor breaches a contract; the agency sues and submits the digital contract as evidence.

What may happen:

• The opposing party argues "didn't sign" or "document was modified"
• Court asks for proof of identity, timestamp, integrity
• System with only Visual Signature has no proof of any of the 3
• Evidence may be rejected

Impact: Lose the case despite having a contract.

Risk 2: OAG Audit Fails

Scenario: OAG audits disbursements and requests approval documents from previous years.

What may happen:

• Open PDF → signature yellow/red (validity unknown)
• Request paper original → none (it's paperless)
• Audit note: documents incomplete
• Affects agency rating

Impact: Time wasted explaining; budget may be reclaimed; executives must take responsibility.

Risk 3: Documents Lost with Technology

Scenario: Use vendor X's signing system — in 2027, vendor goes out of business.

What may happen:

• System closed, cannot verify documents
• Vendor's cloud server deletes data
• Vendor-specific format unreadable elsewhere
• Documents become "files that open but cannot be proven"

Impact: Total evidence loss — vendor lock-in destroys long-term value.

How to avoid: Use systems built on open standards (PAdES, X.509, RFC 3161), not proprietary formats.

Risk 4: Criminal Corruption Cases — System Becomes a Weakness

Scenario: An executive is sued for approving an unlawful document.

What may happen:

• Executive denies "didn't sign — the app signed automatically"
• System has no proof of identity, intent, sole control
• Executive escapes liability → must hunt for who actually signed
• Agency loses opportunity to pursue the corrupt party

Impact: The system becomes a weakness in corruption investigation, not a safeguard.

Risk 5: Documents Expire Before the Legally-Required Period

Scenario: Accounting documents must be kept 10 years per law, but the system signs with a 2-year cert.

Timeline:

Impact: Documents retained per law but cannot be proven — kept for nothing.

Questions to Ask Vendors Before Signing the Contract

Compiled 10 questions from all the checklists that procurement and IT teams should ask vendors before deciding:

Identity & Authentication

1. What Identity Provider does the system use? At what IAL must signers verify?
2. Does the system re-authenticate at signing time? Or rely on login session?

Cryptographic Signature

3. What signature type does the system use — Visual Signature, PAdES B-B, B-T, B-LT, or B-LTA?
4. From which CA is the Certificate? Is it ETDA-recognized?
5. Does the trust chain go up to Thailand's Root CA (NRCA)?

Long-term

6. If the cert expires, can the previously-signed documents still be verified?
7. Does the system support 10-year document retention per the Document Management Regulation (No. 4) B.E. 2564?
8. Is there an Archive Timestamp that auto-renews?

Verification

9. What does opening a signed document in Adobe Acrobat look like? (Request a live demo)
10. Does the system have a Public Verification Portal for outsiders to verify?

Vendor answers to be wary of

• ❌ "Our signatures are safe — we use AES-256" → AES is encryption, not signature
• ❌ "Once signed, verifiable forever" → without specifying PAdES profile = probably untrue
• ❌ "Our system is better than competitors" → request technical proof against international standards

Roadmap for Complete Paperless

Achieving paperless that passes all 10 checklists takes 12-18 months, in 5 phases:

Phase	Duration	Scope
Phase 1: Foundation	1-2 months	Issue internal regulations, procure CA Certificate, define Authority Matrix, integrate with ThaID
Phase 2: Core Workflow	3-5 months	Document workflow engine, approval routing, budget reservation, user roles
Phase 3: Cryptographic	4-6 months	PAdES implementation, TSA integration, LTV/Archive Timestamp, multi-sign workflow
Phase 4: Audit & Verification	2-3 months	Hash chain audit log, public verification portal, evidence bundle, compliance report
Phase 5: Migration & Training	3-6 months	Migrate old documents, train users, pilot rollout, full deployment

Note: If a vendor says "deliverable in 3 months", verify what's included — it likely covers only Phase 1-2, which is Operational Paperless, not Legally-Binding Paperless.

Action Items for Today

For agency executives and procurement teams:

1. Use the 10-item Checklist to evaluate the paperless project under consideration — if vendors can't answer fully, request more information before deciding
2. Audit documents already signed paperless — open old PDFs in Adobe Acrobat, see if signatures are still valid; yellow/red = problems to fix
3. Talk to legal and internal audit teams — use this checklist to identify gaps in system and regulations
4. Review current vendor contracts — do they cover all 10 items? Is there an SLA for long-term verification?
5. Plan upgrades aligned with budget cycles — gradually raise the level based on document importance

Closing

Good paperless isn't just functional — it must hold up in court, in the boardroom, and during OAG audits.

- Saeree ERP Team

Investing in a government paperless system is a decision with 10+ year impact, because today's signed documents are tomorrow's evidence.

Choose a system passing all 10 checklists from the start — and the agency will have a system that works, can be relied upon, and stands the test of time. Choose a system missing some items — you may save budget today but face risks the day documents must serve as evidence, a day there's no going back to fix.

About Saeree ERP

Saeree ERP by Grand Linux Solution develops ERP systems supporting paperless across all 10 checklist items for government agencies, with a roadmap to Long-Term Archive (PAdES B-LTA) for 10+ year retention. Currently implementing PAdES B-B with INET-CA Trust Chain proven for over 5 years in government deployments, upgrading to PAdES B-LTA in 2026 — the highest current PAdES standard, with continuous evolution as standards improve.

Related articles: What Is Digital Signature? and What Is 2FA? Why 2-Factor Authentication Matters

Summary of 10 Checklist Items

#	Topic	Key Question
1	Know 2 Levels of Paperless	Operational or Legally-Binding?
2	Relevant Thai Laws	Comply with all 6 layers?
3	Signature Level	Visual / B-B / B-T / B-LT / B-LTA?
4	Document Retention	How long for each type?
5	Signer Identity	ThaID / NDID / MFA?
6	Certificate Authority	NRCA / ETDA-approved CA?
7	Long-Term Validation	Verify even after cert expires?
8	Audit Trail	Tamper-evident, append-only?
9	Internal Regulations	Supporting regulations issued?
10	Public Verification	Can outsiders verify?

This article was prepared from over 20 years of experience implementing ERP systems for Thai government agencies by the Grand Linux Solution team. For paperless consulting at your agency, contact sale@grandlinux.com or 02-347-7730.