In a recent draft standard practice statement (SPS), IRD set out its views on the responsibilities of businesses opting to use electronic systems, such as Cloud computing systems, to store their business records. IRD noted that, while technology and storage options may have changed, businesses' responsibilities to store business records in compliance with tax rules have not.
Record retention requirements
In order to ensure that IRD can readily audit businesses' tax affairs, tax legislation imposes requirements upon businesses to retain financial and other tax-related records. Generally, the records must be retained for at least seven years from the end of the tax period to which they relate.
Further requirements include keeping all records in New Zealand and in English. IRD does, however, have the discretion to approve offshore record keeping and to allow records to be kept in another language, upon application.
For some time, businesses have had the option of storing records electronically rather than in paper form. Electronic storage is addressed in the Electronic Transactions Act 2002 (ETA). A schedule to the ETA specifically provides that businesses may discharge their record retention obligations under tax legislation by adopting appropriate electronic storage systems.
Integration issues with record retention requirements and Cloud technology
Increasingly, businesses are opting to use Cloud systems for the storage of financial and other business records. This involves using the internet to remotely upload data to Cloud data centres for storage.
From IRD's perspective, the potential problem with this form of storage is that the data centres are often located offshore. If a New Zealand business' records are stored only in an offshore data centre, this may leave them in breach of their statutory record retention requirements. The position would only be compliant if either:
- the business has received IRD authorisation to store its business records offshore; or
- the offshore provider has been authorised by IRD to hold records for New Zealand businesses.
The ability of offshore storage providers to apply for a "blanket" authorisation to store New Zealand businesses' records offshore, follows a recent legislative amendment.
In the draft SPS, IRD confirmed that it is the responsibility of a business to ensure that its business records are stored in New Zealand, or that proper authorisation is in place for offshore storage. The evolution of Cloud technology does not displace these obligations.
IRD noted that if a business is using Cloud or similar data storage systems and its business records are consequently stored in offshore data centres, then in the absence of proper authorisation, the business is technically committing an offence.
Obtaining IRD authorisation for offshore storage
A business intending to store business records with an offshore provider that does not hold a blanket authorisation, or an offshore provider wishing to obtain a blanket authorisation, must make a written application to IRD.
In determining whether to grant authorisation, IRD will consider the merits of each application on a case by case basis. The SPS notes that, in the case of a one-off application by a New Zealand business, IRD will consider the previous compliance record of an applicant business. In all cases, IRD will also require details of any procedures or restrictions the relevant provider has in place in relation to the removal of business records from its systems.
IRD will make an assessment of the capacity of the relevant storage system to maintain the integrity of the stored documents. More specifically, IRD will consider:
- the sufficiency of any backup or disaster recovery plan in guaranteeing the availability of the records for the full retention period;
- whether the system has sufficient access and data alteration controls to provide adequate security for the records; and
- whether the storage system is able to track entries, alterations and deletion of data.
Authorisations can be conditional or withdrawn
All authorisations will be conditional upon an undertaking by the business, or the provider, that the records will be kept in English, and will be provided to IRD upon request and at no cost.
IRD reserves the right to impose additional conditions within reason, or vary conditions, should the circumstances of the business or the provider change.
IRD may also, with reasonable notice, withdraw an authorisation, but will only do so where conditions have not been complied with, or the authorisation no longer appears necessary, eg the business shifts the records back to New Zealand.
Ultimate obligation is with the business
IRD clearly appreciates that Cloud systems offer effective and acceptable alternatives to more traditional storage systems. However, IRD is apparently (and perhaps justifiably) concerned that the convenience of Cloud systems may lead to complacency and inadvertent non-compliance with statutory retention requirements.
The tone of the SPS indicates that IRD will not take sustained non-compliance lightly. Businesses must therefore take care when opting to adopt Cloud systems and ensure that necessary IRD authorisation is in place.