Is Your Accounting System Audit-Ready? SAF-T UA, E-Audit and Accounting Transparency in Ukraine in 2027

A tax inspector, auditor, investor, or bank can request your accounting data without warning. Since 2026, the State Tax Service of Ukraine (STS) has automated part of its audits of large taxpayers, and a SAF-T UA file must be submitted within two business days of a request.

Yevhen Morhaiev, Commercial Director at CBPM Service, and Nestor Baranovskyi, ERP Solution Architect, explain the four warning signs that an accounting system is not ready for this, and why most of the preparation is data work that should start long before the first request.

The signs are these: a balance sheet line cannot be drilled down to transactions; the system does not show who changed a posted document; related-party transactions are recorded as ordinary ones; and reported revenue depends on who prepared the report.

At the end of the article, you will find a self-assessment checklist and a preparation plan.

The Tax Authority Is Not the Only One Checking Your Books

The range of parties with the right or a reason to examine a company’s accounts is wider than most owners assume.

Nestor Baranovskyi names the tax authority and other government bodies first. An audit can also be initiated by co-owners or by organizations whose conclusions open up new markets and opportunities for the company. Yevhen Morhaiev adds banks reviewing a loan application, grant providers monitoring how funds are spent, and owners themselves when they commission an independent audit to make sure the business is in good shape.

People usually come back to this issue when it is already quite late and the audit is at the door

– Nestor Baranovskyi, ERP Solution Architect, CBPM Service

In the past, a company’s accounting could remain in relative chaos while the company hoped that nobody would notice discrepancies or pay attention to them. The development of information systems has taken that hope away.

The requirements for how companies submit data for audits have changed, and the main one is end-to-end traceability from the source document to the financial statements: every figure in a report must be traceable to the transaction it came from.

Two Business Days to Respond: How Tax Audits Have Changed

Inspectors used to request a document, and the company would prepare it on the spot, bring it in, and put off everything related to it until the next day. That habit of putting things off is still visible in many accounting departments, even though the procedure itself has changed.

Now they simply say, ‘Please upload all your business transactions.’ You can no longer finalize, sign, or put documents in order while the audit is underway. Everything is already in the system.

– Nestor Baranovskyi, ERP Solution Architect, CBPM Service

This shift is now embedded in regulatory practice. On January 1, 2026, the STS launched its e-audit system. It automatically checks the structure, logical consistency, and completeness of accounting data, runs analytical tests, and flags high-risk transactions.

Its main data source is the SAF-T UA standard audit file, which replaces dozens of separate documents. Large taxpayers must provide it within two business days of a request during a documentary tax audit (paragraph 85.2 of the Tax Code of Ukraine).

How the Audit Has Changed

	Before	Now
How the company submits data	Separate documents for each request	A single standardized SAF-T UA file
Time to respond	Documents were finalized during the audit	Two business days after the request (for large taxpayers)
Who analyzes the data	An inspector, manually, document by document	Automated e-audit tests flag high-risk transactions
What can be fixed during the audit	A document can be finalized or prepared on request	Nothing: the file is generated from what is already in the system

Nestor recalls that CBPM Service has repeatedly seen companies fail to submit data in the required format on time. This strained their relations with the regulators, and the audit findings went against them. Companies tried to justify the delays with war-related force majeure, but the longer the war goes on, the less weight inspectors give to that argument.

• Two business days leave no time to collect data manually. The file is generated from what is already in the accounting system, exactly as it is stored there.

SAF-T UA: What the File Contains and Who Else Will Ask for Data in This Format

The requirement itself is not new.

SAF-T (Standard Audit File for Tax) is an international standard for exchanging accounting data, first published by the OECD in 2005.

SAF-T UA is its Ukrainian adaptation: a company provides the regulators, primarily the tax authority, with consolidated accounting data broken down to the level of each business transaction.

What a SAF-T UA File Contains and What Needs to Be in Order in Your Accounting

File section	What it contains	What needs to be in order in your accounting
Header	Company registration code (EDRPOU), reporting period, accounting currency, generation date	Correct company details
Master files	Customers and suppliers, products, chart of accounts, tax rates	Complete counterparty details with no duplicates, UKTZED commodity codes, chart of accounts mapped to the standard
General ledger entries	Every journal entry for the period: date, debit, credit, dimensions, reference to the source document	Every entry is linked to a document, and dimensions are filled in
Source documents	Sales and purchase invoices, payments, movements of goods	Document totals match the journal entries

Transactions in the file reference the master files, so a discrepancy in one section immediately shows up in another. According to an STS clarification (category 130.01 of its public reference database, ZIR), SAF-T UA is submitted on request during a documentary tax audit and is not part of regular reporting.

For large taxpayers, this procedure has applied since 2025; for all VAT payers, it is planned to apply from 2027.

The tax authority already wants to see all our inner workings, down to the level of individual business transactions. Clearly, other authorities, owners, and external auditors will also require information in this format.

– Yevhen Morhaiev, Commercial Director, CBPM Service

Warning Sign 1: A Figure in the Report Cannot Be Drilled Down to a Transaction

According to Nestor Baranovskyi, the habit of compiling information for investors in Excel spreadsheets is gradually fading. Excel itself is not to blame: it is also an information system of sorts, and any system follows the logic built into it. The question is whether that logic meets the new requirements.

The new requirements are not just about submitting a figure but about being confident that it can be substantiated: drilling a balance sheet line down to the level of a business transaction with all the necessary dimensions, and getting this information quickly at any time.

– Yevhen Morhaiev, Commercial Director, CBPM Service

A spreadsheet compiled by hand shows the total but does not preserve the path to it. If a report line cannot be drilled down to journal entries and source documents, every figure in it remains an unsupported claim in an auditor’s eyes.

Warning Sign 2: The System Does Not Show Who Changed a Transaction and When

An audit trail is the ability to trace the history of a source document: how the transaction was originally recorded, what changes were made later, and by whom.

All changes must be recorded to confirm that the accounts have not been misstated in favor of particular groups within the company or its management.

Some of this seems obvious to businesses: knowing when and by whom a document was changed and which entry was generated. However, regulators already require far more detailed disclosure than companies are used to providing.

The simplest test: if the system cannot tell you who last changed a specific posted transaction and when, your accounting already has a weak spot.

In Microsoft Dynamics 365 Business Central, this requirement is built into the system’s logic. Posted transactions are not edited: an error is corrected with a reversing entry of the opposite sign or with a corrective document, while the original entry stays in the books. For master data and settings, the Change Log records the user, the date and time, and the old and new field values in the tables selected for tracking. As a result, the history of a transaction can be reconstructed from the system itself, without interviewing the people who posted it.

Warning Sign 3: Related-Party Transactions Are Recorded as Ordinary Ones

Yevhen Morhaiev considers this warning sign the least obvious to business owners.

Related-party transactions are among the first things auditors and investors check, because Ukrainian companies often have complex multi-entity legal structures. Typical examples include property leases from the owner or director, loans between affiliated legal entities, and settlements with the founder personally.

Such transactions are usually booked like any other business transaction, although by their nature they should be clearly flagged so that the company can present them during an audit. Accounting standards also require separate disclosure. In Ukraine, this is set out in National Accounting Standard 23 “Related Party Disclosures” (NP(S)BO 23); under IFRS, in IAS 24, which explicitly lists leases, loans, and guarantees among such transactions.

Any information can be untangled down to the lowest level, but it can take weeks to understand why a transaction was recorded the way it was. And auditors see this as a lack of transparency even when nobody intended to hide anything.

– Yevhen Morhaiev, Commercial Director, CBPM Service

• The easiest time to flag a related-party transaction with a separate attribute or dimension is when it is recorded. Reconstructing its substance after an auditor has already asked about it takes much longer.

Warning Sign 4: Reported Revenue Depends on Who Prepared the Report

Another classic problem in interpreting transactions concerns the moment when revenue is considered earned.

The point of revenue recognition is set by the company’s accounting policy and general accounting rules, so revenue should be recognized according to a single rule. A decision made by a specific person about a specific case at a specific moment is not such a rule.

The warning sign is visible without an in-depth audit: two reports for the same period show different revenue figures depending on who prepared them.

Such a discrepancy undermines confidence in the company’s valuation, and the consequences do not end there. Yevhen Morhaiev stresses that the demand for transparent accounting no longer comes from regulators alone: banks base lending decisions on these figures, grant providers use them to verify how funds are spent, and owners rely on them to plan growth.

If the result depends on who prepared the report, each of these decisions rests on an unreliable foundation.

Checklist: Will Your Accounting Pass an External Audit?

The list is based on the warning signs discussed by the experts and on the SAF-T UA file requirements. Every item you cannot check off points to an area where preparation should begin.

☐   Any balance sheet line can be drilled down to journal entries and source documents without manual spreadsheets.

☐   The system shows who last changed each posted transaction, when, and what exactly was changed.

☐   Errors in posted transactions are corrected with reversing entries or corrective documents, and the original is never edited.

☐   Related-party transactions (leases from the owner or director, loans between group entities, settlements with the founder) are flagged with a separate attribute or dimension.

☐   The point of revenue recognition is set out in the accounting policy, and two reports for the same period show the same revenue figure.

☐   Counterparty master data contains all mandatory details and has no duplicates, and UKTZED codes are filled in for all items.

☐   You know how your internal chart of accounts maps to the SAF-T UA standard.

☐   You know which systems hold journal entries, source documents, payments, and movements of goods, and how to combine them into a single file.

The full version of the checklist contains 16 items and simple tests you can run in-house. The items cover different areas: accounting policy, system settings, master data, and data quality. This makes the PDF easy to pass on to your CFO, chief accountant, and the person responsible for the accounting system, so each of them can review their own part.

Where to Start Before an Audit Is at Your Door

If any of these warning signs sound familiar, Yevhen Morhaiev advises addressing them now. A request for detailed data disclosure can come from any direction, and, as practice shows, problems arise at the worst possible moment.

Achieving this level of detail is painstaking work, and taking it on once an audit has already started is entirely wrong and impractical.

– Yevhen Morhaiev, Commercial Director, CBPM Service

In CBPM Service’s experience, preparing for SAF-T UA is mostly analytical work on the client’s side. The software part comes down to exporting the file, while most of the effort goes into putting the underlying data in order. This work involves four steps.

1. Source inventory. Identify where journal entries, source documents, master data, payments, and movements of goods are stored, in what formats and how complete they are. Data is often scattered across the accounting system, CRM, warehouse software, and banking systems.
2. Chart of accounts mapping. Map the internal chart of accounts to the SAF-T UA standard, with separate mappings where parallel accounting is kept under Ukrainian national standards and IFRS.
3. Master data cleansing. Fill in mandatory counterparty details (VAT number, EDRPOU code, country code, address), remove duplicates and obsolete records, and add UKTZED codes to the item master.
4. File validation. Validate the file against the schema and business rules: balanced entries, document totals, and the presence of every counterparty in the master data.

Two decisions from the previous sections complete these steps: a separate flag for related-party transactions and an established revenue recognition rule.

• The fewer manual spreadsheets and separate applications stand between the source document and the report, the shorter the path from an inspector’s request to a ready file.

Preparing Your Accounting for an E-Audit or Investor Due Diligence?

In many projects, the CBPM Service team has prepared accounting systems to generate data for SAF-T UA, for other regulatory authorities, and for electronic document management.

During a migration from 1C to Microsoft BC, we set up statutory accounting in line with Ukrainian requirements, document management with SAF-T UA support and integration with the Ukrainian e-document services Vchasno and M.E.Doc, as well as an audit trail for every transaction.

If you could not check off at least one item on the checklist, contact us. We will discuss where your company should start its preparation.