Evaluating the internal controls of an assessee (taxpayer) related to the regular compliance of GST laws is a critical part of the audit process. Strong internal controls ensure that the taxpayer adheres to GST regulations, avoids errors, and minimizes the risk of penalties and interest due to non-compliance. Here’s a systematic approach to evaluating the internal controls:

1. Document Management and Record-Keeping Controls:

• Invoice Management: Check if the business has a system for issuing and recording tax invoices and credit notes for both outward and inward supplies. Internal controls should ensure that:
  • All taxable sales are invoiced correctly, with GST amounts clearly segregated.
  • Invoices and credit notes are properly numbered, dated, and recorded in the system.
  • Duplicate or erroneous invoices are prevented by the system.
• Purchase Invoices: Ensure that purchase invoices from suppliers are collected and recorded promptly. ITC claims must match with the purchase invoices received and the GSTR-2A/2B data.
  • Cross-check supplier details and GST amounts to avoid fraudulent claims.

2. GST Registration and Updates:

• Registration Verification: Verify if the business is properly registered under GST based on its turnover and nature of supplies.
  • Ensure that the GSTIN is valid and regularly updated in the system for all business locations.
  • Check if any business locations or branches that are required to have separate GST registrations have been properly registered.
• Timely Updates: Verify if updates regarding business structure (e.g., change in business name, address, etc.) are promptly made on the GST portal. Internal controls should ensure timely submission of any necessary updates.

3. GST Return Filing and Timeliness:

• Filing of Returns (GSTR-1, GSTR-3B, GSTR-9): Ensure that internal controls exist to file returns on time:
  • GSTR-1: Ensure that all outward supplies (sales) are recorded in the correct period and filed by the due date.
  • GSTR-3B: Check if the summary return is filed on time, and the correct tax liabilities and input tax credits (ITC) are reported.
  • GSTR-9 (Annual Return): Ensure that the business has an internal process to file the annual return and reconcile it with the monthly returns.
• Automated Reminders: Evaluate whether there are automated reminders for due dates for all GST filings, ensuring no late submission or missing returns.
• GST Payment: Verify if the business has controls in place to make GST payments promptly before the due date to avoid late fees and interest.

4. Internal Reconciliation Process:

• Monthly Reconciliation of Sales: Ensure that the sales recorded in the books of accounts reconcile with GSTR-1. Internal controls should ensure that all sales transactions (including exempt or zero-rated) are accounted for correctly in the returns.
• Input Tax Credit (ITC) Reconciliation: Review if the ITC reported in GSTR-3B reconciles with the purchase records in the books, and ensure the ITC claims match the purchase invoices recorded and GSTR-2A.
  • Internal Control Mechanism: Verify that internal controls prevent claiming ineligible ITC (e.g., on blocked goods or services) or discrepancies due to mismatches with the supplier’s GSTR-1.
• Cross-Checking with GSTR-2A: Ensure there is a process to reconcile GSTR-2A (or GSTR-2B) with book entries for purchases to ensure that ITC is claimed only for eligible items.
• Year-End Reconciliation: Check if the business has a year-end reconciliation process to align the books of accounts with the annual returns (GSTR-9).

5. Segregation of Duties and Responsibility:

• Role Assignment: Internal controls should ensure that duties are properly segregated to reduce the risk of fraud or errors. Different personnel should be responsible for:
  • Recording of transactions
  • Filing GST returns
  • Approval of invoices
  • Verification of ITC claims.
• Approval and Authorization Process: Verify that there is an approval process for GST returns and payments. Ensure that all returns are approved by the designated person before filing.
• Employee Training: Ensure regular training for employees on GST compliance, changes in law, and internal processes.

6. Automation and System Controls:

• ERP System Integration: Evaluate whether the business uses an ERP system that integrates GST functionality. Internal controls should ensure that the ERP system automatically:
  • Captures all sales and purchase invoices with GST data.
  • Prepares and files GST returns (GSTR-1, GSTR-3B).
  • Ensures tax liabilities are correctly calculated and matched with available ITC.
• System Checks: Ensure that automated controls in the system prevent errors, such as:
  • Duplicate entries
  • Incorrect GST rates
  • Misclassification of goods/services
• Data Backup: Confirm that data is regularly backed up to avoid loss in case of system failures.

7. Monitoring and Review of Compliance:

• Periodic Internal Audits: Ensure that the business conducts regular internal audits to verify compliance with GST laws, especially focusing on return filing, ITC claims, and GST payments.
• GST Compliance Dashboard: If available, check if there is a compliance dashboard that tracks key GST metrics such as:
  • Upcoming due dates for returns and payments.
  • GST paid vs. GST collected.
  • ITC utilization and reconciliation.
• Exception Reporting: Ensure that the system has controls to report exceptions, such as mismatched sales/purchases, missing invoices, or unfiled returns.

8. Audit Trail and Documentation:

• Audit Trail: Ensure that the internal system maintains an audit trail of all GST-related transactions and activities, including who entered, approved, or modified any data.
• Documentation Retention: Verify that the business has a process for retaining GST-related documentation (invoices, returns, payments) for the prescribed period (typically 6 years).
• Compliance with GST Invoicing: Ensure that GST invoices are issued in accordance with the law (proper invoice format, GSTIN details, HSN/SAC codes, etc.).

9. Handling GST Audits and Scrutiny:

• Audit Preparation: Ensure that internal controls are in place for preparing and handling GST audits or any GST-related scrutiny from tax authorities. This includes:
  • Maintaining records and documentation.
  • Being prepared to provide detailed reconciliation reports.
  • Conducting a pre-audit check to ensure all compliance gaps are addressed.

10. Compliance with Specific GST Provisions:

• Reverse Charge Mechanism (RCM): Verify if there are internal controls to ensure that GST under RCM is accurately calculated, reported, and paid on time.
• TDS/TCS Compliance: For businesses covered under GST TDS/TCS provisions, ensure that the process of collecting, reporting, and remitting TDS/TCS is well-established.
• Exports and Zero-Rated Supplies: Ensure there are controls in place for correctly handling exports and zero-rated supplies, including refund claims under the GST law.