Income tax: record keeping - electronic records

This Ruling explains to a person, including a company carrying on business, the principles associated with the retention of electronic records created from business transactions including those carried out through the internet for the purposes of section 262A of Income Tax Assessment Act 1936 (ITAA 1936). It sets out the Tax Office view on what are sufficient electronic records to be retained including those created by internet electronic commerce so as to record and explain all transactions and other acts engaged in by such persons for the purposes of the ITAA 1936.

This Ruling also explains the Tax Office view on access under section 263 of the ITAA 1936 to electronic records including those created from electronic commerce.

Taxation Ruling TR 96/7, Income tax: record keeping - section 262A - general principles and Taxation Determination TD 2002/16, Income tax: what are the obligations under the Income Tax Assessment Act 1936 where a business chooses to keep some of its records as encrypted information ? should be read in conjunction with this Ruling.

In this Ruling: 'documents and records' means: all documents and records including those documents and records kept in electronic form on a computer or on other electronic storage media. 'electronically' means: held or processed by means of a computer. 'electronic commerce' means: 'the delivery of information, products, services or payments via telephone lines, computer networks or by any other electronic means'. [1] 'Electronic Data Interchange (EDI)': is the electronic transfer of data and information to both external and internal sources. Many transfers of data and information are made automatically between computers. 'electronic storage medium' includes: hard disc, removable hard disc, diskette, floppy disc, CD-ROM, optical disc or magnetic tapes. 'encryption' means: scrambling a message so that it is virtually impossible for other people to read unless they have a key. Encryption is either used to maintain privacy when sending a message over the internet and also to verify the identity of the sender of a message. 'internet': is an international network of computers linked by certain rules and guidelines. The Internet has many components: • it has a comprehensive set of protocols [2] that define how computers communicate; • it has a global operational network with no single point of control; and • its operation is supported by a large number of commercial and non-profit organisations. 'key' means: a value that is used to encrypt or decrypt a message. 'websites' means: computer programs residing on computers (known as servers) which are connected to the internet.

It is proposed that when the final Ruling is issued, it will apply both before and after its date of issue. However, the final Ruling will not apply to taxpayers to the extent that it conflicts with the terms of settlement of a dispute agreed to before the date of issue of the final Ruling (see paragraphs 21 and 22 of Taxation Ruling TR 92/20).

The following Ruling is withdrawn: Taxation Ruling TR 97/21, Income tax: record keeping - electronic records .

When a person carrying on a business chooses to process and keep records in electronic form, the records must be in a form that the Tax Office can access and understand in order to ascertain the person's taxation liability. For record keeping purposes, electronic records are subject to the same record keeping requirements under the ITAA 1936 as paper records.

To ensure that the electronic records associated with a computer system are being maintained in accordance with the requirements in subsections 262A(1), (3) and (4) of the ITAA 1936, a person should have an understanding of their computer system. System documents should be retained to explain the basic aspects of the system so the Tax Office can ascertain that the system is doing what it is claimed to do.

Where systems have changed over time, records should be kept to allow the original data to be reconstructed to satisfy section 262A. The records to be kept would include: • a chronological record and explanation of all changes or upgrades to the software and hardware employed in the system, including explanations of how the new system can recreate an original record; • where applicable, explanations of migrations of data that may have taken place across either software or hardware; • a detailed, documented record of the controls which maintain the integrity of the old system and of the records processed and transmitted; and • explanations of archival and back-up facilities under that system.

Any data held under an old system should be capable of conversion to a form that is readily readable and retrievable by the Tax Office.

For record keeping purposes, business transactions carried out using either Electronic Data Interchange (EDI) specific systems or the internet are no different from other forms of business transactions. We consider section 262A requires the person to keep records that explain all internet or EDI transactions that are relevant for any purpose of the ITAA 1936 and the Income Tax Assessment Act 1997 (ITAA 1997) (ITAAs). Accordingly, the minimum information that must be recorded is the date, amount and character of the transaction.

A business using either a manual or a computerised accounting system may want to store and keep paper records in electronic form. Where paper records are produced or received in the course of carrying on business, the Tax Office accepts the imaging of those records onto an electronic storage medium provided that the electronic copies are a true and clear reproduction of the original paper records. This would include documents which have been entered into a Capital Gains Tax asset register under Division 121 of the ITAA 1997 and have been converted to an electronic copy.

Where paper records are imaged and stored electronically the requirements of section 262A are satisfied if they are: • not altered or manipulated once stored; • retained for the statutory period of five years; and • capable of being retrieved and read at all times by Tax Office staff.

Under section 263 of the ITAA 1936, the Commissioner or any duly authorised officer has the right of full and free access to all buildings, places and documents, including electronically stored records required for the purposes of the Act. The provision enables an authorised officer to access and copy records held on an electronic storage medium.

In addition, subsection 263(3) requires the occupier of a building or place to provide an authorised officer with all reasonable facilities and assistance for the effective exercise of powers under the section. In the context of electronically stored records, reasonable facilities and assistance extends, where necessary, to the provision of login codes, keys and passwords. Similarly, it permits access to any printed copies of the records, as well as allowing the authorised officer to read computer and software manuals.

The Electronic Transactions Act 1999 (ETA 1999) established the basic rule that a transaction is not invalid because it took place by means of electronic communication. The ETA 1999 contains specific provisions which state that a requirement or permission under a law of the Commonwealth for a person to provide information, in writing, to sign a document or to retain information or a document can be satisfied by an electronic communication, subject to certain minimum criteria being satisfied.

Particular attention should be paid to the following sections of the ETA 1999: • section 9 (requirement to give information in writing); • section 11 (production of documents); and • section 12 (recording and retention of information). All these sections have the requirement that information stored in electronic form be 'readily accessible so as to be usable for subsequent reference'.

The ITAAs impose obligations on a taxpayer to retain certain records; the ETA 1999 facilitates the acceptance of electronic records. Those electronic records are required by the ETA 1999 to be 'readily accessible so as to be usable for subsequent reference'. It is expected that electronically stored information should be retrievable on the taxpayer's computer system for the full retention period required by the ITAA and that where electronic records are made available in compliance with record keeping requirements that they be 'readily accessible' by the Tax Office.

This Ruling provides prudential guidance in relation to the maintenance of electronic records in the face of such obstacles to electronic record keeping as system upgrades and advancement and subsequent obsolescence of storage media. However, it is the record keeper's responsibility to ensure that electronic records are maintained so as to be 'usable for subsequent reference' over the retention period.

It is considered that the ETA 1999 is not intended to alter the stringency or effect of any obligations imposed on a person by Commonwealth law in relation to retaining information or documents, including the period of retention. The ETA 1999 provides a different way of complying with record keeping obligations.

Advances in technology (including the internet) have meant that many taxpayers who carry on a business now process and keep their records electronically rather than through a paper based system. This includes encrypted records. The Tax Office requires that records, whether kept on paper or electronically, must be kept accurately so as to enable that person's tax liability to be readily ascertained. The records must be in a form which Tax Office staff can access and understand in order to ascertain that person's taxation liability.

Records made by and stored in a computer are recognised as documents for the purposes of Commonwealth legislation. Section 25 of the Acts Interpretation Act 1901 (AIA 1901) extends the ordinary meaning of the word record to include information stored by means of a computer.

The reference in subsection 262A(1) of the ITAA 1936 to the keeping of records therefore includes information stored or recorded by means of a computer. A person carrying on a business may keep documents and records made by and/or stored in a computer system. By virtue of subsection 262A(3), the person is required to keep these computer records in the English language or in a form readily convertible into English. The Explanatory Memorandum to the Taxation Laws Amendment Bill (No. 5) 1989 that introduced subsection 262A(3) into the ITAA1936 explained, at Clause 42: Subsection 262A(3) obliges a person who is required by the section to keep records, to keep those records: • by paragraph (a) - in the English language or, if not in written form (e.g., in an electronic medium such as magnetic tape or computer disc), in a form which is readily accessible and convertible into writing in English; and • by paragraph (b) - so as to enable the person's assessable income and allowable deductions, and any credits to which the person is entitled, to be readily ascertainable.

A taxpayer's computer system may generate records or alternatively, a taxpayer may scan paper records into an electronic form provided that the electronic copies are a true and clear reproduction of the original paper records.

All records must generally be kept for a period of 5 years after the documents were prepared or obtained, or 5 years after the completion of the transaction or acts to which the records relate (whichever is the later): subsection 262A(4) of ITAA 1936.

The admissibility of computer produced evidence in Federal Courts is now governed by various provisions in the Evidence Act 1995 (the Evidence Act). Broadly speaking, computer documents are admissible evidence in taxation matters subject to relevance and, where necessary, proof as to the competence of the computer device. Even prior to the introduction of the Evidence Act, documents held in electronic form had been accepted as admissible evidence: DFC of T v. Capron 93 ATC 4144; (1993) 25 ATR 142.

Under section 25A of the AIA 1901, where a person who keeps records of information by means of a computer is required to produce those records under the access provisions contained in the ITAA 1936, the person can choose to satisfy the access request by providing the Tax Office with a hard or printed copy of the electronic records subject to the discretion of the Tax Office to specify another form of record, that is, electronic, if that is what is required.

Where a taxpayer conducts business transactions through the Internet or by EDI the Tax Office position is that the taxpayer is required to keep records explaining all such transfers that are relevant for any purposes of the ITAAs. All other requirements relating to electronic record keeping systems, such as the need for controls are equally applicable.

If electronic information systems are used to conduct business transactions such as those that may be conducted by websites, but do not function as record keeping systems, there will be no evidence of those transactions. Without this evidence your organisation or business may not be considered to have complied with its record keeping requirements under section 262A of the ITAA 1936. There is an administrative penalty if you do not keep or retain records as required by this section: see section 288-25 in Schedule 1 to the Taxation Administration Act 1953 (TAA 1953). Taxpayers should remember that the onus of proof is on them in showing that an assessment is excessive should the Tax Office amend their taxable income. The failure to keep sufficient records to explain relevant transactions for tax purposes would be inconsistent with the requirements of these obligations.

The nature of e-commerce with the recording of transactions and information and subsequent record keeping implications will assist taxpayers in the design and implementation of systems to manage full and accurate records arising from e-commerce or EDI for the required periods.

There are many similarities between a manual accounting/paper based record keeping system and one operated on a computer. Many businesses use computerised accounting packages to process their financial transactions and to prepare their periodical accounts including those operating in an internet environment. Other businesses need to operate from highly sophisticated and fully integrated real time systems where one single transaction or entry in the system triggers the processing and recording of many other transactions, for example, where a sale transaction will simultaneously update various ledger accounts, adjust stock levels, and so on. Still others use electronic information systems that have special functionality for maintaining the integrity of the digital data as electronic records over time to conduct business transactions. These organisations will have developed software integration between record keeping systems and other corporate systems to ensure that data can be seamlessly and deliberately captured as electronic records.

Different businesses have different needs in terms of the type and level of complexity of the computerised accounting or record keeping system they wish to operate. The Tax Office considers that electronic record keeping systems operate essentially in the same manner as paper based systems and the records kept in them are, in principle, the same as those kept under manual/paper based record keeping systems.

The Tax Office recognises that many taxpayers process and keep their records electronically. There are many advantages associated with such an approach; however the Tax Office requires that the records, whether kept on paper or electronically, must be kept accurately so as to enable that person's liability to be readily ascertained. There are risks with an electronic record keeping system and a taxpayer should take steps to minimise the risks of: • inadvertent destruction or corruption of electronic records; • unauthorised tampering with electronic records; and • the possibility that electronic records and operating systems will become obsolete, due to constant upgrading or changing of computer systems.

Therefore an electronic record keeping system must have adequate controls to safeguard the security and integrity of the records created, processed and kept in the record keeping system to ensure compliance with section 262A of the ITAA 1936.

There are important guidelines to be followed by any taxpayer in formulating acceptable standards for electronic record keeping and to comply with the record keeping requirements under the tax laws. These include: (1) record retention; (2) data security and integrity; (3) system documentation; (4) retaining archival copies; and (5) accessibility.

A taxpayer should retain electronic records for the same length of time that it retains paper records, or at the very least, for so long as they may be material either for tax purposes or for any on-going business transaction. For tax purposes this is generally for a period of 5 years.

If a taxpayer chooses to routinely destroy records then it may be advisable that this occur in accordance with a regular schedule which is part of the documented record retention procedures of the taxpayer. A routine procedure may provide an explanation as to why documents were destroyed.

A taxpayer should be able to demonstrate that its electronic records system is secure from both unauthorized access and data alterations.

This usually involves developing and documenting a security program that establishes controls to ensure that only authorized personnel have access to electronic records; provides for backup and recovery of records; ensures that personnel are trained to safeguard sensitive or classified electronic records; and minimizes the risk of unauthorized alteration, addition or erasure.

To ensure the integrity of its electronic records, a taxpayer would be advised to test the storage media prior to its being used for storing electronic records to verify that it is free from errors and defects and should also maintain the storage media in temperature- and humidity-controlled environments. A sample of all storage media may be read periodically to identify any loss of data and any media likely to deteriorate, such as computer tapes, and this can then be copied onto new media before deterioration is likely.

The entire electronic records system should be documented, including physical and logical descriptions of the system's structure and programs, including all inputs and outputs. This is prudent for a taxpayer's own internal controls and to assist the Tax Office should it request an explanation of the electronic records system.

To ensure that the records are being maintained in accordance with subsection 262A(1), (3) and (4) of the ITAA 1936, a person should have an understanding of their computer system. System documents should be retained to explain the basic aspects of that system so Tax Office officers can ascertain that the system is doing what it is claimed to do. This should also include the changes and upgrades that have occurred in software and hardware and so on.

Generally, it is advisable for a taxpayer's data files (that is, any related numeric, textual or graphic information that is organized in a strictly prescribed form or format) to be stored with documentation including: (a) a narrative description of the system producing, using or storing the data files; (b) a description of the physical and technical characteristics of the records; and (c) sufficient detail, in the form of a sequential file, to identify underlying source documents.

For text documents such as letters, memoranda and reports, each document should be sufficiently identified and indexed to enable retrieval, protection and disposal of such documents through some form of indexing or text search system. Appropriate identifying information may include: origin code, file code, retrieval key words, addressee, signatory, author, date of creation, date of authorized disposition, classification, and correlations to other records in other media.

Labelling of the media is also necessary and should identify the name of the area responsible for the data; the system title; and may also include file titles, creation dates, coverage dates, recording density, type of internal labels, volume serial number (if appropriate), character code/software dependency, and media sequence number (if in a set).

Any data held under an old system should be capable of conversion to a form which is readily readable and retrievable by the Tax Office. Thus, the Tax Office would prefer that data be converted to a standard data format, for example, ASCII, DBF or a spreadsheet format.

Systems documents for example manuals should be retained to explain the basic aspects of the electronic system, so that the Tax Office can ascertain if the system is effectively doing what it is claimed to do. In addition it is advisable that the taxpayer should have an understanding of the controls present in the system.

It is generally not necessary to retain a hard copy of the information contained in an electronic record unless a particular law or regulation requires the taxpayer to retain the paper copies. However, taxpayer's records must be in a form which Tax Office staff can access and understand in order to ascertain that person's taxation liability.

Electronic records should be readily accessible. To that end, a taxpayer should ensure the conversion of electronic records to a compatible format when upgrading or changing data-processing capabilities.

Under section 263 of the ITAA 1936 the Commissioner or any duly authorised officer has the right of full and free access to all buildings, places and documents, including electronically stored records required for the purposes of the Act. The provision enables an authorised officer to access and copy records held on an electronic storage medium.

In addition, subsection 263(3) of the ITAA 1936 requires the occupier of a building or place to provide an authorised officer with all 'reasonable facilities and assistance' for the effective exercise of powers under the section. In the context of electronically stored records, reasonable facilities and assistance extends to the provision of login codes, keys including encryption keys, passwords, and so on, and access to any hard copies of the records as well as allowing the authorised officer to read computer and software manuals.

In relation to section 263 the level of practical assistance required by taxpayers in respect of access to electronic records is that reasonable assistance be provided. For instance, while electronic information should be retrievable on the taxpayer's system for the full retention period, it may not be reasonable for a taxpayer to write new software to make data compatible with the Tax Office system. However, if the Tax Office system is incompatible with the taxpayer's system the Tax Office may need to reduce the information to hard copy form as the electronic information would not be 'readily accessible' (as required by the ETA 1999) to the Tax Office in any other form. If information retrieval takes up time and resources on the taxpayer's system the concept of reasonableness may mean that retrieval takes place before or after ordinary business hours and that the Tax Office may provide its own paper and printer ink, toner or printers and so on if the task was beyond reasonable assistance for the taxpayer to provide the same. What is considered reasonable may vary on a case by case basis.

All records, including those kept for the purposes of the ITAA 1936, should be able to be examined by the Tax Office to determine their authenticity and their integrity. This may also include updating all of the encrypted data to allow for that data to remain accessible in the event of changes to either computer hardware or software and to ensure that the data stored on magnetic or other media does not become 'corrupted' over time.

Businesses should adopt prudential practices to reduce the likelihood of loss of decryption keys. These could include keeping a copy written down or on other storage media such as a floppy disk in a safe place or by the use of trusted third party arrangements (refer TD 2002/16).

The Tax Office considers that where it is intended to convert original paper records onto an electronic storage medium by way of an imaging process that this represents a true and clear reproduction of the original documentation. The Tax Office accepts the imaging of paper records provided the conversion process produces electronic copies that are a complete, true and clear reproduction of the original paper records. For instance, Optical Character Recognition conversion processes that do not produce a 100% accurate reproduction of original documents are not acceptable to the Tax Office.

Scanned copies of paper records must: • not be altered or manipulated once stored; • be retained for the statutory period of 5 years; and • be capable of being retrieved and read by Tax Office staff.

We invite you to comment on this draft Taxation Ruling. Please forward your comments to the contact officer by the due date. Due date: 21 January 2004 Contact officer details have been removed following publication of the final ruling.

Below is a detailed contents list for this draft Taxation Ruling: Paragraph What this Ruling is about 1 Class of person/arrangement 1 Related Rulings 3 Definitions 4 Date of effect 5 Previous Rulings 6 Ruling 7 Storage of paper records in electronic form 12 Access to electronic records 14 Explanation 16 Electronic Transactions Act 16 Electronic records 21 Internet and EDI transactions 28 Electronic record keeping systems 31 What are the essential elements of an electronic record storage system? 35 Record retention 36 Data security and integrity 38 System documentation 41 Retaining archival copies 48 Accessibility 49 Storage of paper records in electronic form 55 Your comments 57 Detailed contents list 58