Keeping business records in the cloud: what New Zealand firms should check first.

What Inland Revenue says about electronic records

Inland Revenue's record-keeping guidance is short and direct. It tells businesses to keep all records, including those in electronic form, for at least seven tax years. The business.govt.nz guidance on keeping tax records says the same thing in plainer words: keep accurate records of your finances and hold on to them for seven years.

Electronic records are expected, not merely tolerated. Inland Revenue's guidance asks that records kept on a computer are kept in a format it can use. In practice that means a file Inland Revenue can open and read, not a proprietary export that only one piece of software understands, and not a scan so poor that the figures cannot be made out.

The overseas question

The point many firms miss sits in the same guidance. Inland Revenue says that if you store your records offshore, including through cloud computing, you should make sure either you or your cloud service provider has its approval. A great many popular cloud services run outside New Zealand, so this is worth checking for every system that acts as the home of your tax records, not just the obvious ones.

The practical step is to list where each category of record actually lives, then ask each provider whether it holds that approval, or ask your adviser how to seek it yourself. Inland Revenue is the authority on what it requires, so read its current guidance rather than relying on a summary, including this one.

System of record, or a place to share

It helps to separate two jobs that are often blurred. A system of record is where the authoritative copy of a document lives for the years you must keep it: your accounting software, your document management system, your practice management tool. A data room is a controlled place to share copies of selected records with people outside the business for a defined piece of work, such as an Inland Revenue audit, a sale, a raise or a lending application.

Keeping those jobs apart makes both easier. Your system of record stays tidy and complete. The data room holds exactly what a particular reviewer needs, for as long as they need it, and records who looked at what. When the work is over, you close the room and export what was shared, with an index, for your own file.

Questions to put to any cloud service

• Where are the documents held, and which other services, such as sign-in and payments, run elsewhere?
• Does the provider hold any approval Inland Revenue requires for records kept offshore, if you plan to use it as a home for tax records?
• Can you export everything, with folder structure intact, in formats that open without the provider's software?
• Is there a record of who viewed, downloaded or changed each document?
• When you delete something, are the stored files and their previews removed?