Did you say reliable audit trail ?

In France, having reliable audit trail documentation is mandatory. Although the laws in this respect were implemented some time ago, they still apply! After a long period of tolerance by the French tax administration, many auditors ask for a reliable audit trail to be submitted to them. But what does that mean ?

Quick reminder of the background

While at first the French government offered companies flexibility in how they send their invoices (whether paper or electronic), European Directive 2010/45/EU, applicable in France since 1 January 2014, provides for the use of any means of transmission guaranteeing the authenticity of the origin, integrity of the content and legibility of invoices. To ensure the security of the means used, the French tax administration then approved three possible procedures for issuing and receiving invoices :

• electronic invoices in the form of a structured message, in accordance with the provisions of the French General Tax Code (abbreviated « CGI » in French), more commonly known as « Tax EDI« ;
• electronic invoices with a « qualified » electronic signature, i.e. an advanced electronic signature based on a qualified certificate created by a secure device, within the meaning of the eIDAS Regulation, in accordance with said Regulation, or a level 2** or 3** device, in accordance with the French General Security Reference Framework (abbreviated « RGS » in French);
• all other invoicing methods, such as paper invoices, « simple » electronic invoices (e.g. PDF which are not signed or not secure enough for tax purposes), or « non-tax » EDI-type electronic invoices, provided that a reliable audit trail, more commonly known by its French acronym « PAF », has been created.

What is a reliable audit trail ?

A reliable audit trail is a VAT requirement imposed by the French tax administration. The entities affected by this requirement are obliged to introduce controls for their incoming flows (supplier invoices) and outgoing flows (customer invoices) for all the transactions they initiate (e.g. the delivery of goods and provision of services). In practice, entities must clearly and closely define their management processes in documents, making it possible to report on each transaction from the start (contract, quote, purchase order) to invoicing, the recording of each invoice in the accounts, its payment and archiving (and vice versa).

In particular, this documentation must demonstrate the existence of :

• an uninterrupted flow between the documents,
• documented and regular internal controls guaranteeing the reality, completeness and accuracy of the data constituting the invoices and correct processing of said data.

Reliable audit trail documentation is also an essential prerequisite for optimising and securing processes. For the French tax administration, it essentially meets the objective of combating VAT fraud and false invoices.

Is your entity affected ?

Your entity is affected if you receive and/or collect invoices in paper format, simple PDF format or via any system deemed « insufficiently secure » by the French tax administration. With the digital transition underway and various systems and formats in use, very few companies are completely exempt.

The reliable audit trail requirement currently applies to all companies (including organisations subject to tax), as in practice very few can claim that they send and receive 100% of their invoices in « tax EDI » format or signed by a « qualified » signature.

According to the French tax administration, however, the format and scope of this documentation vary depending on the size of the entity :

• oral documentation is sufficient for VSEs (i.e. for entities with a workforce < 10 people AND revenue OR balance sheet total ≤ €2 million);
• general written documentation is expected for SMEs (with a salaried workforce of between 10 and 249 people AND revenue < €50 million OR balance sheet total < €43 million); 
• detailed written documentation is required for larger companies.

What are the risks in the event of an audit ?

Not having a reliable audit trail could mean the French tax administration is, for example, permitted to reject the right to deduct VAT for the financial years audited, as well as the company’s accounts.

But also :

• €15 per omission or error in the tax information that must be included in invoices (maximum : 25% of the invoice) e.g. if the EU VAT number is missing. 
• Failure to issue an invoice for a sale : a penalty of 50% of the amount of the invoice (which is reduced to 5% if the transaction is justified within 30 days of receiving formal notice).
• Late production of invoices : €150 per invoice issued.
• Failure to produce invoices : €75,000 fine, which may be increased to 50% of the amount invoiced.

Late or very late implementation by the French tax administration, which hinders compliance (particularly for SMEs).

Unlike the Accounting Entries File (abbreviated « FEC » in French) for example, which is another mechanism showing the French tax administration’s improved accounting checks, there were few requests for reliable audit trails during the first years of its implementation, which could explain why taxpayers were unfamiliar with it. But that is no longer the case today. It is in fact systematically requested by auditors in large companies and more and more frequently in SMEs. It is mainly in this last category of businesses that there may not be enough internal resources to prepare compliant documentation (workforce, knowledge, skills) even though the stakes are high (the requirements imposed by the French tax administration are, for example, more extensive than for VSEs; there are many, sometimes complex flows which are not usually structured). So there is a real challenge.

In addition to compliance, what are the benefits for your entity?

A vehicle for improving existing processes

While usually perceived as yet another administrative constraint, creating a reliable audit trail is a real opportunity to overhaul and review existing processes, and to make them more agile and smoother in order to make managing one more efficient.

Securing information flows and internal control

Documenting your invoicing processes and establishing controls is an opportunity to reduce malfunctions and errors and combat various forms of fraud, which are increasingly difficult to detect, by deploying digital technology. This concern fits within a context in which more and more French companies are victims of fraud (whether internal or external) and cyberattacks. Anything that helps to increase the resilience of information systems (including reliable audit trails) helps to reduce the risks, thanks, in particular, to the traceability of flows and access. So are you ready to create your reliable audit trail and prepare this documentation ?

For further : Opening a business in France : Main topics to be considered

How to approach its operational implementation?

Drafting documentation 

The French tax administration does not provide a template. Reliable audit trails include a description of existing processes (i.e. purchases and sales), where it is, in particular, necessary to explain who does what at each stage and by what means.

The use of flowcharts to summarise the flow of documents and information circulated is recommended.

What controls must be implemented to ensure reliability ?

In concrete terms, several controls are expected at each stage of purchasing and sales processes that will be exposed as they will cover the many risks (e.g. fraud, error in the production or processing of information, non-compliance, slowdown in activity or delay in receipts/disbursements, loss or absence of documents, etc.). These controls may be manual or computerised.

The narrative must be focused on the work carried out by your entity to ensure that the invoice issued or received reflects the transaction that took place (e.g. to establish a link between the invoice and the delivery of goods or the provision of services on which it is based), but also to guarantee the authenticity of customers/suppliers, as well as the legitimacy of the VAT regimes applied. For example, the following key controls may be presented in the documentation to meet these objectives :