Keeping Records CRA’s presentation Whistler CGA conference in September 2006

Topics Electronic Commerce Audit Program Keeping Records Elements of a good electronic record keeping system Self Certification Software Initiative

CRA’s Electronic Commerce Audit Program Electronic Commerce Audit (ECA) provides computer related specialized audit services to support CRA in encouraging, assisting, verifying and investigating compliance with the legislation it administers Program has been around since the 1970’s

What We Do Business Systems Evaluations (larger Entities) Electronic Record Evaluations (SME) The ECAS analyses computerized business systems to identify data that is relevant to the audit so that the auditor can perform the audit in an efficient and effective manner. The ECAS will examine the taxpayers record keeping system for adequacy to our record keeping requirements. If inadequate then the taxpayer will be required to make changes. Computer Assisted Audits (CAA) The ECAS will obtain those files identified during the Record Retention Review from the taxpayer and prepare them for a transfer to the auditor. The ECAS and the auditor will use Computer Assisted Audit Techniques (CAAT’s) to analyze the data in order to determine compliance with CRA legislation.

 Owners are not concerned with historical records and as a result, prior versions of software are not maintained.  Electronic Point of Sale Systems and Internet based systems are becoming more widespread.  Software developers are focusing on future development, not concerned with looking backwards (newer versions can’t always read past records). Electronic record keeping issues:

 CRA auditors face on-going challenges in readily accessing readable electronic books and records: Deleted prior year data Changes in versions of software Upgrades to computer systems Perception that printed records suffice Electronic record keeping issues:

Electronic Record Keeping Issues and the SBAC 1. What are some of the challenges faced by small business regarding electronic record keeping and the requirements of tax legislation? 2. What can CRA do to assist the Small and Medium Enterprises category of businesses in reducing challenges they face related to electronic record keeping?

challenge faced by small business regarding electronic record keeping is primarily a lack of knowledge and awareness of CRA requirements education is important; to accomplish this, develop publications that use plain language and offer clear explanations different formats, including CRA notices of assessment sent to businesses, could be used to deliver the message CRA should focus on the benefit to the small business clients that they serve and who are ultimately responsible for the books and records work with software developers to ensure that minimum standards on electronic record keeping are taken into consideration when they are developing their products whether software is compliant with CRA standards should be transparent to their potential customers. (self certification) Electronic Record Keeping Issues and the SBAC

How do we get the message of proper record keeping out to taxpayers - Meetings with professional and industry associations - IC’s and GST Memorandums - Brochure created - T2 Notices of Assessment/ Reassessment short paragraph – start October for one year. - GST/HST summer newsletter - Work with the provinces - Create standards

Existing Publications Income Tax & GST books and records publications IC7810r3 GST memorandum 15.1 and 15.2 Last updated in 1998 to reflect retention of electronic records The electronic record keeping world has changed tremendously since then Accounting Systems have evolved POS systems are computerized and more complex Internet WEB based sales systems are prolific CRA ability to handle e-records has evolved

New and Revised Publications  Guides · RC4409 Keeping Records  GST/HST Memoranda Series · 15.1 General Requirements for Books and Records · 15.2 Computerized Records  Information Circulars · IC78 ‑ 10 Books and Records Retention/Destruction · IC05-1 Electronic Record Keeping These publications are available at

Keeping Records Records include:  Accounting and other financial information Including all ledgers, journals, statements, accounts, source documents, correspondence, charts, tables etc. (traditional paper documents/reports)  Electronic accounting systems, point of sale systems, internet based systems, electronic purchasing and restocking systems, tax return preparation software, etc. ( s, log files, system files, transactions data files etc.)

Keeping Records Where and for how long ?  Your records must be kept at your place of business or at your residence in Canada, unless we give you permission to maintain them at a different location  Must be kept in either English or French.  Must be retained for a period of six years from the end of the last tax year to which they relate, unless permission to destroy them is obtained from the Canada Revenue Agency (CRA).

Keeping Records Adequate Books and Records contain:  Sufficient Information to enable determination of taxes payable or other amounts that should have been deducted, withheld or collected.  Information related to the audit trail to enable tracing of documents up to financial accounts.

Agency authority to audit The Agency may, at all reasonable time, inspect, audit or examine the books and records or any document of the taxpayer "record" "record" includes an account, an agreement, a book, a chart or table, a diagram, a form, an image, an invoice, a letter, a map, a memorandum, a plan, a return, a statement, a telegram, a voucher, and any other thing containing information, whether in writing or in any other form;

Excerpts GST Memorandum 15.2 Electronic record keeping refers to those electronic business systems that create, process, store, maintain and provide access to a person’s financial records. It includes but is not limited to custom and commercial accounting software, Point of Sale systems and Internet based electronic commerce. (1) Similar in IC05-1

Excerpts GST Memorandum 15.2 …..electronic commerce which can be broadly defined as the delivery of information, products, services or payments by telephone, computer, over the Internet or any other automated means. (4) An electronic record is any information recorded in an electronically readable format. (6)

Excerpts GST Memorandum 15.2, Para 6 of 15-2 Electronically readable format means, information supported by a system capable of producing accessible and useable copy. Accessible copy means that the person must provide a copy of the electronic records in an electronically readable and useable format to CRA auditors to permit them to process the electronic records on CRA equipment. A copy is useable if the electronic records can be processed and analysed with CRA software. The useable copy must be in a common data interchange format that is compatible with the CRA’s software. Electronic files retained in an encrypted or proprietary back-up must be able to be restored at a later date to an accessible and useable state are to meet the CRA’s requirements. Similar Para 7 of IC05-1

Excerpts GST Memorandum 15.2 Place of Retention …..businesses that operate via the Internet and that are hosted on a server located outside of Canada should be cognisant of their responsibility of maintaining their records within Canada. Person with Internet based businesses have the same responsibilities related to record retention as all other business operations. (16) Para 13 of IC05-1

Excerpts GST Memorandum 15.2 Third Party Service Providers A person who keeps records electronically is not relieved of any of the record keeping, readability, retention, and access responsibilities because the person contracts out the record keeping function to a third party such as a bookkeeper, accountant, Internet transaction manager, application service provider, an Internet service provider, through a time share, service bureau, or other such arrangements. (41) Working Papers Books and records may also be in the form of supporting documents (e.g., an accountant’s working papers), whether in writing or any other form, which assist in the determination of GST/HST obligations and entitlements. (42) Para 19 and 20 of IC05-1

Excerpts GST Memorandum 15.2 The person is responsible for ensuring that all electronic records are retained for the period of time specified by the Act, and that the required data in an electronically readable format is available to provide to the CRA auditors when requested. A good practice is to have the third party service provider furnish the person with an acceptable copy of the information required by the CRA in an electronically readable format. (43) Para 21 of IC05-1

Excerpts GST Memorandum 15.2 Audit Trail An audit trail, which is the information that is required to re- create a sequence of events, must include sufficient detail to substantiate summarized information. The electronic records must show an audit trail from the source document(s), whether paper or electronic, to the summarized financial accounts. In addition, the audit trail may include a number of links to other associated processes and events such as front-end systems (e.g., electronic commerce and point of sale), receipts, payments, and stock inventories, all of which may have their own system audit trails…….Internet-based electronic commerce transactions,…………………...web logs, s when used as part of the transaction (e.g. invoice and confirmations) or security measures such as digital signatures.(34) Para 36 of IC05-1

Excerpts GST Memorandum 15.2 Commercial and/or Customized Software A person who uses commercial and/or customized software to keep books and records electronically is not relieved of the responsibility to keep adequate electronic records because of deficiencies in the software. (40) Para 18 IC05-1

Excerpts GST Memorandum 15.2 Inspections, Audits and Examinations ……. Such examinations include the audit of electronic records and, as a part of providing reasonable assistance; registrants must allow CRA auditors access to their electronic records. (44) This access means that the registrant must provide an acceptable copy of the electronic records in an electronically readable and useable format to CRA auditors so that they can process the electronic records on CRA equipment. (45) Para 43 of IC05-1

Imaging 24. Imaging and microfilm (including microfiche) reproductions of books of original entry and source documents must be produced, controlled and maintained in accordance with the latest national standard of Canada as outlined in the publication entitled Microfilm and Electronic Images as Documentary Evidence (CAN/CGSB ).

Imaging Electronic image means the representation of a source document that can be used to generate an intelligible reproduction of that document. Policy and procedure relating to the imaging systems have to be at a high level as outlined in the standard. This high level means that the image should meet the best evidence rule in order to be possibly accepted in court. 26. Paper source documents that have been imaged in accordance with the latest national standard of Canada (see paragraph 24) may be disposed of and their images kept as permanent records.

Excerpts GST Memorandum To ensure the reliability, integrity and authenticity of electronic records, the pending national standards publication entitled Electronic Records as Documentary Evidence (CAN/CGSB ) will outline electronic record management policies, procedures, practices and documentation that will assist in establishing the legal validity of an electronic record. Note: CAN/CGSB published January 2006 by CGSB

Canada Evidence Act The following “Standards Rule”was added to the Canada Evidence Act and to most provincial and territorial Evidence Acts: "Standards may be considered...for the purpose of determining under any rule of law whether an electronic document is admissible, evidence may be presented [in any legal proceeding] in respect of any standard, procedure, usage or practice concerning the manner in which electronic documents are to be recorded or stored having regard to the type of business, enterprise or endeavour that used, recorded or stored the electronic document and the nature and purpose of the electronic document."

Standards The standards are not a law, it is a guideline. Compliance with the standard is not mandatory. Compliance with the standard is a safe harbour, not a guarantee of any legal result. The standard is a statement of best practices. The Evidence Act says a court “may consider”compliance with the standard –if party asks.

Electronic Commerce Auditing What happens when an auditor contacts you to set up an audit of your business, or, What happens when your client calls and says that he/she is going to be audited and the CRA want the electronic records.

Electronic Commerce Auditing Auditors Role Auditor makes contact and sets up the audit They will usually ask whether you maintain an electronic record keeping system Will mention that an Electronic Commerce Audit Specialist will call to arrange to discuss the electronic records Contact name to handle questions on the electronic records and accounting software What software do you use? Or did you use during the audit period? What version(s)? If the records are located at a different site I.e accountants, service bureau, other, they will need permission to talk to the third party. It would be best for taxpayer to contact the third party and make them aware.

Electronic Commerce Auditing ECAS Role ECAS will make contact and arrange a meeting and ask some questions. ECAS will identify the files that are needed for the upcoming audit Ask for a copy of the files in a readable and useable format (not the originals) Readable and Useable Format Format that can be used with Agency software such as IDEA. ASCII Text, EBCDIC, DBF, ACCESS, Excel, Print file, etc.

Electronic Commerce Auditing ECAS Role ECAS will take those files and load them onto Agency computers (laptops or PC’s) Import them into IDEA I nteractive D ata E xtraction and A nalysis Analytical tool to allow ECAS and Auditors to extract and summarize the data provided.

Electronic Commerce Auditing ECAS Role ECAS will verify that everything is included in the data and reconcile the data by creating summaries that can be reconciled to financial statements and reports such as: Trial Balance, Financial Statements or other reports as needed. The data files are transferred to the auditor so that they can perform audit tests on the data in the normal course of their audit. Auditors are equipped with laptops loaded with the IDEA software. At the end of the audit and any appeal period the data is deleted from the ECAS computers and any Agency CD’s with Taxpayer data are destroyed and the taxpayer’s CD’s tapes etc are returned to the taxpayer.

Security Data that is stored on the CRA laptops and PC’s are protected with Safeguard Easy. Encryption and Access Controls

Electronic Record Keeping Systems What are the elements of a good electronic record keeping system?

Electronic Record Keeping Systems ACCPAC Quickbooks Simply SAP MYOB JD Edwards Great Plains Business Visions Peachtree Navision Peoplesoft Solomon Platinum BAAN MAS 90 Newviews Oracle Many Other Accounting and POS Software and Electronic Cash Registers Maitre’D Squirrel PixelPoint Micros Positouch LPOS SMS

SME Issues Large businesses usually or should have robust internal control systems and procedures SME businesses can have significant compliance costs and difficulties in understanding and complying with tax requirements Ability of SME to create, record and maintain adequate transaction information data as part of their normal business operations is limited SMEs are engaged in cross border trade at an ever increasing rate

Elements of a Good Electronic Record Keeping System Why?? Good business practices From a CRA perspective we want to encourage voluntary compliance To increase efficiency and effectiveness of computer based auditing by the Agency and taxpayer external auditor

Elements of a Good Electronic Record Keeping System Good business practices Good records will keep you informed about the past and present financial position of your business and keep you in control and give you the information needed to make good business decisions. Good record keeping increases a new business' chances of survival and an established business's chances of staying in business and earning good profits. (Canada Business Service Centre) Good records will satisfy Canada Revenue Agency, Canada Pension Plan, Employment Insurance, Department of Finance, Goods and Service Tax, Workers' Compensation Board, Provincial Revenue Authorities etc. and facilitate correct and timely remittances. From a CRA perspective we want to encourage voluntary compliance To increase efficiency and effectiveness of computer based auditing by the Agency…… and…… taxpayer’s external auditor

Elements of a Good Electronic Record Keeping System; Agency Perspective Sufficient details captured and produced Accuracy and completeness of accounting records Transaction integrity and security Retention of files in a legible format Access to electronic records Adequate backup and export procedures

Sufficient details captured and produced The software should have the capacity to capture and produce sufficient detail to determine income and consumption taxes administered by the Agency. Details of each transaction should be captured An audit trail for each transaction should be created and preserved

Accuracy and completeness of accounting records The software should have the capacity to ensure that all transactions are recorded accurately and completely. Adequate internal controls should be incorporated in the software Zero balancing control total for general ledger transactions Transaction sequential number validation Transaction date validation

Transaction integrity and security Access controls to ensure that only authorized users can have access to a computer system to process data. Adequate internal controls should be incorporated in the software Controls that prevent the editing and deleting of recorded transactions. No single entry transaction correction should be allowed Changes to recorded transaction should be made by journal entry. Any changes to recorded transactions must be adequately documented and at least include the following: 1. Person making modifications 2. Date of change 3. Previous transaction details 4. Current transaction details

Transaction integrity and security Adequate internal controls should be incorporated in the software Password protected access to information generated by the software Data processing batch control Transaction unique sequential numbering Access and activity log The software should produce and save information related to transaction integrity and security

Retention of files in a legible format The software should have the capacity to create, save and backup files and/or tables containing information required by the Agency in a legible format. All transactions and required information created or captured by the software should be saved to files and/or tables Legible format includes commonly used formats such as Comma Separated Value (CSV), ASCII / EBCDIC (flat file), DBF, Default (MS) ODBC and other.

Access to electronic records The software should allow Agency representatives access to electronic records and to the business system documentation. The software should have the capacity to retrieve or rebuild and export original transactions to legible format files accessible to Agency representatives. The software documentation should allow Agency representative to gain a better understanding of the business system.

Adequate backup and export procedures In order to facilitate compliance with data retention, accessibility and readability requirements, the software should provide user with adequate backup procedures and offer the capacity to export the required files in a commonly used format.

Adequate backup and export procedures It should also provide backward compatibility of data and backups. Backup files are not recommended as a method of record retention since the proprietary format of the files only makes them useable, readable and importable by the software version that created the file. As a result, taxpayers depending on backups as a method of record retentions method usually have problems with accessibility in years that follow.

Self Certification Software Initiative

What is the Self Certification Software Initiative Multi-jurisdiction initiative led by the CRA to help software developers ensure that their software meets CRA and Provincial record keeping requirements for tax purposes.

Record Keeping Obligations CRA requirements The provinces have similar requirements to maintain and retain proper books and records.

Who is Involved Initial collaboration with provincial revenue authorities Quebec Ontario British Columbia Working group formed

Working Group Canada Revenue Agency B.C Ministry of Small Business and Revenue Ontario Ministry of Finance Ministère du revenu du Québec Canadian Institute of Chartered Accountants Certified General Accountants Association of Canada The Society of Management Accountants of Canada Sage Software Intuit Canada Fortsum Business Solutions POSERA NCR Canada Small Business Advisory Committee to CRA Information Systems Audit and Control Association (ISACA)

Working Group Adapt principles based on OECD Guidance to develop specifications for software Guidance on Tax Compliance for Business and Accounting Software Standard Audit File - Tax

Working Group Create Canadian Guidance Document for Business and Accounting Software Developers Create Canadian Standard Audit File Specifications Accounting and POS systems

Why are these specifications being developed Improve reliability of business systems Improve adequacy & retention of records Improve accessibility to transactions Improve efficiency of the audit process Governments seek to minimise their tax system operating costs while at the same time keeping taxpayer compliance costs as low as possible

Guidance Document for Business and Accounting Software Developers Standards that should be applied to accounting and POS software in Canada (e.g.) Adequate internal controls Adequate audit trails Electronic export facility (SAF) Ready access to data for compliance testing (SAF) Archive procedures that ensure the integrity and readability of electronic records after an extended period

Adequate Internal Controls Software developers are encouraged to ensure that application software incorporates adequate internal controls to ensure reliability of entry processing

Audit Trails Software developers are encouraged to ensure that application software creates adequate audit trails to assist auditors gain audit assurance

Standard Audit File File containing reliable accounting data Detail level Standard layout and format E.g. XML Extensible Archive procedures that would allow auditors to retrieve the SAF as required

Benefits Improve record keeping of Businesses Records are reliable, complete and accessible assist in the management of the business Assist businesses in meeting their tax obligations Business owners will know that their record keeping software produces information needed during a tax audit thus less time could be taken for an audit

Benefits Developers of Software that meet the specifications will provide an attestation to the CRA that they meet the specifications Businesses, when purchasing or upgrading their software, will be able to access a list of self certified software on a CRA web page

Software vendors One uniform requirement makes product marketable in many jurisdictions Public accountants Simplify assignments of preparing accounting statements and of auditing prepared statements Benefits

When Specifications posted to the CRA Website by Sept 2007 Software available and listed after this date as software is developed and self certified