Taxation Ruling

TR 97/21

Income tax: record keeping - electronic records

This version is no longer current. Please follow this link to view the current version.

• Please note that the PDF version is the authorised version of this ruling.
  This document has changed over time. View its history.

FOI status:

May be releasedFOI number: I 1017252

Preamble

What this Ruling is about

Class of person/arrangement

1. This Ruling explains to a person, including a company, carrying on a business, the principles associated with the retention of electronic records for the purposes of section 262A of the Income Tax Assessment Act 1936 ('the Act'). Where the person uses a computer, either partly or fully, to run an accounting system, this Ruling sets out our views on what are sufficient electronic records to be retained to record and explain all transactions and other acts engaged in by such a person for the purposes of the Act. This Ruling also sets out our views on access to electronic records under section 263 of the Act.

2. Although section 262A applies for any purpose of the Act, this Ruling considers the section as it relates to the income and expenditure of a person carrying on a business.

3. This Ruling is the third in a series of Rulings released by the Australian Taxation Office ('the ATO') on record keeping. The first Ruling is Taxation Ruling TR 96/7 on the general principles of record keeping. The second in the series is Taxation Ruling TR 96/11 that sets out our views on what records are sufficient for the purposes of section 262A to record income from taxi takings. The ATO has also issued a publication called 'A Guide to Keeping Your Business Records'. The Rulings and publication provide further information to a person carrying on a business on their record keeping responsibilities and should be read in conjunction with this Ruling.

4. This Ruling does not deal with the retention of electronic records created from business transactions carried out through the Internet or through the use of Smartcards.

Definitions

5. In this Ruling:

'documents and records' means

all documents and records including those documents and records kept in electronic form in a computer or in other electronic storage media;

'paper records' means

all written documentation, whether in hand writing or by typewriter, computer or other means of recording on paper;

'imaging' means

the scanning of an image into a digitised form to be stored electronically;

'electronically' means

held or processed by means of a computer;

'electronic storage medium' includes

hard disc, removable hard disc, diskette, floppy disc, CD-ROM, optical disc or magnetic tapes; and

'EDI' means

Electronic Data Interchange.

Ruling

Computerised record keeping systems

6. When a person carrying on a business chooses to process and keep records in electronic form, the records must be in a form that ATO staff can access and understand in order to ascertain the person's taxation liability. Under section 25A of the Acts Interpretation Act 1901 the person can choose at any time to satisfy access requests by providing a hard or printed copy of their electronic records and where necessary, system documentation, notwithstanding that the person's business records may be kept electronically.

7. The information contained in a record kept in a computerised accounting system is generally the same as would be contained in a manual accounting system.

8. We acknowledge that there are risks associated with the processing and retention of records on a computer system that are not generally associated with manual record keeping. Those risks include:

•

the inadvertent destruction or corruption of electronic records;

•

the unauthorised tampering with electronic records; and

•

the possibility that electronic records and operating systems will become obsolete due to the constant upgrading or changing of computer systems over time.

System controls

9. We consider that a person carrying on a business with a computerised accounting system generally has a series of adequate controls available to safeguard the security and integrity of the records processed and kept in that system. These can include:

•

access controls;

•

input and output controls;

•

processing controls; and

•

back-up controls.

10. The ATO considers that the level of controls required by a business is a matter for the particular business to determine provided it can demonstrate that the records kept in the computer system are secure and accurate.

11. We have included as Appendix A of this Ruling a checklist of the electronic records that, providing adequate controls are in place, a person carrying on a business could keep to explain the essential features (i.e., the date, amount and character) of every transaction and enable the person's taxation liability to be ascertained. The checklist is provided as a guide only. Depending on the nature and size of the business, not all of the records listed may be applicable.

Storage of paper records in electronic form

12. A business using either a manual or a computerised accounting system may want to store and keep paper records in electronic form. Where paper records are produced or received in the course of carrying on business, the ATO accepts the imaging of those records onto an electronic storage medium provided that the electronic copies are a true and clear reproduction of the original paper records.

13. Where paper records are imaged and stored electronically the requirements of section 262A are satisfied if they are:

•

not altered or manipulated once stored;

•

retained for the statutory period of five years; and

•

capable of being retrieved and read at all times by ATO staff. The taxpayer is expected to provide appropriate facilities for the viewing of the electronic records kept in that format and where necessary, the printing of a paper copy or the provision of an electronic copy.

The ATO considers that paper records imaged and stored electronically should be:

•

read only; and

•

subject to adequate back-up control, i.e., a duplicate back-up copy of the stored records must be kept at all times at a safe location.

Paper records that can be imaged and stored include:

•

invoices, purchase orders, receipts, vouchers, credit notes, delivery dockets, etc.;

•

bank statements and other bank records and documents; and

•

any other paper source documents produced or received in the course of carrying on a business.

Original paper records that have been imaged onto an electronic storage medium need not be retained for the purposes of the Act.

System documentation

14. To ensure that the records are being maintained in accordance with subsections 262A(1), (3) and (4), a person should have an understanding of their computer system. System documents should be retained to explain the basic aspects of the system so ATO officers can ascertain that the system is doing what it is claimed to do.

15. Where systems (regardless of their level of sophistication) have changed over time, records are to be kept to allow the original data to be reconstructed to satisfy section 262A. The records to be kept include:

•

a chronological record and explanation of all changes or upgrades to the software and hardware employed in the system, including explanations of how the new system can recreate an original record;

•

where applicable, explanations of migrations of data that may have taken place across either software or hardware;

•

a detailed, documented record of the controls which maintain the integrity of the old system and of the records processed and transmitted; and

•

explanations of archival and back-up facilities under that system.

Any data held under an old system is to be capable of conversion to a form that is readily readable and retrievable by the ATO. Thus, the ATO would prefer that data be converted to a standard data format, e.g., ASCII, DBF or a spreadsheet format.

Access to computer records

16. Under section 263 of the Act, the Commissioner or any duly authorised officer has the right of full and free access to all buildings, places and documents, including electronically stored records required for the purposes of the Act. The provision enables an authorised officer to access and copy records held on an electronic storage medium.

17. In addition, subsection 263(3) requires the occupier of a building or place to provide an authorised officer with all reasonable facilities and assistance for the effective exercise of powers under the section. In the context of electronically stored records, reasonable facilities and assistance extend, where necessary, to the provision of login codes, keys, passwords, etc., and access to printed copies of the records as well as allowing the authorised officer to read computer and software manuals.

18. Where it is necessary to download electronic records onto ATO computers, it is the policy of the ATO to invite taxpayers to carry out the copying of these electronic records for and on behalf of the ATO on tapes or disks provided by the ATO. Where this is inconvenient or impractical, the ATO undertakes, with the approval of the taxpayers, to carry out that downloading process.

Electronic data interchange

19. Many businesses transfer data and information electronically to both internal and external sources. This process is commonly referred to as Electronic Data Interchange ('EDI'). A special feature of EDI is that most of the transfers are done automatically between respective computers.

20. Where a person carrying on a business uses EDI, we consider section 262A requires the person to keep records that explain all EDI transactions that are relevant for any purpose of the Act. The record keeping requirements for EDI are the same as for other computer records as set out in the preceding paragraphs of this Ruling.

Date of effect

21. This Ruling applies to years commencing both before and after its date of issue.

Explanations

Electronic records

22. Records made by and stored in a computer are recognised as documents for the purposes of Commonwealth legislation. Section 25 of the Acts Interpretation Act 1901 extends the ordinary meaning of the word record to include information stored by means of a computer. The reference in subsection 262A(1) of the Act to the keeping of records therefore includes a reference to information stored or recorded by means of a computer. A person carrying on a business must keep documents and records made by and/or stored in a computer system. By virtue of subsection 262A(3), the person is required to keep these computer records in the English language or in a form readily convertible into English. The explanatory memorandum to the Taxation Laws Amendment Bill (No 5) 1989 that introduced subsection 262A(3) into the Act explained:

'Subsection 262A(3) obliges a person who is required by the section to keep records, to keep those records:

•

by paragraph (a) - in the English language or, if not in written form (e.g., in an electronic medium such as magnetic tape or computer disc), in a form which is readily accessible and convertible into writing in English; ...'

23. In addition, the admissibility of computer produced evidence in Federal Courts is now governed by various provisions in the Commonwealth Evidence Act 1995 ('the Evidence Act'). Broadly speaking, computer documents are admissible evidence in taxation matters subject to relevance and, where necessary, proof as to the competence of the computer device. Even prior to the introduction of the Evidence Act, documents held in electronic form had been accepted as admissible evidence: DFC of T v. Capron 93 ATC 4144; (1993) 25 ATR 142.

24. The ATO has for some time recognised that advances in technology have meant that many taxpayers now process and keep their accounting records electronically. We acknowledge that there are many advantages associated with such an approach. However, the ATO's concern is that the records, whether kept on paper or electronically, must be kept accurately so as to enable that person's liability to be readily ascertained.

25. Under section 25A of the Acts Interpretation Act 1901, where a person who keeps business records of information by means of a computer is required to produce those records under the access provisions contained in the Act, the person can choose to satisfy the access request by providing the ATO with a hard or printed copy of the electronic records in a form capable of being understood by the ATO. In some circumstances, a hard copy of system documentation explaining how the system works also needs to be made available so the ATO can ensure that the records kept in the system are correct and maintained in accordance with subsections 262A(1), (3) and (4). Paragraphs 14 and 15 of the Ruling part of this Ruling and paragraphs 31 and 32 of the Explanations part deal with the range of system documentation required to be retained.

Computerised record keeping systems

26. There are many similarities between a manual accounting system and one run by a computer. Essentially, both systems involve the updating of a general ledger and subsidiary ledgers. Many businesses use computerised accounting packages to process their financial transactions and to prepare their periodical accounts. Different businesses have different needs in terms of the type and level of complexity of the computerised accounting system they wish to operate. Some small businesses find it adequate to operate from a basic accounting system, e.g., from a computerised cash flow system where the computer acts merely as an accumulator and produces various reports at regular intervals. Other businesses need to operate from highly sophisticated and fully integrated real time systems where one single transaction or entry in the system triggers the processing and recording of many other transactions, e.g., where a sale transaction will simultaneously update various ledger accounts, adjust stock levels, etc. We consider that computerised accounting systems operate essentially in the same manner as manual accounting systems and the records kept in them are, in principle, the same as those kept under manual accounting systems.

System controls

27. Significant concerns that the ATO has about the retention of electronic records are the risk of loss of integrity or corruption of those records and the inability over time of taxpayers to reconstruct records that have been inadvertently destroyed, manipulated or tampered with, or altered or lost within a computerised accounting system. It is normal practice for a person operating such a system in a business to safeguard the security and integrity of the records kept in that system through the use of system controls. Those commonly expected to be in place include:

•

access controls, i.e., the controls over access to a computer system by some form of identity recognition, such as a password, card system, personal identification number ('PIN') or some combination of these;

•

input and output controls, i.e., the controls which ensure the accuracy and security of the information received and transmitted;

•

processing controls, i.e., the controls which protect and ensure the integrity of the information processed by the system; and

•

back-up controls, i.e., the controls that guarantee the retention of back-up copies of computer files, computer programs and the recovery of computer records in case of system failure.

28. The size of a business often dictates the level of sophistication of the computerised accounting system that the business adopts. This, in turn, impacts on the level of complexity of the system controls in place. The ATO takes the view that the levels of controls required by a business are a matter entirely for the business to determine after assessing its own requirements, provided that the records kept in the computer system are secure and accurate.

29. We stated in Taxation Ruling TR 96/7 that, in circumstances where records of individual transactions provide no additional information about the essential features of the transactions, a person can record and explain those transactions by recording and explaining groups of transactions, i.e., in the form of summary records. The same conclusion applies to records held electronically. For example, in TR 96/7, we advised that rolls of cash register tapes may be discarded after one month, provided there had been a reconciliation of the Z-totals with actual cash and bankings for that period. In this case, an electronic reconciliation, as described above, would be acceptable to the ATO provided that the reconciliation is kept for the statutory period of five years.

Storage of paper records in electronic form

30. The ATO considers that where it is intended to convert original paper records to microfilm or computer output microfiche, the conversion needs to be carried out in such a manner that the film/fiche represents a true and clear reproduction of the original documentation. The ATO acknowledges that microfilm/ microfiche technology, although not entirely obsolete, is not commonly utilised these days and that the conversion of paper records onto an electronic storage medium, by way of an imaging process, has effectively replaced that technology. The ATO therefore accepts the imaging of paper records provided the conversion process produces electronic copies that are a complete, true and clear reproduction of the original paper records. For instance, Optical Character Recognition conversion processes that do not produce a 100% accurate reproduction of original documents are not acceptable to the ATO.

System documentation

31. Where a person keeps records within a computerised accounting system, the ATO may require an explanation of the basic aspects of the computer system. To that end, certain system documents are to be retained to assist ATO officers ascertain that the system is doing what it is claimed to do. In the case of a simple accounting software package, these documents may be limited to a system manual that explains:

•

the operation of the various components of the system;

•

the controls built in the system; and

•

the flow of data from input to output.

32. With a sophisticated computerised accounting system, the documents need to include:

•

details of the file organisation and controls;

•

details of record contents, context and structure;

•

the program logic, in the case of computer programs produced in-house; and

•

audit trails or logs of records added, deleted and amended that relate to the accounting system.

Electronic data interchange

33. EDI is widely understood to mean the transfer of data, by agreed message standards, electronically from computer to computer. The exchange of information can be by way of document transfer only (i.e., where a document is merely sent electronically to a receiver, not unlike an invoice sent by mail) or by interactive mode (i.e., where the document results from an actual exchange of information, not unlike an interaction by telephone).

34. The ATO considers that there should be no difference in the general principles governing the records processed and kept in an EDI environment and in a normal computerised accounting system. Taxpayers who operate in an EDI environment ordinarily have in place, for their own purposes, adequate controls to safeguard the security and integrity of their transactions. Those controls have been discussed earlier.

35. Users of EDI should ensure that controls are in place to prevent unauthorised access to their EDI network by the use of access passwords, or some other form of authentication (e.g., electronic signatures), together with a secure user profile that would define the identities of the trading partners, the transaction types that can be exchanged, the standards and versions used and the direction of the exchange. This profile would ordinarily be encrypted and, in turn, secured against unlawful access by the use of user passwords, PIN numbers or access keys. In addition, EDI messages should be protected against unauthorised reading by the use of encryption techniques applied to all or part of the messages. Providing that these controls are in place, we consider that the retention requirements as stated previously in this Ruling apply equally in an EDI environment.

36. A copy of all original transmitted and received messages in their own interchanged image (e.g., EDIFACT or ANSI X12 image) is required, as well as audit trails, and logs of all EDI transactions are to be retained. The audit trails allow a transaction to be traced through a system forward to its ultimate destination and backward to its beginning through relevant source transactions. Where messages have been encrypted, those encryptions must be capable of being removed to allow for authorised officers to understand the contents of the message.

Examples

Example 1

The facts

37. Joe's Corner Mini Mart is a small family business with an annual turnover of about $300,000. Its sales are strictly on a cash basis and are recorded through a cash register. It purchases its supplies either by cash or on 30 day terms. The business pays its expense accounts either by cash from the till (for small expenses) or through a business cheque account for items of stock and other expenses. It employs one casual employee for after school and week end hours. The employee has access to the cash register but not to the computer system that only Joe operates.

The system

38. Joe has adopted an electronic cashbook system because of the nature and size of his business. Although he is the only one who operates the system, he has built into it a password control to stop unauthorised access to his accounts. The system provides him with up to date information on what payments he has made (by cash or cheque) for stock or running expenses; daily total receipts he has banked and reconciled with his cash register tapes; a bank reconciliation showing deposits made and any withdrawals; periodical trial balances; income and expense reports; and even a balance sheet.

39. Joe can download these reports on a computer disk or print out a copy for his accountant or bank manager at any time. On advice from his software provider, at the end of every month Joe backs-up all his accounts onto a floppy disk, which he keeps at home in case the computer system crashes. He has been provided with a system manual by his computer company and a short hands-on training session on the operation of the system. He keeps invoices sent to him by suppliers and bank statements of his business account in paper form in a filing cabinet. He also keeps a purchase order book to order stock.

Our view

40. We consider that Joe has appropriate system controls, including file back-up facilities, to ensure the security and integrity of the electronic records kept in the system. He also has a system manual to explain to an ATO officer what the system does and how input data is processed by the system in producing the various records and reports.

41. The electronic records kept in the electronic cash book can be audit trailed to original transactions, groups of transactions or summaries of transactions. For instance, the receipts entry in his cashbook for sales made on one particular day can be traced back to a reconciled Z-total on a cash register tape and can be cross referenced to a reconciled banking deposit entry. The reconciled entry also shows any personal drawings, any cash payments for expenses or stock, etc., for that day.

42. Joe has integrated in the accounting system the use of a simple but convenient computer package that enables him to have better control over his accounts, to know at any point in time his liquidity position and to have a better financial picture of his business.

Example 2

The facts

43. The TC Hotel is an inner suburban pub owned by a husband and wife with an extensive bar trade, restaurant and bistro facilities, a drive through service, poker machines, TAB racing facilities and 30 motel-type accommodation rooms. Its annual turnover currently stands at $7-8 million. Most of its revenue is derived in cash or through credit cards although recently it has started catering through its restaurant and bistro for local businesses where payment is made by cheque on 30-day account.

44. The hotel has also recently introduced EFTPOS facilities in its restaurant, drive-through bottle shop and gaming areas. A barcode scanner is also in operation in the drive-through as this seems to speed up customer service. All of its cash registers are linked to a central computer facility located in the administration area and every transaction is recorded on a real time basis, updating relevant ledgers immediately the transaction occurs. The business purchases all of its supplies on credit and takes full advantage of either the 30- or 60-day terms offered. The hotel employs as many as 30 employees, who are either permanent full timers or work only on a casual basis.

The system

45. The business' computer system is fully integrated and revolves around a general ledger. It has the following features:

•

it operates on an open item basis, i.e., each transaction is processed immediately it occurs and triggers the updating of relevant ledgers. For instance, the scanning of a carton of beer in the drive-through department triggers a series of simultaneous transactions. Once the sale is completed either by cash, credit card or through EFTPOS, the inventory records are also immediately updated giving an up to the minute view of the stock level of that particular item;

•

each product's sales can also be called up on screen for viewing, comparison with past months' sales, etc.;

•

reorder points are automatically set in the computer;

•

other reports are produced on all aspects of the business' trading activities including full current bank reconciliation, trial balance at any time, all transaction history and full audit trail;

•

the system operates as a network allowing for a number of users to access it at various locations within the hotel at any time. A multi-level password system is employed with some staff only permitted to operate certain functions of the system;

•

system support is provided by an elaborate manual, on-screen help functions, demonstration disks and technical support from the software provider; and

•

backing-up of the computer files is carried out at the end of each day and the business records are downloaded to floppy disks periodically for the business' external accountants.

Our view

46. This business' system, although more sophisticated than the one in the earlier example, is nevertheless subject to tight controls and security safeguards. Access controls are available, as are appropriate audit trails to all transactions that enable the tracing back of any transaction through the system to its origin. The business also has in place a system for backing-up its electronic records. Explanations of the system are provided by the manual and other facilities, as well as system support from the software manufacturer. The essential features of each transaction (or batch of transactions) can be explained by the taxpayer on request.

Example 3

The facts

47. Millie Maker ('MM') runs a medium-sized printing business. She uses a commercial software accounting package in the business and receives system support from the software manufacturer. MM has retained the software manual that explains the basic aspects of the system she uses.

Issue 1

48. MM has found that storing paper purchase invoices, statements, purchase orders, receipts, etc., is time consuming and cumbersome. She wishes to explore acceptable alternatives to reduce storage and speed up the retrieval of these records while ensuring that the records are in an acceptable format for ATO purposes.

49. MM has approached Imagery P/L to image her records onto CD-ROMs into a format that is compatible with her current computer system. This will be done once every two months. Original paper records are to be kept prior to being imaged. However, MM proposes to discard the paper records once they are imaged. Her computer system will readily allow her to access and where required, print a hard copy of any of the electronic records. In doing so, an audit trail will automatically be produced to provide details of what actions were taken with that record. MM also proposes to retain an electronic copy of her business' tax returns, which could be reproduced on paper or electronically on request for a tax officer. She seeks from us our view on her proposal.

Issue 2

50. With the increase in business activity, MM is considering whether to upgrade to a more powerful accounting package from the same software manufacturer or to change over to a new software product. She is particularly interested in knowing what the ATO requirements will be in this latter case as her business records have, for the last five years, been stored under one system.

Our view

Issue 1

51. The ATO would have no difficulty with this proposed system provided the imaged records represent a true and complete copy of the original records. MM would need to confirm that from Imagery P/L. We would also prefer that the imaged records be in 'read only' format and for a back-up copy of the records to be stored at a safe location, e.g., at MM's home. We also accept that once the records have been appropriately imaged, the paper records can be discarded for income tax purposes. During the course of an audit, MM can choose to satisfy our access requests by providing a printed copy of the imaged records sought. However, it may be more practical and less time consuming for those records to be downloaded onto a disk and made available to us in electronic form.

Issue 2

52. If MM is to simply upgrade, i.e., move from one version of a commercial package to an updated one, there should be no difficulty for the records kept under the old system to be read and accessed under the new system. This is generally provided for in upgrades by software manufacturers. However, she would still need to retain sufficient documentation to explain to us how records under the old system can be recreated under the new system. Generally, the system manual should provide that information. She should check with the software manufacturer on that point.

53. However, should she decide to opt for a new software product, she would need to consider whether to have the records under the old system converted to a form that is acceptable and readable under the new system so that, where necessary, she and an ATO officer can readily access them. Alternatively, she can retain the old records in their current format on some form of electronic storage medium, e.g., CD-ROM, but ensure that there is some mechanism available to have them converted to a form readily readable and retrievable by us. In this case, conversion to a standard data format such as ASCII, DBF or a spreadsheet format would be acceptable. In addition, she would need to retain sufficient information about how the old system operated, the controls (including audit trails) which were in place, and the archiving and backing up facilities. For commercial packages, this information is generally available in the system manual.

Commissioner of Taxation
5 November 1997

APPENDIX A

CHECKLIST OF ELECTRONIC RECORDS

(The following checklist represents only a guide and should not be taken as an exhaustive list of all records required to explain transactions.)

a)

Electronic records (or summary records) of sales transactions such as:

•

cash sales, including reconciliations made of cash register tapes;

•

credit sales, including electronic copies of merchant statements for sales made by you or alternatively, electronic copies of summary statements of reconciled credit transactions;

•

invoices and statements issued, including invoices and statements that you have sent electronically (e.g., via EDI) or imaged copies of hard copy invoices and statements which you have sent;

•

credit notes issued for returned goods;

•

updates and adjustments to the debtors' ledger; and

•

where appropriate, stock used for private purposes.

b)

Electronic records (or summary records) of purchase transactions including:

•

cash and credit purchases, including credit card purchases;

•

purchase orders issued;

•

invoices and statements received from suppliers; these would include invoices and statements that suppliers have sent electronically (e.g., via EDI) to you or imaged copies of hard copy invoices and statements sent to you;

•

payment details;

•

updates and adjustments to the creditors' ledger; and

•

inventory details, including stocktake lists, price lists details, etc.

c)

Electronic records (or summary records) of all other items of income and expenditure such as:

•

business expenses like rent, electricity, telephone, insurance, etc.;

•

motor vehicle expenses, including records of information kept in car log books and details of odometer readings.

d)

Electronic records of quotes provided.

e)

Electronic records of information obtained from job sheets.

f)

Electronic records (or summary records) of banking transactions including:

•

details of deposits;

•

details of withdrawals or payments;

•

bank statements;

•

bank reconciliations; and

•

details of any term deposits and any other investments associated with the business.

g)

Electronic records of the purchase and disposal of assets; depreciation schedules; etc.

h)

Electronic records of all entries to the general ledger and a reconciliation of that ledger to all other subsidiary ledgers.

i)

Electronic records of:

•

profit and loss statement;

•

balance sheet;

•

other financial statements;

•

schedule of work in progress and raw materials, where applicable, at the end of the financial year; and

•

all wages transactions.

j)

Audit trails or logs of all electronic transactions including deletions, additions and changes to accounting data.

Previously released in draft form as TR 97/D4

References

ATO references:
NO 97/5586-7

Related Rulings/Determinations:

TR 97/21W
TR 96/7
TR 96/11

Subject References:
business records
electronic data interchange
record keeping
records

Legislative References:
- ITAA 262A
- ITAA 262A(1)
- ITAA 262A(3)
- ITAA 262A(4)
- ITAA 263
- ITAA 263(3)
AIA 25
AIA 25A

Other References:
Explanatory Memorandum: Taxation Laws Amendment Bill (No 5) 1989