Information Systems Audit of E-Document Special Integrators

On 19 November 2019 the Revenue Administration (GİB) published the E-Document Special Integrators Information Systems Audit (ÖEBSD) Guide, which sets out the procedures and principles for the audit, by authorised independent audit firms, of the management of the information systems that e-document integrators use in carrying out their activities.

Under the new regulation, in special integrator applications made after its publication, candidate special integrators are expected to have had the Information Systems Audit described in the guide carried out and to have attached the "ÖEBSD Opinion Letter and Report" to their application file.

The aim of this audit is to assess, within the scope of the guide, whether the special integrator's information systems environment and the software it uses in its services meet the relevant Revenue Administration guides, the e-Invoice, e-Archiving, e-Archive Invoice, e-Waybill, e-Ledger and e-Signature standards and the norms appropriate to the service flow.

Accredited firms were given until 31/12/2020, starting from the publication of the guide, to have their first audit carried out; thereafter, an information systems audit is expected to be carried out every 2 years following the first audit date by independent audit firms authorised or permitted under the BSDHY and submitted to the Revenue Administration.

Scope of the audit

ÖEBSD Guide

International certifications, penetration testing service and BIS report

Staff qualifications

System and security assessment category

Of the processes in this scope, the "System and Security Assessment Category" is detailed under 7 sub-headings.

• Physical conditions and security measures
• Access security
• Business continuity, risk management and emergency plans
• Change management
• Audit trail management
• Management of external service providers
• Controls over the service software

Audit report

The audit report may contain an unqualified opinion, a qualified opinion or a disclaimer of opinion.

• For an unqualified opinion, at least 166 of the 208 control items must be assessed positively. Moreover, even if 166 items are positive, an unqualified opinion cannot be issued if the number of positive responses in any assessment category is below 70%.
• In the case of a qualified opinion, sanctions of a warning and gradual suspension of activities apply; in the case of an adverse opinion, suspension of activities and revocation of authorisation apply.
• If the report result is negative, the special integrator's activities are temporarily suspended. If a new audit report with an unqualified opinion is not submitted to the Revenue Administration within 6 months, the special integrator's authorisation is revoked.

How can ARSEN SFAI help you?

With our broad sector knowledge and advisory experience in regulatory compliance, ARSEN identifies the legal requirements and supports your organisation at every step of its compliance with the legislation.

Our compliance services cover current-state analysis, improvement work and audit stages within the framework of the provisions of the legislation.

Current-state analysis

A current-state analysis is carried out by assessing the institution's compliance with the provisions of the legislation.

Improvement work

A roadmap is presented for the gaps and findings identified in the compliance assessment, and improvement work is carried out.

Audit

An audit assessing compliance with the rules and principles of the Guide is carried out and an audit report is issued.