Compliance audit — traceability, fiscal and documentary evidence

When to use this playbook

This playbook applies to companies about to undergo an audit — internal comptrollership, external by firms such as Deloitte, PwC, EY, KPMG, BDO, Baker Tilly, Salles Sainz Grant Thornton, Mancera S.C.; audits by SAT, IMSS, STPS, CNBV or the Financial Intelligence Unit; audits by corporate clients requiring supplier traceability; or audits by international corporates that must demonstrate compliance in their Mexican operations.

The typical audits that put merch programs to the test are: (1) fiscal audit where SAT verifies that each expense has a valid CFDI 4.0, correct CFDI usage, 16% IVA broken out and delivery traceability; (2) anti-corruption compliance audit where gifts to public officials are verified against caps and disclosure; (3) data protection audit where personal data handling of recipients is validated under LFPDPPP; (4) origin audit for IMMEX companies or those with USMCA preferences where pieces must show rules-of-origin compliance.

It also applies to companies about to participate in public tenders (Compranet, Tianguis Digital, federal agencies, IMSS, ISSSTE, CFE, Pemex, Banobras, Bancomext, Nacional Financiera, Banorte, BBVA, Santander, Citibanamex, Scotiabank, HSBC, Inbursa, Banco Azteca) that must demonstrate traceability, fiscal compliance and supplier certifications. And to family businesses or groups preparing for sale, merger or investor entry that need impeccable due diligence.

What problem it solves

The typical merch program is built with informal suppliers, no origin traceability, no batch photo evidence, no CFDI 4.0 archive, no privacy notice for recipients and no gift disclosure. When audit arrives, the typical findings are: (1) CFDI 4.0 not issued or with incorrect CFDI usage; (2) 16% IVA not broken out or wrong rate; (3) missing delivery evidence; (4) personal-data handling without LFPDPPP; (5) gift to public official without disclosure; (6) imported piece without customs entry or without USMCA certificate of origin.

This playbook prevents each of those findings from the program design stage. Traceability is built from the brief — which piece will be produced, with what material, at which workshop, with which supplier, under which fiscal scheme, with which delivery, to which recipient, with which consent. Each step leaves evidence archived for at least five years to comply with Mexican regulation (CFF article 30, RMF, LFPDPPP).

Roles and responsibilities

The client brings: the comptrollership area that defines applicable compliance rules, the legal area that validates the LFPDPPP privacy notice and disclosure letters, the fiscal area that validates CFDI 4.0, the procurement area that selects certified suppliers and the program owner who documents the auditable brief. Corp-Merch brings: an auditable-brief methodology, a network of certified suppliers, batch photo evidence, CFDI 4.0 archive, digital file per program, audit accompaniment and technical support before the auditor.

During the audit itself Corp-Merch participates as an invited third party to explain the production process, present photo and documentary evidence, validate SKU traceability and sign truthfulness letters when the client requests it. The experience of having passed SAT, IMSS, CNBV and corporate-client audits lets us anticipate the most common findings and prevent them from the design stage.

KPIs to track

• Correctly stamped CFDI 4.0 rate (target 100%).
• Recipients with signed LFPDPPP consent rate (target 100%).
• Gifts to officials with full disclosure rate (target 100%).
• Pieces with per-batch photo evidence rate (target 100%).
• Audit-without-findings rate (target 100% with no material findings).