Update on FTA EDI Audit and Legal Issues Task Force.

EDI Is Growing as Business

Changes

Electronic data interchange (EDI), the buzz word of the 1990s, is keeping many companies and their tax professionals in a state of flux. While dearly streamlining certain operational functions, the business process has far-reaching tax ramifications. EDI is the electronic transmission of business documents between entities (trading partners) using a standard formatted structure. Specifically, this process controls the exchange of data by published standards and allows information to be sent and received by computer systems with different hardware and/or software configurations.

Although EDI has been in place for decades (the American National Standards Institute (ANSI) was established in 1918 to create national standards for EDI), even as late as the mid-1980s only leading-edge companies were using EDI. However, as companies of all sizes in many industries continue to downsize and seek more cost-efficient operations, many are joining the more than 100,000 U.S.businesses that already use EDI and EDI-related processes as an integral part of their businesses. According to the EDI group, Ltd., growth in the EDI market is expected to average more than 15% each year for the next four years.

Although EDI can streamline operations and significantly reduce costs, it can also complicate recordkeeping and audits. These complications increase as companies continue to diversify and expand their sales activity over industry lines. The telecommunications industry is a case in point. After deregulation, these companies began providing numerous services that differed markedly from their traditional lines of service. The fifth largest merger in U.S. history, between WorldCom and MPS, produced a telecommunications giant providing a full spectrum of services to an estimated 500,000 customers, each of whom receives a single bill. Earlier this year, Bell Atlantic Corp. agreed to merge with Nynex Corp. in a transaction worth $22.7 billion. This rapid transformation of telecommunications companies, which are expected to generate between $75 to $125 billion in sales by the turn of the century, raises many issues. For example, how will the electronic systems be consolidated in these megamergers; further, how will companies be able to identify these new services by location?

EDI Continues to Transform

Corporations While Complicating

Audits

One of the key benefits of EDI is the exchange of information and completion of transactions directly between computers, eliminating the need for processing purchase orders, bills of lading, invoices and other traditional paper documents. Considering the broadened industry scope of companies, the evolution of the EDI process, the fact that in certain instances the laws are over 100 years old, and the fact that the audit process used by many jurisdictions today is in transition, it is logical that new issues and challenges will continue to arise.

There is always a need for state governments to maintain a stable revenue stream. Today, it is necessary to increase revenues, heightening the need to quickly develop consistent and clear standards for EDI audits.

How can standard audit processes, which benefit all, be achieved? On the taxpayer side, in organizing the corporate EDI process, it is critical to ensure that legal, audit, systems and tax representation are part of the EDI process team. Requirements should be written to ensure the basic premise that the electronic record should contain all of the information found on the paper document. A description of the commodity being purchased, the price, identification of seller/purchaser, location of delivery, tax amount, tax jurisdiction and type of tax are a few of the required fields. Obtaining the required information upfront, meeting with the tax representatives of the trading partner and joining with internal audit to ensure system integrity will expedite all audit processes. Taxpayers should also ensure that appropriate records are maintained for audit purposes in a format that is readable and available years after a transaction has occurred.

From the perspective of the taxing authority, it is critical that the system be deemed to have sufficient integrity. Once this is achieved, the audit is returned to the normal taxability phase. Arguably, this is the current requirement; the lack of "paper" simply brings the point home more strongly. Unfortunately, the electronic process generates questions that can no longer be avoided. Should a sales tax auditor, for example, perform certain tests of the system? Isn't the purpose of an audit simply to ensure that the appropriate sales tax was paid and remitted? Further, the state authorities must consider the varying requirements by type of tax and the related record retention requirements.

The growth of EDI strongly encourages taxpayers and tax authorities, at a minimum, to agree: - that there are situations in which there may not be a purchase order, invoice, payment, acknowledgment or other form of traditional audit document; - to modify policies, regulations and statutes to address paperless processes; and - to analyze record retention requirements.

FTA Task Force Addresses EDI-Related

Issues

In October 1994, the Federation of Tax Administrators (FTA) organized a team - now known as the Task Force on Electronic Data Interchange Audit and Legal Issues for Tax Administration (Task Force) - comprised of the Committee on State Taxation (COST), the FTA, the Institute of Property Taxation (IPT), the Multistate Tax Commission (MTC) and the Tax Executive Institute (TEI). The Task Force's goal was to submit a final report that included an explanation of and background on EDI; a review of EDI's impact on the state tax audit and tax administration process; and recommendations to the governing bodies of COST, FTA, IPT, MTC and TEI.

While this report would not be binding, it would hopefully provide guidelines addressing the major issues on EDI and related processes. The Task Force was made up of a Steering Committee and two work groups: the Recordkeeping and Legal Issues Work Group and the EDI Audit Approaches Work Group. (The following discussion summarizes the two work groups formed as part of the Task Force. Note that the Steering Committee provided final comments and modifications to all documents.)

Recordkeeping and Legal Issues Work Group: The Recordkeeping and Legal Issues Work Group was given the task of developing a proposed rule on the maintenance, retention and availability of electronic business, tax and accounting records for state audit purposes. The proposed regulation draws from various sources including, but not limited to, existing state regulations, Rev. Proc. 91-59 (governing automated recordkeeping and accounting systems), suggested revisions to Rev. Proc. 91-59 developed by TEI, and a draft regulation by the California Board of Equalization. The original draft underwent substantial revisions during various meetings of tax administrators and taxpayer representatives.

This regulation was developed as a model to allow modifications accommodating the particular requirements of various state laws, such as retention periods and penalties for noncompliance. The regulation also allows states to identify specific records or documents they require to be retained in addition to the general requirements specified in the regulation. Although no attempt was made to address differences among each state's statutes as to each type of tax, the general requirements should apply across all types of taxes, with allowance for specific details to be addressed by states individually.

Again, the regulation was designed not only to cover retention of records created using EDI technology, but to cover the retention and access to records generated through other electronic means and maintained by taxpayers in computerized accounting systems. Because the retention of EDI records is so intertwined with other electronic systems for maintaining accounting records, they may not be realistically separated. Also, most state recordkeeping regulations have not been revised to capture die widespread use of electronic accounting systems by all types of taxpayers. Along with retention of records, this regulation addresses access to records during an audit, maintenance of records over time, and conversion of hard copy records to other storage media.

The regulation tried to balance the interests of taxpayers and tax authorities, and create an environment that would make tax administration efficient for all parties. The regulation sought to clearly identify the responsibilities and obligations of taxpayers to provide books and records necessary to verify that correct tax liabilities have been reported and paid. At the same time, it attempted to provide taxpayers with flexibility in how they choose to fulfill these responsibilities.

The issue of tax authorities access to taxpayers' EDI processing, accounting or other systems for purposes of verifying or evaluating the integrity of those systems is not addressed in this regulation. While participants acknowledged that such evaluations are essential to the tax administration process, the Steering Committee agreed that the issue might be more appropriately addressed by the EDI Audit Approaches Work Group, which developed approaches to conducting such evaluations.

The most significant specific elements of the Model Recordkeeping and Retention Regulation stipulate that: * The general requirement imposed on taxpayers is to retain those records necessary to verify that the correct tax liability has been reported and paid by the taxpayer. * If a taxpayer maintains records in both hard copy and machine-sensible forms, the taxpayer must provide the state authority with access to the records in machine-sensible form at the time of an audit, if so requested by the taxing authority. * Taxpayers may demonstrate tax compliance through traditional paper records, but this does not eliminate the requirement to provide access to machine-sensible records if requested by the tax authority. * While access to machine-sensible records may be accomplished in a variety of ways, taxpayers must have the capacity to extract required records and convert them to a standard record format at the request of the taxing authority. * Individual EDI transactions need not be retained in their original format if the data elements required to be retained under the regulation are captured from the EDI transaction and maintained in the taxpayer's accounting and recordkeeping systems in accordance with the regulation.

Original hard copy records may be converted to alternative storage media such as microfilm, microfiche or various storage-only imaging systems, provided that certain standards of access, readability and integrity are met. Once converted, the original hard copy documents need no longer be retained for tax administration purposes. Note: A copy of the Model Recordkeeping and Retention Regulation may be obtained from Stephanie Rosenbusch, at Federation of Tax Administrators ([phone]).

EDI Audit Approaches Work Group: The EDI Audit Approaches Work Group, which focused on identifying issues involved in auditing electronic records and assessing alternative approaches to auditing such records, has created a report currently in draft form. The final report will be distributed in the near future.

As the work group's report indicates, the primary objective of a tax audit does not change because all or part of the taxpayer's records are in electronic form. However, the mix of electronic data to physical data within a taxpayer's accounting system does determine whether the review of electronic records serves as a function of the overall tax audit program or functions as the overall tax audit program itself.

There are numerous advantages to auditing electronic data, including the reduction of time, effort and human resources invested in an audit. Electronic audits can also increase the percentage of the taxpayer population audited, maximize the efficiencies related to statistical sampling, streamline the detailed review of all records for an audit period and instantly access records in a computer readable format.

A tax auditor's responsibility is to examine the tax accrual and reporting system, procedures and methodology, not necessarily to audit the electronic data processing (EDP)/EDI systems. However, a review of internal controls in place for the tax accounting process is within an auditor's scope, whether the accounting system is paper-driven or electronic. An evaluation of internal controls assists the auditor in formulating an opinion on the level of reliability of the tax accounting and accrual system, essential in determining the scope of the audit. If the auditor favorably assesses the system, electronic records can be trusted and the audit can move forward using the taxpayer's electronic records to perform the audit. Traditional audit techniques and the taxpayer's physical records may be used if the auditor unfavorably assesses the reliability of the taxpayer's electronic records.

To successfully complete an accurate electronic audit, the auditor needs to know the answers to the following questions outlined in the report: * Where do the numbers on the tax report come from? What are the origins of the taxpayer's electronic records? Is there an audit trail? Since summary reports in the early stage of an audit may not be sufficient to satisfy the auditor's need to know, is transaction-level information available in adequate detail, to sample and determine if the tax treatment is correct? * Are the electronic records reliable? What internal controls are in place to support the tax accrual system? Do the internal controls produce an acceptable level of assurance that records are reliable? How are tax accrual system changes developed and implemented? Do undocumented system changes exist? * Are the electronic records available? What is the taxpayer's record retention policy? What controls are in place to safeguard records? Are detail and summary records available for the audit period? * When, where md how will electronic records be analyzed? Can the information be analyzed using the taxpayer's system resources? Does the tax audit organization have adequate hardware and software resources to conduct an audit of electronic records? Are the resources of a third-party service available? Can statistical sampling techniques be used in place of a detailed review of all records for the audit period?

Effective Internal Controls Crucial

to a Successful Electronic Audit

As far as who participates in electronic audits, the report points out that auditors will need to interact with representatives from internal audit, data processing and management information systems, and perhaps records management, as well as with individuals traditionally involved in a physical records audit (e.g., individuals representing the taxation, accounting and legal areas of a taxpayer's business).

The report also points out that an electronic data tax audit is a tax audit in every sense of the term, applying the same tests, procedures, standards and techniques similar to the traditional physical records audit, except that these tools may be in an electronic, computer-readable form.

In any audit, the auditor's belief that internal controls for the accrual and reporting of tax liabilities are reliable is critical. While many questions have arisen about the potential for taxpayer manipulation or alteration of electronic source documents, the truth is that there has always been the potential for alteration, forgery and falsification in traditional recordkeeping. In the absence of effective internal control, any document - physical or electronic - is subject to alteration, forgery or falsification. The report stresses that the degree of auditor-taxpayer trust has not changed, only the nature of the source document has changed; more weight must realistically be given to internal controls installed to support tax accrual and supporting systems in an electronic recordkeeping environment.

Basic internal control functions that should be in place within an electronic recordkeeping system. are enumerated in the report. The following list is not all-inclusive, but the existence (or nonexistence) of these functions helps a tax auditor assess the degree of reliability that can be placed on the electronic records and tax accrual and reporting systems: * System threat and risk analysis. * Limited access to electronic record systems. * Unalterable date-stamping of transactions and transaction files. * System access and data access logs. * Data alteration logs and preservation of original unaltered data records. * Rejected transaction or transmission procedures logs or trails. * Regular review of access, alteration and rejection logs or trails. * Archival retention of electronic records for the statutory period. * Preservation and security of data integrity of archival records for the statutory period. * Retention of historical transactions, summary and control of total reports to verify and establish a level of reliability for the electronic data. * Third-party documentation that supports electronic transactions, including audit reports, bills of lading, exemption certificates, acknowledgments of receipt, payment vouchers, contracts, trading-partner agreements and other applicable records.

It should also be noted that the report suggests that an acceptable level of confidence in the EDI system can be determined by answering die following questions: * Are policies and procedures in place that govern the system and subsystem process and implement controls? * Are the controls subject to manipulation? And if so, to what degree? * Can individual transactions be traced? * Are translation software control procedures in place? * Does the information generated by the system fie to die financial statements or similar reports? * Are relevant audit reports (internal, third-party) available for review?

The report points out that with the widespread use of EDP and the growing use of EDI, tax audit organizations need to develop resources, procedures and policies that focus specifically on electronic data audits: * In the area of recordkeeping, clarify the minimum requirements that must be met when all or part of a taxpayer's tax accrual and reporting records are maintained on an EDP/automated data processing (ADP) system. * Augment tax audit procedures by using internal and external EDP, ADP and EDI audit reports to establish a level of reliability for existing internal controls. Develop, only as needed, procedures and techniques that verify the validity and integrity of EDI and other electronic records. * Clarify the minimum requirements that must be met in issuing, tracking and maintaining ANSI compliance and EDI tax exemption certificates. * Identify the hardware and software resources needed to use taxpayer records in a computer-readable form for analysis and statistical sampling purposes. Determine whether the electronic tax audit will use the tax jurisdiction's computer resources, the taxpayer's resources, an outside service, or a combination of all three. * Clarify the minimum requirements that must be met in the agreement to support the taxpayer's tax accrual and reporting system, developing guidelines for the review and verification of trading-partner agreements and the terms and conditions involved. * Develop tax audit procedures for verifying transactions, on a sample basis, from electronic source documents, through control total reporting to the tax accrual and reporting system and finally to the tax return. * Develop tax audit procedures for using historical transactions, summary and control total reports to verify and establish a level of reliability for the electronic record data provided to the tax auditor.

The report also addresses other critical areas involved in electronic audits and makes suggestions about developing specific methods of establishing guidelines for electronic data audit overview of data files, data integrity testing, population definition, population evaluation, population analysis, sample or detail determination and report generation. Note: The MTC will hold a meeting on Dec. 10, 1996, at Hall of the States Building, 444 North Capitol Street, N.W., Suite 331, Washington, D.C. 20001-1538, to consider whether the Model Recordkeeping and Retention Regulation should be adopted as an MTC uniformity recommendation to the states.

Some Issues Remain to Be

Addressed

In May 1996, two additional work groups were formed to address the remaining issues that relate to electronic business processes used by taxpayers and tax authorities. The first group, the Electronic Business ProcessWork Group, is examining electronic billing, collection and certain other processes that affect the way companies conduct business with each other and the method in which tax authorities audit those companies. Specific issues to be addressed include corporate procurement cards, evaluated receipts settlement, exemption certificates and direct pay status.

The second group, the In-bound EDI Transactions Work Group, is examining the electronic filing of tax information that raises issues such as signature alternatives, due dates, timely filing and payment, due diligence, confidentiality, acknowledgment processes, message integrity/nonrepudiation, filing options and other related concerns. This group will produce a model regulation covering administrative issues modeled after existing laws and administrative rules in California, Florida, Illinois,texas, Utah and Wisconsin.