34

into IT

Auditing e-taxation
The rise of e-commerce poses new questions for taxation policy and administration. E-commerce makes it easier for business to be conducted without creating the "permanent establishment" that would otherwise subject a seller to tax on income. It blurs the distinctions between the sale of goods, the provision of services and the licensing of intangible assets, each of which is subject to some form of taxation. Rapid developments in information technology have not only had an impact on assessing tax liability and collecting revenue, but on the State's ability to identify the growing number of taxable transactions that take place in cyberspace. Mukesh Arya considers these problems and suggests some general requirement for auditing e-Taxation.

into IT

35

Issues and Challenges

Introduction
Information technology (IT) now pervades our lives. Everyone, including the tax authorities is trying to cope, and the tax auditor cannot be excluded. Globalisation has enabled large multinational corporations to grow faster than some nations in terms of gross domestic product. By using their large information bases international media conglomerates are able to shape world opinion on most subjects. With workforces that can exceed some nations' populations, international business is able to impose a significant influence on international trade and commerce, mostly to enhance profits. Consequently their powers to employ innovative tax saving devices cause the State to lose revenue. IT has exacerbated this by placing international business in a better position to manipulate their accounts worldwide, and to wield greater negotiating power with the State on the taxability of their transactions. But a state's rights to impose taxation must be protected if it is to survive.
!

Web-based information portals for use in educating taxpayers and researchers on taxation issues, and publishing information.

The overall aim e-taxation is to replace cumbersome manual, bureaucratic service systems with collaborative, efficient, process-driven and secure online delivery. The tax auditors' traditional skills in conducting Value for Money and systems based auditing will need to be reoriented as e-taxation is introduced. The pre-requisites for effective tax audit are appropriate audit methods, software and training. Other major issues to overcome are access to computerised databases, digital documents and evidence, and the auditor's ability to understand e-taxation systems.

But these distinct tax identities break down in the case of digital products such as software, books, music and medical transcription services because they can be produced anonymously, offered for sale simultaneously anywhere within the world, and delivered and paid for electronically. In the case of e-commerce the concepts of permanent residence (to determine location of manufacture), point of sale (for the application of relevant tax rates), income classification (based on source of income), product classification (for preferred tax rates), etc. become difficult to apply. Within borderless cyberspace, web-enabled commerce effectively obliterates any footprints leading to the buyers' and sellers' locations. Governments are

Measures induced by the need to interface with the global impact of it (noncontrollable)
Traditionally nations tax the economic activities carried on within their jurisdictions. These can be broadly categorised as taxes on production, trade, consumption, income and importexport. Even though laws, rules and regulations have been built around each nation's unique needs, levying and collecting taxes follows more or less identical procedures. Elaborate national and international tax law has also emerged from judgements. These laws remain relevant to tangible goods, since they can be used in conjunction with their location of manufacture, transportation, customs entry and exit, and physical delivery.

Understanding e-taxation
E-governance essentially means the electronic delivery of government services. In the context of taxation this translates into:
!

on-line filing and assessment of tax returns; electronic funds transfer to enable taxes to be paid and refunds to be issued across the Internet; different government departments sharing information on tax assessments to support comprehensive policy decision making;

distinct tax identities break down in the case of digital products such as software, books, music and medical transcription services because they can be produced anonymously, offered for sale simultaneously anywhere within the world, and delivered and paid for electronically

36

into IT

Governments are already losing millions in tax revenue through the penetration of e-commerce within their jurisdictions, and their tax authorities are finding it increasingly difficult to stem this haemorrhage
already losing millions in tax revenue through the penetration of e-commerce within their jurisdictions, and their tax authorities are finding it increasingly difficult to stem this haemorrhage. Supreme Audit Institutions (SAIs) are at a loss to understand the evolving situation and find it extremely difficult to quantify this revenue loss or make effective recommendations.

International corporations could indulge in harmful tax evasion schemes whereby financial transactions might be shown to originate in other jurisdictions. Such organisations are well represented in the corridors of powers where they attempt to extract tax concessions from the State or have loopholes incorporated in tax legislation. SAIs are often confronted with these knotty issues when auditing various executive notifications that traditionally have the force of law. In cyberspace the situation is further complicated by the very deep understanding required of the links between information and tax law. For instance, where multi-national organisations operate in international markets, the auditor is professionally challenged first to determine the transactions that have validly arisen in his national jurisdiction, conduct a risk analysis, determine the audit sample of data to be collected on cross-border transactions, and then devote due attention to its analysis. SAIs may experience practical difficulties in undertaking these types of audits unless e-taxation projects address the auditor's requirements.

To enable a meaningful analysis to be made, a reliable structured information base covering all enterprises subject to tax becomes a necessity for both the tax authority and the tax auditor, and efforts may need to be directed within the revenue department at creating it. Egovernance presupposes the possession of a reliable information base on taxpayers, the major constituents of the economy and the effects of tax policies. The absence of a strategic information base that is capable of analysis significantly weakens tax administration. In auditing taxation SAIs are confronted with non-computerized systems, inadequate computerised databases or an unreliable information base. There are no universal standards for evaluating public domain databases that could be accepted as audit evidence, and using such databases for drawing conclusions or for making audit recommendations is fraught with risk.

Cross Border Transactions

The international community of traders and manufacturers has grown significantly in the Information Age. Double taxation avoidance agreements between countries often create tax havens that erode their national taxation base. In the case of e-commerce these loopholes are difficult to plug quickly, and may become impossible to control without verifiable evidence, which in cyberspace is difficult to obtain. E-taxation therefore needs to address the electronic content of cross border finance, e-services and the sale of products, and the State may need to find new sources of Information Age revenue. The canons of sound taxation that recognise simplicity, equity and efficiency are more relevant to the digital environment because a complicated taxation system can lead to complex technological problems in tax collection.

Intra-border transactions
In addition to cross-border transactions impacting on the State's ability to levy and collect taxes, there are larger issues for nations with strong federal and provincial political structures where the powers to levy and collect taxes are distributed. The advent of e-commerce has already weakened this delicate balance of power, with tax evasion becoming a rule rather than exception. Indian provinces, for example, depend largely on taxing sales and inter-state transactions. The traditional brick and mortar structures that were necessary for dealers to register under sales tax laws are gradually disappearing into cyberspace and it is becoming more difficult for the tax authorities to identify the legal 'person' for tax compliance purposes, particularly as traders and consumers can assume multiple virtual identities.

The traditional brick and mortar structures that were necessary for dealers to register under sales tax laws are gradually disappearing into cyberspace and it is becoming more difficult for the tax authorities to identify the legal 'person' for tax compliance purposes

into IT

37

Measures initiated by tax executives with the desire to leverage information technology (controllable)
Most nations have sought to intensify their exploitation of IT, and with the launch of their e-governance initiatives the concept of public accountability has also assumed a digital identity. Because taxation is the most visible area of governance for the citizen, it is no wonder that tax executives find leveraging IT through e-taxation projects irresistible! It is imperative that SAIs assess these changes and provide Parliament with assurance that etaxation provides good value for money (including sound information security). However, such projects present significantly different platforms for evaluation, so the crucial issue is whether an SAI is capable of undertaking an effective audit in the context of the major e-taxation components enumerated below.

A uniform IT audit approach to this problem requires standard audit software, and the gathering and analysis of information on client systems for input to a systematic audit planning process. Training auditors on different platforms requires 'technology set-up', which may include an e-laboratory for experimentation and the preparation of suitable audit programmes, but most SAIs lack the resources to undertake development work of this scale. Public auditors also lack sufficient time to audit IT investments. Whereas, client staff gain knowledge from specific IT implementations, the public auditor arrives much later, and then for only a limited time. Issues of public accountability for IT investment are challenges that SAIs must face in the e-governance age.

Websites
For the tax authority, a web-presence that provides information and other services is an important interface with the citizen, and many tax authorities operate such websites. The emergence of private websites that provide taxpayers with personalised services, thereby plugging deficiencies in official websites, is an interesting trend in many developing countries. These sites provide on-line tax forms, jurisdictional information, tips on tax avoidance, the services of lawyers or accountants, an eforum for tax policy debates, etc. They might be regarded as an embodiment of the failures of official websites to provide a quality service.

Information bases
Most developing countries aim to use IT to make their tax administration more efficient. Like India, they generally operate with a small tax base, which means large scale evasion by those outside the tax net. The basic problem in widening the tax base lies in an inability to link to and analyse different sets of information; a particular obstacle is the inherent limitation in cross-linking to relevant information in manual record keeping systems. E-governance projects typically address this issue through the on-line filing of tax returns, bills of entry, registrations, licences, etc., thus creating a growing information base that significantly enhances the tax administrator's ability to widen the tax base. Major issues for the tax auditor are to analyse these new information databases, link the results to other information bases, and then draw conclusions on which to make effective recommendations. It is also important to audit both the information base design parameters and the operational controls.

IT investments
IT investment decisions relate to the procurement of hardware, software and communications networks, and are normally synchronized to present a fairly robust e-governance project. As with any other procurement, IT investment involves assessing and auditing acquisition risks. Despite these rudimentary requirements, studies of etaxation projects have shown technologies to be mismatched or badly sized, and have revealed a lack of awareness of IT procurement standards. The problem seems accentuated in countries with federal and provincial governments each having its own etaxation project. It has been observed that while federal government taxes share a common administration technology, provinces experiment with their own IT solutions, a situation that leaves public auditors confronted with multiple information systems implemented on different platforms.

For the tax authority, a web-presence that provides information and other services is an important interface with the citizen.
In their quest to analyse website design, content and use, tax auditors are particularly intrigued by benchmarking standards for websites and what could be termed 'proven indicators'. While audit observations on website performance may need to be tempered by acknowledged shortcomings in accessibility, computer literacy and the telecommunication infrastructure, there remains the need for auditors to evolve suitable assessment criteria for rating websites.

Security issues
Citizen confidence in e-taxation is a prerequisite to its success. Taxpayers are highly concerned with their tax liabilities and will only participate in the electronic transfer of tax remittances if they are confident about their security. E-taxation must therefore address the security of online payments, web-based notification systems and the online filing of tax

38

into IT

returns. Business process reengineering by tax authorities to address security concerns vis--vis technical and process changes will need to be evaluated. Tax auditors are now called upon to assess the adequacy of security in etaxation projects and 'business continuity and disaster recovery planning', 'logical access controls', 'network auditing' and 'database management' are among their latest responsibilities. These are complex issues requiring in-depth knowledge of IT. IT auditing standards for the government sector are still to be prepared, leaving the audit of security in e-taxation projects to be resolved. There is an urgent need for global initiative to lay down standards, structured training modules and audit programmes.

Plan & establich the audit capability

Plan
Implement and operate the audit plan

Do Act Check
Monitor and review the audit plan

Maintain and improve the audit plan

Development, maintenance and improvement cycle

Plan: establish relevant policies, objectives, targets, processes and procedures to deliver results in accordance with statutory and other obligations. Do: implement and operate the audit policy, processes and procedures.

A framework for the audit response

Training
It is imperative that auditing skills are sharpened to keep pace with the needs of a constantly changing business environment. E-taxation initiatives demand different techniques and audit tools that are necessarily technologycentric. A holistic training approach based on a skills gap analysis is therefore an essential perquisite to equipping an SAI to audit e-taxation and render strategic advice to clients on managing their IT investments.

Check: evaluate process performance against policies, objectives and operational experience and report to management for review. Act: take corrective and preventive actions based on management review results to achieve continual process improvement.

A quality assurance framework

International standards require the adoption of a process driven approach to developing, implementing and improving a quality management system. Some tax authorities have obtained ISO or equivalent quality management systems certification by adopting a "PlanDo-Check-Act" (PDCA) methodology for their business processes, principles that apply equally to implementing etaxation systems. IT audit processes should also be consistent with the international standards of quality for auditing. To be able to evaluate the suitability, adequacy, effectiveness and efficiency of a quality management system within an etaxation project it is necessary to build an IT audit capability on comparable PDCA quality lines.

Standard tools and techniques

E-taxation applications implemented on multi-platform IT systems are becoming common, requiring audit attention that often coincides with the development of an audit capability. Extracting relevant data from client servers, warehouses, data-marts and complex online applications is essential in any e-taxation project, involving the use of different audit tools for different platforms and of a level of sophistication that is commensurate with the complexity of the underlying database. This involves the innovative use of data-mining tools and CAATs, such as ACL and IDEA, which should be tested and benchmarked to achieve standardization and cost effective use across the audit office. The adoption of audit frameworks such as SEI-CMM and CoBIT may also enhance capability.

Business process re-engineering

Introducing e-taxation obliges a tax authority to reengineer its business processes. SAIs also need to redesign their audit framework in readiness for leveraging technology to optimise the value of their audit, but there is always a dilemma as to whether BPR is required. This could be determined through a structured approach that recognises specific environment in which the SAI is operating.

into IT

39

IT presents a kaleidoscope of scenarios with which one is required to keep in constant touch in order to remain knowledgeable and competitive.
A technology interface
IT presents a kaleidoscope of scenarios with which one is required to keep in constant touch in order to remain knowledgeable and competitive. A "technology watch group" may serve the limited purpose of keeping pace with IT developments in client organizations, but in the longer term linking with international organizations such as INTOSAI, IEEE, ISO and the Software Engineering Institute may prove fruitful. As electronic funds transfer becomes the typical means for remitting and refunding tax, auditing EFT both within and across jurisdictions will increase audit risk. Common acceptable laws and standards for national and international cross-border transactions are still evolving, and e-payments may need to be extensively logged for audit analysis.

SAIs face increasing difficulty providing their legislatures with assurance that etaxation revenues have been properly realised. Cross-border transactions, trans-national corporations, double taxation avoidance agreements, transfer pricing, the shift to market oriented economies, analysis of information bases, the administrations' webpresence and attendant security concerns are some of the e-taxation issues they need to address. The solution lies in reputable standards for assessing e-taxation initiatives and in the appropriate training and equipping of tax auditors to audit its roll-out and operation.

About the author

Mukesh Arya B.Com (Hons), LL.B., AICWA, IAAS, CFE has served as Principal Director (Research, Training & IT Audit) in the Office of the Comptroller & Auditor General of India. Between 1997 and 2001 Mukesh was assigned to audit India's internal revenue department. Since then he has been engaged in preparing and implementing IT audit strategies for the government sector, including the audit of India's egovernance projects. Mukesh currently holds the position of Director of the Audit & Inspection Department of the United Nations Relief & Works Agency (UNRWA).

Conclusion
IT is rapidly shrinking the world economically, raising the prospects of governments losing control of tax collection, an ability that must be protected if they are to survive. Etaxation is the taxation authorities' response to their inherent desire to leverage technology to provide a better standard of service delivery. Tax auditors too are required to cope up with etaxation, and they must be properly trained and equipped to audit this emerging scenario effectively.