Overview on Compliance of Electronic Invoices - Joost Kuipers

Overview on compliance of
electronic invoice solutions

WG 2 & WG3
Joost Kuipers
Netherlands/Belastingdienst

CEN Task Groups 2 & 3:
cooperation towards a common goal

TG2 SG2: remove regulatory inhibitors

One EUTG2 SG1 and SG3:
Compliance Guidelines

4th CEN Industry Conference on Electronic invoicing and compliance.
Brussels, June 2009 -2-
©2005 CEN – all rights reserved 2
© 2008 CEN – all rights reserved 22.06.2009

Members:

Guidelines Inhibitors

TG 2 (sub group 1) TG3 TG2 (sub group 2)
Joost Kuipers (chair) Tony Nisbett
Johan Borendal (chair)
Dave Chambers Dave Chambers
Adrian Mueller
Eloy Ruiz Madueño
Olaf Schrader Andrea Caccia
Greg Gosling
Kevin Thornton Eloy Ruiz Madueño Olaf Schrader
Danny Kuijper Marc Straat Franco Ruggieri
Isabelle Desmeytere Paul Hojka Fabio Cavraro
Christiaan van der Valk Christiaan van der Valk Wolfgang Matt
Jacqueline Wijnands Joerg Walther
Nick Pope
Patrick Frijns (technical editor) Marina Ferraro
Sören Lennartson
René de Waard
Alexandra Sladek
Tony Nisbett
Mounir El-Khoury
Mounir El-Khoury (technical editor)
(technical editor) 4th CEN Industry Conference on Electronic invoicing and compliance.
©2005 CEN – all rights reserved

Outline scope of CWA 2 and 3

Compliance of electronic invoice
implementations with Council Directive
2006/112/EC and the national legislation as
regards electronic invoices

TG 2 (SG1): Criteria for certification of service
providers and e-invoice solutions;
TG 2 (SG1): A framework for tax authorities to
audit VAT invoice solutions;
TG 3: Cost effective authenticity and integrity


The perception of complexity and
unclear (VAT-)regulation. UNCERTAINTY

Corporate e-invoicing users and solution providers
feel insecure about their e-invoicing solutions. They
want to be (VAT-) compliant
Today, most tax administrations do not provide
accreditation services or self-assessment
programmes to assist e-invoicing users or their
service providers to ascertain that e-invoicing
systems are VAT-compliant.
Tax administrations seek guidance how to audit e-
invoicing solutions. They feel insecure.


VAT Invoicing Rules

28 January 2009. EC proposal to change the
VAT-directive 2006/112/EC
http://ec.europa.eutaxation_customs/taxation/v
at/traders/invoicing_rules/index_en

Existing Legislation in the Member States
https://globalvatonline.pwc.com/uk/tls/gvol2/gvol2.n
sf/AllByCode/RJAI-7CHKU5/$File/PwCLegislation


What’s so special about the invoice, anyway?

VAT >35% EU public
revenue

Invoice is common
denominator across
business models, the
ultimate concentrate of
transaction information


What’s on the EU table

“Equal treatment” of paper and
e-invoices
“Technologically neutral”
Consistent Business Control
Framework/Tax Control Framework
So auditability for external auditors, as tax
auditors, must be guaranteed (“authenticity of
origin” and “integrity of content”)


FISCALIS: Activity “audit of e-invoicing”

Audit process facilitation:
Producing of audit standards (guidance paper) for
tax auditors. Including verification of the
authenticity and integrity of invoice transmissions
Produce training standards (requirements) for
different target groups
Central point (network) for questions.


The co-regulation model

Tax Quick, cost- Businesses
authorities
effective audit

Brussels, June 2009 - 10 -

Background & positioning

Based on strong similarity between Fiscalis
audit project and CEN TG2 en TG3 (Cost
effective authenticity and integrity) tasks for
guidelines
Desire to avoid overlap
Exploit synergies
Joint promotion & implementation
opportunities


Deliverables

http://www.e-invoice-gateway.net/
+
Commentary Guidelines (Matrix)


DRAFT CWA E-INVOICING
COMPLIANCE GUIDELINES vs 0.90

Commentary: background, definitions,
descriptions
READ THIS FIRST
Guidelines matrix: ~100 process steps are
mapped to: Risks (why), requirements (what),
controls (how)
Process filters allow viewing specific end-to-end
process configurations


The Guidelines offer:

Clarification of basic expectations for a compliant e-invoicing
process underlying most EU Member States’ laws in this area
Solid basis for meeting tax requirements across the EU
Solid basis for a tax audit
Overview of the end-to-end process for e-invoices using
commonly available “classes” of compliance approaches
Check-list to ensure controls are in place where needed, but
leaving choice as to implementation (listing examples)
For solution vendors to demonstrate adherence to good
practices


The Guidelines are addressed to:

All companies engaged in e-invoicing
Large, medium small, micro enterprises
- maybe it’s not one size fits all -
Service and solution providers offering e-
invoicing functionality
Internal and external auditors
VAT auditors in tax administrations


Preplanning

SOX-audit

External
audit
Tax
audit

Business
Other audit techniques

Internal control
in control
statement (SOX)

Process overview: life cycle


Archiving and auditability

Storage in compliant archive
during mandatory period
Issues: time, venue,
segregation of duties,
access, search criteria,
readability, audit trail….


Trading partner off-boarding

Discontinuation of trading
partner or service provider
relationship
Issues: hand-over of
originals (for outsourced
storage), termination of
processes and contracts etc


Summary recommendations at this stage

Much positive feedback
One set of comments yet to be incorporated
The e-Invoicing Compliance Guidelines are endorsed
by the Expert Group on e-Invoicing
More than 10 solution providers and end users have
shared initial self-assessments using the Guidelines
The invitation still stands
We invite companies, service providers and developers of e-
invoicing solutions to assess the applicability
We invite all auditors specialising in e-invoicing applications
and VAT administrations to review the Guidelines


Misunderstandings

For professionals, not SMEs
Tools for different target groups can be created
Phase II will create SME version
Read Commentary first
Describes all available methods
Not simply a guide for 2001 Directive
implementation
Addresses entire spectrum of adequate business
control frameworks, no favorites between process-
or data-level controls etc


Questions?

Joost Kuipers :
jhb.kuipers@belastingdienst.nl
(chair)

Mounir El Khoury : mk@scarlet.be
(editor)


eInvoicing Public Meeting
Brussels, 18 June 2009

TG 3: Cost effective means to
guarantee authenticity & integrity

Johan Borendal – TrustWeaver (Chair)
Nick Pope – Thales e-Security (Technical Editor)

4 th CEN Industry Conference on Electronic invoicing
and compliance. Brussels, June 2009 - 23 -



One EUTG2 SG1 and TG3:


Terms of Reference

“Cost-effective authenticity and integrity of
electronic invoices and related business
documents regardless of formats and
technologies”

Minimise unnecessary costs to businesses
Ensure that major risks identified by Tax
Authorities are addressed


CEN eInvoicing WG 3: Terms of
Reference
technologies”

Can include:
Authenticity & integrity in transfer
Maintain authenticity & integrity over period of
storage


Reference
technologies”

eInvoicing main legal pressure point
for business
Applicable to other aspects of
eBusiness & eGovernment


Reference
technologies”

Addressing authenticity & integrity by
a range of methods including those
from current Directive


TG2 Good Practice vs
TG3 Requirements & Controls

WG2 WG3
eInvoice Requirements
A&I Mechanisms
Preparation
Archiving
eInvoice & audit
EDI
Translation
Controls
Signatures
Self Protocols
Billing


Class of Business Implementation

Wide range of business solutions to
e-Invoicing in existence across EU
VAT Directive 2006/112 Identifies for Authenticity &
Integrity:
EDI
Advanced Electronic Signature
Other accepted by Member State
Guidelines:
Recognise that authenticity & integrity only one aspect of
business operations
Generalise Directive classifications to incorporate other
aspects of business operations
Basic options of process- or data-level controls

Classes Identified to date
A) Business solutions exclusively relying on the transparency of individual trading
partners’ internal business controls to prove sales transactions to
tax administrations.

B) Business solutions relying on basic business controls augmented by
controlled data exchanges (e.g. EDI) to ensure that real and
unchanged invoices exist between trading partners and can be made available
to tax auditors.

C) Business solutions relying on basic business controls augmented by data
level controls (e.g. advanced electronic signatures) to
ensure that real and unchanged invoice data exists between trading partners
and can be made available to tax auditors.

D) Business solutions relying on basic business controls augmented by central
"safe-keeping" of invoice data to ensure that real and
unchanged invoice data exists between trading partners and can be made
available to tax auditors.

Class A - internal business controls

Relying on the transparency of individual trading
partners’ internal business controls

Not explicitly referenced in the Compliance Matrix

Method for ensuring compliance and auditability
depends largely on the type of organization and the
way in which certain processes and controls are
naturally implemented


Class B - controlled data exchanges

e.g. EDI

Every leg must have controls in place
Processing
Transmission
Storage


Class C – Data level controls

e.g. Advanced Electronic Signatures

May be used to protect invoice
When sending/making available
and depending on form of signature
In storage


Class D – “SafeKeeping”

Revolves around outsourcing to a trusted
party (trading partner e.g. supplier portal or
service provider)

Trusted to keep e-invoices safe throughout
life-cycle including storage


Conclusion

Authenticity and integrity integral with other
aspects of e-invoicing
In guidelines considered as part of overall
business processes
4 classes of business implementation
currently identified building on but not limited
to classifications for authenticity & integrity in
Directive 2006/112
In compliance matrix can select requirements
relating to a particular implementation class


Questions?

Johan Borendal:
johan.borendal@trustweaver.com
(chair)
Nick Pope:
nick.pope@thales-eSecurity.com
(editor)


Good use of the Compliance
Guidelines

Isabelle Desmeytere
Christiaan van 4der ValkConference on Electronic invoicing
th CEN Industry

Too detailed or maybe not detailed enough?

Example:
Step 4 of the invoicing process: Send or make
available


The classes in practice

Categorization is conceptual only – not a
straightjacket
Framework to assist trading partners in optimizing controls
for specific risks in every step of their process
Objective: offer different models that can fit maximum of
trading scenarios
Many implementation examples per control in each class
Businesses to decide freely which are most beneficial in
which circumstances


Class A scenario #1

Transparent (micro-)enterprise
Prima facie auditability: few trading partners, low staff turnover and
change rate
Exchange e.g. PDF via email, signed or unsigned
Storage on e.g. DVD or online through ISP

41

Class A scenario #2

Large corporate with high degree of internal
control
Auditability inherent in matching being
reproducible / strong audit trails
Well-documented processes, frequent internal
and external audits
Strong archiving solution
Takes two to tango: trading partner compliance
position must be considered (Class A-D )
42

Class B scenario

Emphasis of controls/auditability in exchange
mechanism: secure transmission, automated syntax
checking
Always structured data; normally no conversion of
the invoice as issued – strong audit trail if conversions

43

Class C scenario

Emphasis of controls/auditability on
the data level (sign/validate)
No changes/conversions of original
invoice (dual feed + audit trail possbile)
4 CEN Industry Conference on Electronic invoicing and compliance.
th

44

Class D scenario

Invoices created for trading partner never
leave single secure environment: web
consultation/audit possible, as well as
download of copy « data »
Party offering secure safe-keeping has
strong internal controls
No changes/conversions of original invoice
If larger trading partner offers the service, it
will usually use Class A
45

Taxable persons can leverage service providers to outsource tax-
relevant processes. Tax-wise this does not change anything.
Supplier’s service provider can issue « in his name and on behalf »

Attention points:
On- and off-boarding controls
First and last mile
Conversions in multi-corner models and compliance.
4th CEN Industry Conference on Electronic invoicing

COMPANY A self-assessment

Connecting PO and non-PO suppliers
40+ countries in scope
40+ supplier VAT jurisdictions
33 COMPANY A subsidiary VAT jurisdictions
One-stop service provider
Also responsible for interoperability with suppliers’
own solutions (including other SPs)
Storage offered to suppliers, COMPANY A
performs own storage


Ensure buyer acceptance

Ensure supplier agreement

Ensure supplier training

Ensure coordinated use of security mechanisms

Ensure sufficient testing prior to production

Ensure SP issues complete invoice

Ensure SP issues all supplier’s invoices

Ensure supplier has all data of issued invoice


eInvoicing Public Meeting
Brussels, 19 June 2008

Legal and regulatory inhibitors to the
acceptance of Electronic Invoicing

Tony Nisbett, IBM & EDIFICE

4 th CEN Industry Conference on Electronic invoicing



One EUTG2 SG1 and TG3:


Classes Identified to date
A) Business solutions exclusively relying on the transparency of individual trading
partners’ internal business controls to prove sales transactions to
tax administrations.

to tax auditors.


D) Business solutions relying on basic business controls augmented by central
"safe-keeping" of invoice data to ensure that real and
unchanged invoice data exists between trading partners and can be made
available to tax auditors.

Mapping to current legislation
A) UNAVAILABLE IN AT LEAST 2/3 OF EU MEMBER STATES
to tax auditors.


D) UNAVAILABLE IN AT LEAST 2/3 OF EU MEMBER STATES


Legal & regulatory inhibitors to the
acceptance of Electronic Invoicing
Background
Objectives
Proceedings
Selection of Main Areas of Interest
Issue Groups
Issue Evaluation Templates
Issues on the CEN/e-invoicing Portal
Do current proposals help?


Background
EU and national VAT legislation

Are not in synch. So >>

Many alternative possibilities for
implementation offered to Member States


Objectives
CEN/ISSS Electronic Invoicing Workshop Phase 2
Compliance Group – WG2/Task Group (TG) 2

Tasks
Monitoring the legal requirements in member states as
regards cross border exchange of electronic invoices

Recommendation of changes in the legal environment
for electronic invoicing


Proceedings
Could have
Enumerated all electronic invoicing issues in all
Member States
Issued Lengthy questionnaire to stakeholders
Deliberated for years without achieving anything
Instead
Direct approach
Real issues and challenges analysed by people who are
actually dong this as their day-job


Original Extensive “Special Challenges” - Categories

Buyer acceptance of e-invoicing Outsourced issue authorisation
Special issues concerning Outsourcing buyer functions
e-invoicing Outsourcing Buyer's authorization
EDI definition Invoice process requirements
EDI Interchange agreement Invoice content
EDI Security and audit trail Credit Note
EDI Summary statement Self-billing General
EDI Other requirements Self-billing Supplier acceptance of
Electronic signatures and invoice
Certificates Self-billing agreement
Other methods Self-billing Hybrid forms
Outsourcing e-invoicing Self-billing E-signature issues
processes General Archiving General
Outsourcing of Invoice issue Archiving Outsourcing of archival
Outsourcing E-signature issues Archiving Outsourcing agreement


Final “Special Challenge” List – Issue Groups

Buyer Requirements
Electronic Signatures & Qualified Certificates
Other Methods to ensure Authenticity & Integrity
Invoice Process Requirements
Cross Border
EDI
Self Billing
Outsourcing
Invoice Issue
Buyer Functions
Archiving
Storage Period
Form/Format
Location


Issue Evaluation Templates
Common Feature of Sub Groups 1 and 2
multi line spreadsheet – control list of issues
Each line has an Issue Evaluation Template
Problem Statement
Issue Category
Problem Description
Countries where problem evident
Appropriate EU Member States
All EU Member States
Suggested resolution (or evidence of good practice)
Process of Implementing the resolution
Group’s suggestion(s)
Time period for implementing the resolution


Sample Issue Evaluation Template


Issues are posted on Electronic Invoicing Portal
42 Issue Evaluation Templates
Work Group 1 developed e-Invoicing Portal
http://www.e-invoice-gateway.net.
Open issues for discussion to:
Industry
trade sector
other interested parties
Invitation to comment on and submit further issues to
portal in next month
for WG2 SG2 review
to be made available for discussion on portal
must be:
business justified
Practical
Resolvable in reasonable time scale
within WG2/SG2 scope

How do current Commission Proposal and other
pertinent documents help with the issues?

WG supports attempts to remove barriers to
eInvoicing, especially cross border.
Reduction in options available
Standardise use of signatures
Clearer definition of storage requirements
Conversion of paper to electronic
Location of Storage/Archives

Open issues for discussion:
Equal Treatment
Acceptance and general legal frameworks
Converting electronic to paper
Harmonising Tax, Accounting and other laws
EDI Summary Reports

Questions?

Tony Nisbett: tony.nisbett@uk.ibm.com
(chair)

Mounir El Khoury : mk@scarlet.be
(editor)


General questions?

Joost Kuipers, TG2 Chair


Overview on Compliance of Electronic Invoices - Joost Kuipers

Recommended

Recommended

More Related Content

Viewers also liked

Viewers also liked (14)

Similar to Overview on Compliance of Electronic Invoices - Joost Kuipers

Similar to Overview on Compliance of Electronic Invoices - Joost Kuipers (20)

More from Danny Gaethofs

More from Danny Gaethofs (19)

Recently uploaded

Recently uploaded (20)

Overview on Compliance of Electronic Invoices - Joost Kuipers