Since the adoption of ERP systems[2] and accounting software at the end of the last century, information systems have been widely used by auditors who now often rely on the data and reports that are generated by such systems (the era of information). However, given the plethora of systems on the market, accessing this data may require time and effort. Every system has its own data structures, data definitions, data formats and ways of storing the data. Auditors often need help to understand the data and this restricts their ability to act independently.

To make the collection of audit data more efficient and reliable, experts in auditing techniques representing businesses, governments, software developers and universities worked together under the umbrella of the International Standards Organization (ISO) to standardize the data required for financial auditing. They based their work on existing national standards, such as the Swedish SIE format[3], the Dutch Auditfile Financieel[4], China National Audit Office Version 2 Audit Files, the American Institute of Certified Public Accountants’ Audit Data Standards[5], and international standard OECD SAF-T[6] (Standard Audit File for Tax), which has been adopted by several countries. This resulted, in 2019, in the publication of International Standard ISO 21378:2019 – also known as the Audit Data Collection Standard (ADCS).

What auditors need is a universal adapter for ERP systems, just like we use an adapter to plug in electronic devices when we are in a country that uses a different type of electric plug.

The ADCS aims at bridging the “gap of understanding” between auditors, auditees, software developers and IT professionals, by creating a common mechanism for expressing information stored in accounting and ERP systems in an independent manner. It describes a way to access data for audit purposes, regardless of the system or underlying data structures. In other words, it is a data model (Figure 1) for financial audit purposes.

The Audit Data Collection Standard (ADCS) covers the main areas of accounting and ERP systems and the main business processes in the production supply chain. It consists of eight modules, corresponding to the following areas: Base (BAS), General Ledger (GL), Accounts Receivable (AR), Sales (SAL), Purchase (PUR), Accounts Payable (AP), Inventory (INV) and Property, Plant and Equipment (PPE). The modules, and the interaction points between them, are shown in Figure 2 (readers should note that this is a high-level representation which is not intended to depict all interactions in detail).

In total, the ADCS defines accounting data elements in 71 tables spread across the eight modules. Of particular importance here are the inventory module (INV) which consists of 7 tables, including one called INV Product which lists the basic attributes of inventory items and other tracked items through purchase, use and sales, and another called INV Transaction, which sets out the transaction history impacting the inventory accounts during the specified time period. Figure 3 shows some elements of the INV Transaction table.

The Audit Data Collection Standard, as published, focuses on supporting the financial audits usually performed by large accounting firms. As such it does not focus on other types of audits, for example those performed by governments to ensure the correctness and completeness of declarations regarding indirect taxes and Customs duties.

In general, the latter audits largely require the same data elements as the financial audits for which the ADCS was drawn up, plus certain additional, specific data elements related to Customs and indirect taxation. ISO has therefore endorsed a proposal initiated by the Netherlands to extend the ADCS and enable data related to Customs duties and indirect taxes to be collected in a coherent manner.

Under the auspices of ISO Technical Committee 295 Audit Data Services (convened by China), three new tables have already been added to the Inventory module (see Figure 4 above). The first two contain Customs-specific data elements relating to products or transactions. The third table contains data elements that make it possible to establish a relationship between the data stored in a company’s system and the data stored in the systems of the Customs or tax authorities. It should be noted that data already known to Customs is not requested again, and therefore is not part of the extension (for example, the declaration data).

As Customs-specific data elements relating to products or transactions vary greatly from one Customs territory to another, the structure of the extension tables differs from that of the tables in the ADCS. Data elements are inserted under “characteristics” which can be customized.

The INV Transaction Characteristic table in Figure 5 above shows four characteristics that are specific to Dutch Customs. The data elements include an indication of the level to which they refer (GEN for general, EU for European Union, and NL for the Netherlands). In this example, the data element in line 3 referring to the commodity code applies at EU level. The last two columns show the values of the characteristics. The letter “S” in line 4 referring to VAT means “Standard”, while the “1” is the corresponding value as represented in the company’s ERP system.

The use of the ISO Standard will bring transparency and efficiency to the process of retrieving data when conducting post-audit controls. The query – in other words, the description of the data retrieval process based on the audit objective – will be standardized. The outcome (the dataset) will directly match the purpose of the audit, in terms of both semantics and syntax. In addition, it creates the possibility to standardize the analyses for the auditees, leading to more fairness in supervision and, ultimately, increased willingness to comply on the part of the company. This article does not discuss a Standard for data exchange. However, a proposal (XML, JSON and CSV) has also been submitted to ISO and the Standard will be ready by September 2022 at the latest.

In the Netherlands, we have observed that companies are making increasing efforts to comply with Customs and tax legislation. They invest a huge amount of time and effort into obtaining the right data in the right format, but this can be a complex endeavor, especially for companies which operate in multiple jurisdictions. The ADCS, with its extension for Customs and indirect tax, will support these efforts as it reflects the data requirements of Customs, tax authorities and audit firms, while at the same time establishing the basis for the exchange of the data required. Responding to a request for data from a supervision authority will require nothing more than the “push of a button”. The Standard also provides flexibility. Companies can extend (and improve) the system using their own data characteristics – in order to monitor their internal control, for example. The ADCS and its extension also open up opportunities for the joint development of analytical methods. Software vendors are fully aware of these advantages, and have got involved in the development of the Standard.

Many Customs and tax authorities have adopted strategies which include the objective of becoming data-driven organizations. Artificial Intelligence, Machine Learning, Advanced Data Analytics, Robotics and Block Chain are among the tools and technologies often mentioned in their strategy documents. Such tools and technologies leverage data, and data standardization is key to their implementation because it enables easy access to the data. The ADCS will enable us to be ready for the audits of the future – a future where data is easily accessible and auditors can focus on their core mission.

The extension for Customs and indirect taxes is still under development. It must be ready for publication by September 2023. A list of countries which are participating in or observing the development of the Standard can be found at https://www.iso.org/committee/5648297.html. At present the participants are working on the structure of the extension tables, as well as looking at which information (characteristics) should be included, the naming conventions and the standard maintenance procedure. On behalf of the members of the technical group, Dutch Customs would like to invite other Customs administrations to join in with this effort. We highly desire your input. If you would like to participate in the development of the extension, please contact your country’s ISO Member institute (see https://www.iso.org/members.html).

More information
https://www.iso.org/committee/5648297.html
re.van.t.hof@douane.nl

[1] ISO: International Organization for Standardization

[2] An ERP is an application that makes use of a central database which receives information from various departments within a company. It includes integrated modules dedicated to functions like accounting, inventory management and CRM. An ERP gives companies a single place to store, view, manage and interpret data. Source: https://www.netsuite.com/portal/resource/articles/erp/what-is-erp.shtml