Tg 2 3 Compliance Cen 18 06 2009

Overview on compliance of electronic invoice solutions

WG 2 & WG3Joost KuipersNetherlands/Belastingdienst

©2005 CEN – all rights reserved

4th CEN Industry Conference on Electronic invoicing and compliance. Brussels, June 2009 - 2 -

One EU

CEN Task Groups 2 & 3: cooperation towards a common goal

© 2008 CEN – all rights reserved 22.06.2009

2

TG2 SG2: remove regulatory inhibitors

TG2 SG1 and SG3:Compliance Guidelines

http://www.google.fr/imgres?imgurl=http://www.sfbvg.ch/fr/verbindungsstelle/images/img_map_eu_efta.jpg&imgrefurl=http://www.sfbvg.ch/fr/verbindungsstelle/fr_verbindung_listeEFTA.htm&h=370&w=410&sz=32&tbnid=SAxxw6QEYJL8WM:&tbnh=113&tbnw=125&prev=/images%3Fq%3Dmap%2Beu%2Bimage&hl=fr&usg=__1ohiaYNzacIs5nAiHdwgMgva8FQ=&ei=iKU0SuPcCsXLjAfe5pCNCg&sa=X&oi=image_result&resnum=3&ct=image

http://www.google.fr/imgres?imgurl=http://www.edupics.com/scissors-t8216.jpg&imgrefurl=http://www.edupics.com/en-coloring-pictures-pages-photo-scissors-i8216.html&h=531&w=750&sz=37&tbnid=t2BDYx-WeoWQEM:&tbnh=100&tbnw=141&prev=/images%3Fq%3Dpicture%2Bscissors&usg=__wR8SihyCmXRkliSq0zVDGdqmlVQ=&ei=fa00SuPYGoeRjAftt5z5CQ&sa=X&oi=image_result&resnum=4&ct=image



Members:

TG 2 (sub group 1)

Joost Kuipers (chair)

Dave Chambers

Olaf Schrader

Kevin Thornton

Danny Kuijper

Isabelle Desmeytere

Christiaan van der Valk

Jacqueline Wijnands

Patrick Frijns

René de Waard

Tony Nisbett

Mounir El-Khoury (technical editor)

TG3

Johan Borendal (chair)

Adrian Mueller

Andrea Caccia

Eloy Ruiz Madueño

Marc Straat

Paul Hojka

Christiaan van der Valk

Nick Pope (technical editor)

TG2 (sub group 2)

Tony Nisbett

Dave Chambers

Eloy Ruiz Madueño

Greg Gosling

Olaf Schrader

Franco Ruggieri

Fabio Cavraro

Wolfgang Matt

Joerg Walther

Marina Ferraro

Sören Lennartson

Alexandra Sladek

Mounir El-Khoury(technical editor)

Guidelines Inhibitors



Outline scope of CWA 2 and 3

Compliance of electronic invoice implementations with Council Directive 2006/112/EC and the national legislation as regards electronic invoices

TG 2 (SG1): Criteria for certification of service providers and e-invoice solutions;

TG 2 (SG1): A framework for tax authorities to audit VAT invoice solutions;

TG 3: Cost effective authenticity and integrity



The perception of complexity and unclear (VAT-)regulation. UNCERTAINTY

Corporate e-invoicing users and solution providers feel insecure about their e-invoicing solutions. They want to be (VAT-) compliant

Today, most tax administrations do not provide accreditation services or self-assessment programmes to assist e-invoicing users or their service providers to ascertain that e-invoicing systems are VAT-compliant.

Tax administrations seek guidance how to audit e-invoicing solutions. They feel insecure.



VAT Invoicing Rules

28 January 2009. EC proposal to change the VAT-directive 2006/112/EC

Existing Legislation in the Member States

http://ec.europa.eutaxation_customs/taxation/vat/traders/invoicing_rules/index_en

https://globalvatonline.pwc.com/uk/tls/gvol2/gvol2.nsf/AllByCode/RJAI-7CHKU5/$File/PwCLegislation



What’s so special about the invoice, anyway?


7

VAT >35% EU public revenue

Invoice is common denominator across business models, the ultimate concentrate of transaction information



What’s on the EU table

“Equal treatment” of paper and e-invoices“Technologically neutral” Consistent Business Control Framework/Tax Control Framework So auditability for external auditors, as tax auditors, must be guaranteed (“authenticity of origin” and “integrity of content”)



FISCALIS: Activity “audit of e-invoicing”

Audit process facilitation:Producing of audit standards (guidance paper) for tax auditors. Including verification of the authenticity and integrity of invoice transmissionsProduce training standards (requirements) for different target groupsCentral point (network) for questions.



The co-regulation model


10

Tax authorities

BusinessesQuick, cost-effective audit



Background & positioning

Based on strong similarity between Fiscalis audit project and CEN TG2 en TG3 (Cost effective authenticity and integrity) tasks for guidelines

Desire to avoid overlapExploit synergiesJoint promotion & implementation opportunities



Guidelines (Matrix)Commentary

Deliverables

+http://www.e-invoice-gateway.net/

http://www.google.fr/imgres?imgurl=http://www.paltechsolutions.com/images/Excel%2520Logo2.jpg&imgrefurl=http://www.paltechsolutions.com/office_solutions.html&h=203&w=203&sz=23&tbnid=zVZkebiyPZYtCM:&tbnh=105&tbnw=105&prev=/images%3Fq%3Dmicrosoft%2Bexcel%2Blogo&hl=fr&usg=__MJfdvBNjU1VublSE_04VmaBfMMM=&ei=d-w1SrrZG9q6jAf7_oWKCg&sa=X&oi=image_result&resnum=4&ct=image

http://www.google.fr/imgres?imgurl=http://www.protoneurope.org/main_images/pdf_logo/image&imgrefurl=http://www.protoneurope.org/main_images/pdf_logo/view&h=160&w=160&sz=4&tbnid=0RLDE6aq1KVhDM:&tbnh=98&tbnw=98&prev=/images%3Fq%3Dpdf%2Blogo&usg=__dJhmeeoSDX7DsoVUMZl554JJ80A=&ei=ivI1SuD8MNm6jAe87tCGCg&sa=X&oi=image_result&resnum=1&ct=image

http://gpg.e-invoice-gateway.net/



DRAFT CWA E-INVOICING COMPLIANCE GUIDELINES vs 0.90

Commentary: background, definitions, descriptions

READ THIS FIRST

Guidelines matrix: ~100 process steps are mapped to: Risks (why), requirements (what), controls (how)

Process filters allow viewing specific end-to-end process configurations



The Guidelines offer:

Clarification of basic expectations for a compliant e-invoicing process underlying most EU Member States’ laws in this area

Solid basis for meeting tax requirements across the EU

Solid basis for a tax audit

Overview of the end-to-end process for e-invoices using commonly available “classes” of compliance approaches

Check-list to ensure controls are in place where needed, but leaving choice as to implementation (listing examples)

For solution vendors to demonstrate adherence to good practices



The Guidelines are addressed to:

All companies engaged in e-invoicing

Large, medium small, micro enterprises- maybe it’s not one size fits all -

Service and solution providers offering e-invoicing functionality

Internal and external auditors

VAT auditors in tax administrations



Business

Internal control

External audit

Taxaudit

in control statement (SOX)

SOX-audit

Other audit techniques

Preplanning



Process overview: life cycle



Archiving and auditability

Storage in compliant archive during mandatory period

Issues: time, venue, segregation of duties, access, search criteria, readability, audit trail….



Trading partner off-boarding

Discontinuation of trading partner or service provider relationship

Issues: hand-over of originals (for outsourced storage), termination of processes and contracts etc



Summary recommendations at this stage

Much positive feedbackOne set of comments yet to be incorporated

The e-Invoicing Compliance Guidelines are endorsed by the Expert Group on e-InvoicingMore than 10 solution providers and end users have shared initial self-assessments using the GuidelinesThe invitation still stands

We invite companies, service providers and developers of e-invoicing solutions to assess the applicabilityWe invite all auditors specialising in e-invoicing applications and VAT administrations to review the Guidelines



Misunderstandings

For professionals, not SMEsTools for different target groups can be created

Phase II will create SME versionRead Commentary first

Describes all available methodsNot simply a guide for 2001 Directive implementationAddresses entire spectrum of adequate business control frameworks, no favorites between process-or data-level controls etc

©2005 CEN – all rights reserved©2005 CEN – all rights reserved


Questions?

Joost Kuipers : [email protected](chair)

Mounir El Khoury : [email protected](editor)

mailto:[email protected]



4 th CEN Industry Conference on Electronic invoicing and compliance. Brussels, June 2009 - 23 -

TG 3: Cost effective means to guarantee authenticity & integrity

Johan Borendal – TrustWeaver (Chair)Nick Pope – Thales e-Security (Technical Editor)

eInvoicing Public Meeting Brussels, 18 June 2009



One EU



TG2 SG1 and TG3:Compliance Guidelines





Terms of Reference

Minimise unnecessary costs to businesses

Ensure that major risks identified by Tax Authorities are addressed

“Cost-effective authenticity and integrity of electronic invoices and related business documents regardless of formats and technologies”



CEN eInvoicing WG 3: Terms of Reference

Can include:Authenticity & integrity in transferMaintain authenticity & integrity over period of storage





eInvoicing main legal pressure point for business

Applicable to other aspects of eBusiness & eGovernment





Addressing authenticity & integrity by a range of methods including those from current Directive




TG2 Good Practice vsTG3 Requirements & Controls

A & I

Signatures

EDI

Controls

Requirements

SelfBilling

eInvoicePreparation

eInvoiceTranslation

WG2 WG3Mechanisms

Protocols

Archiving & audit



Class of Business Implementation

Wide range of business solutions to e-Invoicing in existence across EU

VAT Directive 2006/112 Identifies for Authenticity & Integrity:

EDIAdvanced Electronic SignatureOther accepted by Member State

Guidelines:Recognise that authenticity & integrity only one aspect of business operations

Generalise Directive classifications to incorporate other aspects of business operationsBasic options of process- or data-level controls



Classes Identified to date

A) Business solutions exclusively relying on the transparency of individual trading

partners’ internal business controls to prove sales transactions to

tax administrations.

B) Business solutions relying on basic business controls augmented by

controlled data exchanges (e.g. EDI) to ensure that real and

unchanged invoices exist between trading partners and can be made available

to tax auditors.

C) Business solutions relying on basic business controls augmented by data level controls (e.g. advanced electronic signatures) to

ensure that real and unchanged invoice data exists between trading partners

and can be made available to tax auditors.

D) Business solutions relying on basic business controls augmented by central "safe-keeping" of invoice data to ensure that real and

unchanged invoice data exists between trading partners and can be made

available to tax auditors.



Class A - internal business controls

Relying on the transparency of individual trading partners’ internal business controls

Not explicitly referenced in the Compliance Matrix

Method for ensuring compliance and auditability depends largely on the type of organization and the way in which certain processes and controls are naturally implemented



Class B - controlled data exchanges

e.g. EDI

Every leg must have controls in placeProcessingTransmissionStorage



Class C – Data level controls

e.g. Advanced Electronic Signatures

May be used to protect invoice When sending/making available

and depending on form of signatureIn storage



Class D – “SafeKeeping”

Revolves around outsourcing to a trusted party (trading partner e.g. supplier portal or service provider)

Trusted to keep e-invoices safe throughout life-cycle including storage



Conclusion

Authenticity and integrity integral with other aspects of e-invoicing

In guidelines considered as part of overall business processes

4 classes of business implementation currently identified building on but not limited to classifications for authenticity & integrity in Directive 2006/112

In compliance matrix can select requirements relating to a particular implementation class



Questions?

Johan Borendal: [email protected](chair)Nick Pope: [email protected](editor)





Good use of the Compliance Guidelines

Isabelle DesmeytereChristiaan van der Valk



Too detailed or maybe not detailed enough?

Example: Step 4 of the invoicing process: Send or make available



The classes in practice

Categorization is conceptual only – not a straightjacket

Framework to assist trading partners in optimizing controls for specific risks in every step of their processObjective: offer different models that can fit maximum of trading scenarios

Many implementation examples per control in each class

Businesses to decide freely which are most beneficial in which circumstances



41

Class A scenario #1

Transparent (micro-)enterprisePrima facie auditability: few trading partners, low staff turnover and

change rateExchange e.g. PDF via email, signed or unsigned

Storage on e.g. DVD or online through ISP



42

Class A scenario #2

Large corporate with high degree of internal control

Auditability inherent in matching being reproducible / strong audit trails

Well-documented processes, frequent internal and external audits

Strong archiving solutionTakes two to tango: trading partner compliance

position must be considered (Class A-D )



� 2008 CEN all rights43

Class B scenario

Emphasis of controls/auditability in exchange mechanism: secure transmission, automated syntax

checkingAlways structured data; normally no conversion of

the invoice as issued – strong audit trail if conversionsStrong archiving solution



44

Class C scenario

Emphasis of controls/auditability on the data level (sign/validate)

No changes/conversions of original invoice (dual feed + audit trail possbile)



45

Class D scenario

Invoices created for trading partner never leave single secure environment: web consultation/audit possible, as well as

download of copy « data »Party offering secure safe-keeping has

strong internal controlsNo changes/conversions of original invoiceIf larger trading partner offers the service, it

will usually use Class AStrong archiving solution



Taxable persons can leverage service providers to outsource tax-relevant processes. Tax-wise this does not change anything.

Supplier’s service provider can issue « in his name and on behalf »

Attention points:On- and off-boarding controls

First and last mileConversions in multi-corner models



COMPANY A self-assessment

Connecting PO and non-PO suppliers

40+ countries in scope40+ supplier VAT jurisdictions33 COMPANY A subsidiary VAT jurisdictions

One-stop service providerAlso responsible for interoperability with suppliers’ own solutions (including other SPs)

Storage offered to suppliers, COMPANY A performs own storage





Ensure buyer acceptance

Ensure supplier agreement

Ensure supplier training

Ensure coordinated use of security mechanisms

Ensure sufficient testing prior to production





Ensure SP issues complete invoice

Ensure SP issues all supplier’s invoices

Ensure supplier has all data of issued invoice



Legal and regulatory inhibitors to the acceptance of Electronic Invoicing

Tony Nisbett, IBM & EDIFICE

eInvoicing Public Meeting Brussels, 19 June 2008



One EU



TG2 SG1 and TG3:Compliance Guidelines





Classes Identified to date

A) Business solutions exclusively relying on the transparency of individual trading

partners’ internal business controls to prove sales transactions to

tax administrations.




to tax auditors.




D) Business solutions relying on basic business controls augmented by central "safe-keeping" of invoice data to ensure that real and

unchanged invoice data exists between trading partners and can be made

available to tax auditors.



Mapping to current legislation

A) UNAVAILABLE IN AT LEAST 2/3 OF EU MEMBER STATES




to tax auditors.




D) UNAVAILABLE IN AT LEAST 2/3 OF EU MEMBER STATES



Legal & regulatory inhibitors to the acceptance of Electronic Invoicing

BackgroundObjectivesProceedingsSelection of Main Areas of InterestIssue GroupsIssue Evaluation TemplatesIssues on the CEN/e-invoicing PortalDo current proposals help?



BackgroundEU and national VAT legislation

Are not in synch. So >>

Many alternative possibilities for implementation offered to Member States



ObjectivesCEN/ISSS Electronic Invoicing Workshop Phase 2Compliance Group – WG2/Task Group (TG) 2

TasksMonitoring the legal requirements in member states as regards cross border exchange of electronic invoices

Recommendation of changes in the legal environment for electronic invoicing



ProceedingsCould have

Enumerated all electronic invoicing issues in all Member StatesIssued Lengthy questionnaire to stakeholdersDeliberated for years without achieving anything

InsteadDirect approach

Real issues and challenges analysed by people who are actually dong this as their day-job



Original Extensive “Special Challenges” - Categories

Buyer acceptance of e-invoicingSpecial issues concerning e-invoicingEDI definitionEDI Interchange agreementEDI Security and audit trailEDI Summary statementEDI Other requirementsElectronic signatures and Certificates Other methodsOutsourcing e-invoicing processes GeneralOutsourcing of Invoice issueOutsourcing E-signature issues

Outsourced issue authorisationOutsourcing buyer functionsOutsourcing Buyer's authorizationInvoice process requirements Invoice contentCredit NoteSelf-billing GeneralSelf-billing Supplier acceptance of invoiceSelf-billing agreement Self-billing Hybrid forms Self-billing E-signature issuesArchiving GeneralArchiving Outsourcing of archivalArchiving Outsourcing agreement



Final “Special Challenge” List – Issue Groups

Buyer RequirementsElectronic Signatures & Qualified CertificatesOther Methods to ensure Authenticity & IntegrityInvoice Process RequirementsCross BorderEDISelf BillingOutsourcing

Invoice IssueBuyer Functions

ArchivingStorage PeriodForm/FormatLocation



Issue Evaluation TemplatesCommon Feature of Sub Groups 1 and 2

multi line spreadsheet – control list of issuesEach line has an Issue Evaluation Template

Problem StatementIssue CategoryProblem Description

Countries where problem evidentAppropriate EU Member StatesAll EU Member States

Suggested resolution (or evidence of good practice)Process of Implementing the resolution

Group’s suggestion(s)Time period for implementing the resolution



Sample Issue Evaluation Template



Issues are posted on Electronic Invoicing Portal

42 Issue Evaluation TemplatesWork Group 1 developed e-Invoicing Portalhttp://www.e-invoice-gateway.net.Open issues for discussion to:

Industrytrade sectorother interested parties

Invitation to comment on and submit further issues to portal in next month

for WG2 SG2 review to be made available for discussion on portalmust be:

business justifiedPracticalResolvable in reasonable time scalewithin WG2/SG2 scope

http://www.e-invoice-gateway.net/



How do current Commission Proposal and other pertinent documents help with the issues?

WG supports attempts to remove barriers to eInvoicing, especially cross border.

Reduction in options availableStandardise use of signaturesClearer definition of storage requirementsConversion of paper to electronicLocation of Storage/Archives

Open issues for discussion:Equal TreatmentAcceptance and general legal frameworksConverting electronic to paperHarmonising Tax, Accounting and other lawsEDI Summary Reports



Questions?

Tony Nisbett: [email protected](chair)

Mounir El Khoury : [email protected](editor)





General questions?

Joost Kuipers, TG2 Chair