Computerized Records

GST/HST memorandum 15.2
June 2005

Disclaimer

The information in this memorandum does not replace the law found in the Excise Tax Act and its Regulations. It is provided for your reference. As it may not completely address your particular operation, you may wish to refer to the Act or appropriate Regulation, or contact a Canada Revenue Agency (CRA) GST/HST Rulings Centre for more information. These centres are listed in GST/HST Memorandum 1.2, Canada Revenue Agency GST/HST Rulings Centres. If you wish to make a technical enquiry on the GST/HST by telephone, please call the toll-free number 1-800-959-8287.

If you are located in the Province of Quebec, please contact Revenu Québec by calling the toll-free number 1-800-567-4692 for additional information.

Note
This memorandum cancels and replaces GST/HST Memorandum 15.2, Computerized Records, dated July 1999.

Note – HST
Reference in this publication is made to supplies taxable at 7% or 15% (the rate of the HST). The 15% HST applies to supplies made in Nova Scotia, New Brunswick, and Newfoundland and Labrador (the “participating” provinces). If a person is uncertain as to whether the supply is made in a participating province, the person may refer to Technical Information Bulletin B078, Place of Supply Rules Under the HST, available from any Canada Revenue Agency (CRA) tax services office.

Table of Contents

• Requirement to keep electronic records
• Retention of records
• Place of retention
• Methods of retaining electronic records
• Transaction integrity and security
• Inspections, audits and examinations
• Lost, damaged or inadequate records

Requirement to keep electronic records

Electronic record-keeping

1. Electronic record-keeping refers to those electronic business systems that create, process, store, maintain and provide access to a person’s financial records. It includes but is not limited to custom and commercial accounting software, point of sale systems and Internet-based electronic commerce. The rules in the Act relating to record-keeping apply to all records generated by electronic business systems. It is the person’s responsibility to keep, maintain, retain and safeguard all of its electronic data files.

General requirement for keeping books and records
ss 286(1)

2. Persons carrying on a business or engaged in a commercial activity in Canada, persons who are required to file a GST/HST return, and persons who make an application for a rebate or refund are required to maintain adequate books and records in English or French in Canada, or at such other place and on such terms and conditions as specified in writing by the Minister, to enable the determination of their tax liabilities and obligations, or the amount of any rebate or refund to which they are entitled.

3. The books and records are required to be in an appropriate form and to contain sufficient information to allow determination of the amount of tax to be paid or collected, or the amount to be refunded, rebated or deducted from net tax.

Electronic commerce

4. Persons engaged in electronic commerce, which can be broadly defined as the delivery of information, products, services or payments by telephone, computer, over the Internet or by any other automated means, must retain electronic records that meet the above requirements. The retained electronic records must, in combination with any other records (e.g., the underlying contracts, price lists and price changes), have an adequate level of detail to meet these legislative requirements.

5. Persons using electronic records must retain all business records in an electronically readable format and the data must be capable of relating back to the supporting source documents. The person is not relieved of the responsibility of keeping adequate records because of the utilization of a third party such as an accountant, a transaction manager for electronic commerce, an Internet service provider, an application service provider, a service bureau, a time-sharing service, or other such arrangements.

6. An electronic record is any information recorded in an electronically readable format. Electronically readable format means information supported by a system capable of producing accessible and useable copy.

• Accessible copy means that the person must provide a copy of the electronic records in an electronically readable and useable format to the CRA auditors to permit them to process the electronic records on CRA equipment.
• A copy is useable if the electronic records can be processed and analysed with CRA software.
• The useable copy must be in a common data interchange format that is compatible with the CRA’s software.
• Electronic files retained in an encrypted or proprietary back-up format must be able to be restored at a later date to an accessible and useable state to meet the CRA’s requirements.

More information

7. The CRA is prepared to offer advice on electronic record-keeping issues and to respond to questions concerning the types of formats that are compatible with the CRA’s software. All questions and concerns should be directed to the attention of the Electronic Commerce Audit Specialist (ECAS) at the nearest CRA tax services office. Advice provided by the ECAS must not be construed or viewed as an audit, inspection or a ruling issued by the CRA. It is the person’s responsibility to keep, maintain, retain and safeguard its records.

Retention of records

Electronic records
ss 286(3.1)

8. Persons who keep records in an electronic format are required to retain them in an electronically readable format for a period of six years from the end of the latest year to which they relate. This means that a person must retain the electronic records even when hard copy is available.

Minimum retention period

9. The minimum retention period for books and records is generally determined by the last year when a record may be required for purposes of the Act, and not the year when the transaction occurred and the record was created. For example, records supporting the acquisition and capital cost of property should be maintained until the day that is six years from the end of the last year in which such an acquisition could enter into any calculation for GST/HST purposes, including the basic tax content of the property.

Exemptions
ss 286(3.2)

10. The Minister may exempt a person or class of persons from the requirement to retain their electronic records under such terms and conditions as are acceptable to the Minister.

More information

11. More general information on retaining records is available in GST/HST Memorandum 15.1, General Requirements for Books and Records.

Place of retention

ss 286(1)

12. Records must be maintained at the person's place of business or residence in Canada or another place designated by the Minister, and must, upon request, be made available to the CRA auditors at all reasonable times. Records kept outside Canada and accessed electronically from Canada are not considered to be records kept in Canada. Where records are maintained electronically in a location outside Canada, the CRA may accept a copy of these records, provided the copy of the records is made available in Canada to the CRA officers in an electronically readable and useable format and contains adequate details to enable the determination of the person’s tax liabilities and obligations, or the amount of any rebate or refund to which the person is entitled.

Location outside Canada

13. All retained records must be clearly labelled and stored in a secure environment in Canada. However, authorization to maintain records outside Canada may be granted, subject to such terms and conditions as the Minister may specify in writing. These terms and conditions will include that these records, including electronic records, that are stored outside Canada are to be made available to the CRA auditors at all reasonable times in accordance with the relevant provision of the Act. Authorization to maintain records outside Canada may be obtained by writing to the nearest CRA tax services office.

14. Normally back-up copies of electronic records are stored at a site other than the business location for security and precautionary purposes (i.e., in case of fire, flood, theft or other cause). The CRA encourages this business practice and recommends that these back-up copies be maintained at a location within Canada.

15. It is the person’s responsibility to produce the records for inspection regardless of where these records are located.

16. Persons with businesses that operate via the Internet and that are hosted on a server located outside Canada should be cognizant of their responsibility of maintaining their records within Canada. Persons with Internet-based businesses have the same responsibilities for record retention as all other business operators.

Methods of retaining electronic records

17. Persons using electronic business systems must ensure that sufficient detail is captured and produced to enable the GST/HST charged and remitted on taxable supplies of goods and services as well as the tax paid on purchases to be properly determined and verified.

18. Each person must ensure that its current and/or prior-period data files are, or have been, archived or backed up properly and adequately in order to meet its record-keeping obligations.

19. Each person that retains records by copying or backing up data to another medium must ensure that this method of retaining records is done according to the medium manufacturer’s suggested procedures, with particular attention given to the suggested shelf life of the medium. Information recorded on rewriteable media such as computer hard disks must be backed up on tape or on another suitable medium to avoid accidental deletion or erasure of the recorded information. The media containing the recorded information must be stored in an environment free from hazards such as magnetic fields, direct light, excessive moisture and temperature extremes.

20. When back-up copies of electronic files are being used as a method of record retention, procedures must be put in place to ensure that:

• the backed-up data files can be restored in a format that is accessible and useable by the CRA;
• the intended data are actually being written to the medium being used;
• the backed-up procedure does not overwrite prior-period back-up files or logs, thereby destroying them;
• the medium is uniquely labelled in a readily identifiable manner;
• the log is prepared to identify what records and data have been recorded on such medium;
• the log indicates how long the medium is to be retained before it can be overwritten or discarded (see the section called “Retention of records”);
• the name of the software and the version number used to create the records are noted on the medium label and in the log;
• the proper system software and operating system is available to restore the back-up files to the original environment; and
• there is periodic testing of the back-up records to verify that these records can be restored in an electronically readable format.

Electronic records management and imaging

21. When original source documents and records are in an electronic format, they must be kept in an electronically readable format even if they have been transferred to another medium (e.g., microfilm).

22. To ensure the reliability, integrity and authenticity of electronic records, the pending national standards publication entitled Electronic Records as Documentary Evidence (CAN/CGSB-72.34-2005) will outline electronic record management policies, procedures, practices and documentation that will assist in establishing the legal validity of an electronic record.

23. Electronic image means the representation of a source document that can be used to generate an intelligible reproduction of that document, or the reproduction itself. In the case of a paper source document, an intelligible reproduction means that:

• the reproduction is made with the intention of standing in place of the source document;
• the interpretation of the reproduction, for the purposes for which it is being used, gives the same information as the source document; and
• the limitations of the reproduction (e.g., resolution, tone or hues) are well defined and do not obscure significant details.

24. Imaging and microfilm (including microfiche) reproductions of books of original entry and source documents must be produced, controlled and maintained in accordance with the latest national standard of Canada as outlined in the following Canadian General Standards Board (CGSB) publications:

• CAN/CGSB 72.34, Electronic Records as Documentary Evidence
• CAN/CGSB 72.11, Microfilm and Electronic Images as Documentary Evidence

The above-mentioned standards publications are available from the Canadian General Standards Board.

Mailing address:

CGSB
Canadian General Standards Board
Gatineau (Québec)   K1A 1G6
Canada

Street address:

Place du Portage Phase III, 6B1
11 Laurier Street
Gatineau  QC

Telephone numbers:

(819) 956-0425 or
Toll free 1-800-665-2472

Fax number:  (819) 956-5644

E-mail:  ncr.cgsb-ongc@pwgsc.gc.ca

Managing retention and disposal

25. An acceptable imaging program (see paragraph 24) requires that:

1. a person in authority in the organization has confirmed in writing that the program will be part of the usual and ordinary activity of the organization's business;
2. systems and procedures are established and documented;
3. a log book is kept showing:
   1. the date of the imaging;
   2. the signatures of the persons authorizing and performing the imaging;
   3. a description of the records imaged;
   4. whether source documents are destroyed or disposed of after imaging, and the date a source document was destroyed or disposed of;
4. the imaging software maintains an index to permit the immediate location of any record, and the software inscribes the imaging date and the name of the person who does the imaging;
5. the images are of commercial quality, and are legible and readable when displayed on a computer screen or reproduced on paper;
6. a system of inspection and quality control is established to ensure that (c), (d) and (e) above are maintained; and
7. after reasonable notification, equipment in good working order is available to view, or where feasible, to reproduce a hard copy of the image.

26. Paper source documents that have been imaged in accordance with the latest national standard of Canada (see paragraph 24) may be disposed of and their images kept as permanent records.

27. The registrant is responsible for ensuring that imaging is done in an acceptable manner when the imaging has been done by a third party.

Business system documentation

28. Documentation whether in writing or any other form that describes the operating and business systems must be maintained, retained and provided to the CRA upon request.

29. Operating and business systems documentation should describe:

• the operation of the business system, including documentation relating to the data files;
• the physical and system controls to prevent unauthorized alteration or loss of the records;
• the creation and processing of transactions; and
• how standard reports are created.

30. In addition to the normal business system documentation that is available, Internet-based transactions can generate additional information, either during transaction processing (e.g., web logs) or as a result of security measures to preserve the authenticity and integrity of the resultant record (e.g., electronic signatures). This additional information forms an important part of the audit trail and, where relevant for GST/HST purposes, must be retained. For persons with businesses operating on the Internet and utilizing the services of an application service provider, this information must be obtained from that application service provider. These additional records form an important part of the audit trail for electronic commerce activity and must be retained. The information so produced must be retained for a period of six years from the end of the latest year to which they relate.

31. Documentation relating to data files and their retention and archiving includes such items as:

• procedures, including period retention, frequency and location of retained files;
• file information such as file name, description, format, and record definition (i.e., record layout or data dictionary); and
• description of storage media, hardware and software used in the archiving process.

32. Persons who outsource accounting or bookkeeping functions to third parties are required to provide this same documentation.

33. Documentation varies from system to system according to the complexity of the business systems and software. Where documentation is lacking for both custom and commercial business systems, it is good business practice to create the documentation where possible and/or contact the business system vendor to acquire the documentation.

Audit trails

34. An audit trail, which is the information that is required to re-create a sequence of events, must include sufficient detail to substantiate summarized information. The electronic records must show an audit trail from the source document(s), whether paper or electronic, to the summarized financial accounts. In addition, the audit trail may include a number of links to other associated processes and events such as front-end systems (e.g., electronic commerce and point of sale), receipts, payments, and stock inventories, all of which may have their own system audit trails. For example, in Internet-based electronic commerce transactions, other records such as web logs and e-mails when used as part of the transaction (e.g., invoices and confirmations) or security measures such as digital signatures could be an important part of the audit trail. Transactions covered by a trading partner agreement of electronic data interchange and the electronic record(s), including functional acknowledgments, have to be kept. It is the person‘s responsibility to ensure the reliability and readability of these transaction records.

Converting from one format to another

35. Where electronically kept records are converted from one format to another, it is the person’s responsibility to ensure that the converted records are reliable and readable. The conversion must not result in a loss, destruction, or alteration of information and data relevant to the determination of the GST/HST payable, collected, or withheld. This is particularly important with respect to Internet-based businesses that are dealing with third parties where documents and records relating to transactions are held or maintained by an application service provider.

36. Each person who keeps electronic records must also retain source documents. Source documents include items such as sales invoices, purchase invoices, cash register receipts, formal contracts, credit-card receipts, delivery slips, deposit slips, work orders, dockets, cheques, bank statements, tax returns, and could also include e-mails and other general correspondence where relevant for tax purposes. Paper or hardcopy records may be retained in microfiche, microfilm or electronic image format in accordance with CRA policy. Where any of the aforementioned documents are created, transmitted or received electronically, these documents constitute records and must be retained electronically.

Transaction integrity and security

Systems control

37. Each person who carries on a business with an electronic business system must ensure that adequate controls are in place to safeguard the accuracy, security and integrity of the electronic records processed and kept in that system. These can include:

1. access controls to ensure that only authorized users can have access to a computer system to process data;
2. input and output controls that ensure the accuracy and security of the information created, received and transmitted;
3. processing controls that protect and ensure the integrity of the information processed by the system;
4. back-up controls that guarantee the retention of back-up copies of electronic records, computer programs, system documentation, and the recovery of electronic records in case of a system failure; and
5. controls to ensure that there is no accidental or intentional editing or deletion of recorded or completed transactions. Changes to any recorded transaction must be made by journal entry. Any changes to recorded transactions must be adequately documented and must include the following:
   • the name of the person making the modifications,
   • the date of the change,
   • the previous transaction details,
   • the current transaction details, and
   • the reason for the change or deletion.

Changing electronic record-keeping systems

38. If changes to the operating and/or electronic business system are made, the capability to access and retrieve data must be preserved. The changes must not result in a loss, destruction, or alteration of information and data relevant to the determination of the GST/HST payable, collected, or withheld. Adequate documentation must be retained to preserve an accurate chronological record of the changes, including any changes to software systems and the format of the files. This documentation must be made available upon request to the CRA.

39. Before implementing a new business system, a person must ensure that:

• sufficient detail will be captured and produced to ensure proper determination and verification of the GST/HST charged and remitted on taxable supplies of goods and services as well as the tax paid on purchases;
• the audit trail of each transaction will be preserved to allow the CRA auditors to verify the accuracy of the GST/HST charged and remitted on taxable supplies of goods and services as well as the tax paid on purchases by the registrant;
• adequate internal controls are incorporated into the system to ensure that all transactions are being recorded accurately and completely;
• the system ensures transaction integrity and security;
• the system will capture and save in a readable format all information required by the CRA;
• CRA auditors will have access to all information produced by the system and required by the CRA;
• adequate back-up and restore procedures will be in place to safeguard information required by the CRA; and
• the system will continue to offer the capacity to export the required information into a commonly used non-proprietary format.

Commercial accounting packages

40. A person who uses commercial and/or customized software to keep books and records electronically is not relieved of the responsibility to keep adequate electronic records because of deficiencies in the software. In cases where the software back-up procedures are deficient, additional specific back-up procedures must be taken to retain adequate electronic records. Documentation must be kept at a level of detail that will describe the data entry procedures, reports produced, and any features that alter standard reports or create new reports.

Third party service providers

41. A person who keeps records electronically is not relieved of any of the record-keeping, readability, retention, and access responsibilities because the person contracts out the record-keeping function to a third party such as a bookkeeper, accountant, Internet transaction manager, application service provider, or Internet service provider, through a time share, service bureau, or other such arrangements. The person must ensure that the requirements continue to be met in the event of third party changes such as software and/or hardware conversions and upgrades, bankruptcy or migration to/from a third party. The person is responsible for keeping the records and for providing access to authorized persons. Refer to paragraph 38 for additional information on changes to business systems.

Working papers

42. Books and records may also be in the form of supporting documents (e.g., an accountant’s working papers), whether in writing or any other form, which assist in the determination of GST/HST obligations and entitlements.

43. The person is responsible for ensuring that all electronic records are retained for the period of time specified by the Act, and that the required data in an electronically readable format is available to provide to the CRA auditors when requested. A good practice is to have the third party service provider furnish the person with an acceptable copy of the information required by the CRA in an electronically readable format.

Inspections, audits and examinations

Inspections
s 288

44. A person authorized by the Minister may inspect, audit or examine relevant documents, property or processes of any person and, at reasonable times, enter any premises or place of business and require persons therein to provide reasonable assistance and answer all proper questions. Such examinations include the audit of electronic records and, as a part of providing reasonable assistance, registrants must allow CRA auditors access to their electronic records.

Copies
ss 291(1)

45. This access means that the registrant must provide an acceptable copy of the electronic records in an electronically readable and useable format to CRA auditors so that they can process the electronic records on CRA equipment.

Changes

46. Any change that would impact a registrant's ability to access and read the records must also be reported to the CRA.

Business systems evaluations

47. The CRA may undertake a review of the business systems in order to understand the flow of information, to evaluate the reliability of internal controls and to identify electronic data files that are required. These reviews are undertaken to provide the CRA with an overview of the business system, including details related to the flow of information through the business system and subsystems. As part of providing reasonable assistance, registrants must provide, upon request from an authorized person, information regarding their business systems.

Lost, damaged or inadequate records

Maintaining back-up records

48. Registrants must ensure that proper back-up records are maintained at all times and, if any electronic records required to be maintained are lost, destroyed or damaged, the registrants must report this situation to the CRA and recreate the files within a reasonable period of time.

Inadequate records
ss 286(2)

49. If a registrant has failed to keep adequate records, the Minister may require the person to keep such records as the Minister may specify. In this instance, the CRA will ordinarily request a written agreement that the records be maintained as required. Within a reasonable period of time, usually not less than a month, the CRA will follow up the request by letter or visit to ensure compliance.

Failure to comply with request to keep adequate records

50. If the registrant has not complied with the request to maintain adequate records within the time allowed, the CRA will then issue a further letter, describing the information to be recorded and the consequences for failure to comply.

Enquiries

All of the memoranda in the GST/HST Memoranda Series are available on the CRA Web site at canada.ca/gst-hst-tech