SOPs, Governance & Controls

The ASP and ERP integration ensure invoice data can move correctly through the Continuous Transaction Control network, but they do not decide whether a given invoice should have been issued in the first place, at the right value, with the right approval, or with accurate master data behind it. Those are governance questions, not technical ones. Because the network reports invoices close to the point of transaction, an ungoverned error is reported to the FTA almost immediately, with no periodic review window left to catch it quietly beforehand.

Segregation of duties means no single person can both create and approve the same transaction, or both amend customer master data and issue an invoice to that same customer, without an independent check. Under periodic invoicing, a segregation gap might be caught at month-end review. Under Continuous Transaction Control, the same gap allows an unauthorised or erroneous invoice to reach the FTA before anyone else reviews it, which is why PNPC treats segregation-of-duties mapping as a core, non-optional part of SOP design for e-invoicing.

This depends on your company's existing governance structure and shareholder expectations. For many SMEs, documented management sign-off is sufficient and proportionate. For larger companies, groups with external investors, or companies where the board is actively involved in financial policy, formal board approval is the stronger position. What matters most is that adoption is documented in some form — a signed policy with no record of who approved it, and when, is weaker evidence if an auditor or the FTA later asks how the governance framework was established.

At minimum: what to do when the ASP or FTA network rejects a submission, what to do during a genuine connectivity or system outage, how a rejected invoice is corrected and resubmitted, who is accountable for resolving each exception type, and the maximum time allowed before an unresolved exception is escalated to management. A playbook without a named accountable role and a resolution deadline tends to leave exceptions sitting unresolved, which compounds risk the longer they remain open.

Taxable and exempt persons must retain records sufficient for the Federal Tax Authority to verify their Corporate Tax position for at least seven years after the end of the relevant tax period. E-invoice data, ASP transmission logs, and any exception or override approvals form part of that evidence trail. PNPC designs the archiving and retention policy as part of SOP design specifically so these records remain retrievable, indexed by period and entity, for the full retention window — not simply stored somewhere without a retrieval plan.

This should be a materially tighter control than standard invoice approval, because credit notes and cancellations are the transaction types most exposed to misuse — reversing revenue, correcting an error inappropriately, or covering an unauthorised discount. PNPC typically recommends a higher approval level than standard invoicing, mandatory documented justification for every credit note, and a periodic review of credit note volume and pattern by someone independent of the person issuing them.

This is exactly the scenario SOP design has to anticipate rather than assume away. PNPC builds a realistic exception path for genuinely urgent situations — a documented fast-track approval with a lower-friction but still logged sign-off, rather than an unofficial bypass that leaves no trail at all. A policy with no legitimate fast path for real urgency tends to get informally bypassed anyway, which is worse than designing a controlled fast path from the outset.

PNPC recommends a quarterly control refresh as a baseline — reviewing access rights, the approval matrix, and exception-handling assignments — plus an ad hoc review whenever the Ministry of Finance or FTA publishes further detail on the e-invoicing programme's phased scope, thresholds, or requirements, since the framework continues to evolve as the rollout matures.

PNPC runs the staff training as part of the engagement, with role-specific sessions for invoice issuers, approvers, and master-data custodians rather than a single generic session for everyone. We find role-specific training is materially more effective, since each group needs different, specific guidance rather than a broad overview of the entire policy.

The need scales with complexity — number of staff issuing invoices, number of entities, and transaction volume — but the underlying principle applies to any business bringing invoice issuance under a Continuous Transaction Control model. A single owner-operator issuing a handful of invoices personally may only need a lightweight checklist. A business with multiple invoicing staff, multiple entities, or meaningful credit note volume needs a formal, documented SOP framework to manage the real segregation-of-duties and exception risk that scale introduces.

Master data governance is the policy controlling who can create, amend, or deactivate customer and supplier records — the records that supply the Tax Registration Number, legal entity name, and address information a structured e-invoice depends on. It is a priority because a single unauthorised or erroneous master-data change can silently corrupt every subsequent e-invoice generated against that record, and because master data is frequently the least controlled part of a business's existing process, having grown informally over time.

Where entities share staff, systems, or invoicing processes, PNPC designs a consistent governance framework applied across both, adapted only where each entity's specific licensing, VAT registration, or Corporate Tax position genuinely requires a different treatment. Applying inconsistent, entity-specific governance where the underlying process is actually shared tends to create confusion and gaps at the boundary between entities.

Evidence that the documented SOPs actually operated in practice, not just that a policy document exists — approved invoices showing the required sign-off, a master-data change log showing authorisation, exception records showing how a rejected invoice was resolved, and a formal adoption record showing when and by whom the governance framework was approved. A well-written SOP with no operating evidence behind it is a weaker position than a simpler SOP that is clearly and consistently followed.

For a single-entity business with a reasonably formal existing approval process, the full cycle — from scoping through drafting, workshops, training, and go-live monitoring — typically takes five to six weeks. Multi-entity groups, businesses with several invoicing departments, or businesses starting from an entirely informal control environment take longer, since the roles and segregation-of-duties mapping step expands with each additional department or entity.

A strong existing process is a good starting point, not a reason to skip governance design entirely. PNPC still reviews it specifically against the risks a Continuous Transaction Control model introduces — the removal of a periodic correction window, the higher exposure of credit notes and master-data changes, and the record-retention requirements for continuously reported data. In many cases the engagement is materially shorter because it builds on and formalises what already works, rather than designing a framework from nothing.

This engagement covers design, drafting, workshops, training, and a go-live monitoring window to catch and adjust for practical issues. Ongoing operational support, monitoring, and periodic control checks after that initial window are covered under our Post Go-Live Support service, which many clients run alongside or immediately following SOP design, ensuring continuity rather than a handoff gap between the two.

Through the workshop and testing stage, where the draft SOP is applied to real recent transactions from each department before it is finalised, through role-specific training rather than a generic policy announcement, and through the go-live monitoring window that adjusts the SOP where it proves impractical against real conditions. PNPC also recommends a quarterly control refresh specifically to catch drift before an unfollowed SOP becomes the normal, unquestioned practice.