Mistake one: Editing or deleting issued invoices
Some older systems, or poorly configured settings in modern ones, still allow an invoice to be edited or cancelled after it is issued. This is one of the clearest things e-invoicing requirements prohibit: once issued, an invoice is final. How to avoid it: • Disable edit and delete permissions for everyone, including managers and system administrators. • Adopt a single correction path: a credit or debit note that references the original invoice and states the reason. • Review system settings periodically to make sure these permissions have not been re-enabled after an update.
Mistake two: Shared accounts and weak permissions
At many points of sale, several employees work under one account, or the default password is never changed. The requirements prohibit anonymous access and operating with a default password, because a shared account makes it impossible to know who issued an invoice. How to avoid it: • Create a personal account for each employee and require a password change on first login. • Define permissions by role: who issues invoices, who issues notes, and who views reports. • Deactivate the accounts of departing employees immediately.
Mistake three: Multiple sequences and counter resets
Some businesses use a separate sequence for each employee or each type of sale on the same device, or reset the counter at the start of every year. The requirements prohibit more than one sequence for the same unit and prohibit resetting the counter. In phase two, each invoice is linked to the hash of the previous one, so any break in the sequence becomes visible. How to avoid it: • Give each invoicing unit a single continuous sequence that is never reset. • If you need to separate sales for reporting, separate them by classification in the system, not by independent sequences.
Mistake four: Inaccurate date and time
Changing a device's time to backdate or postdate an invoice is explicitly prohibited, but it can also happen unintentionally when devices are not synchronised, so that an invoice appears to have been issued before the one preceding it. How to avoid it: • Configure all devices to take their time automatically from a reliable source. • Prevent users from changing time settings. • If you need to invoice a supply made on an earlier date, use the supply date field, not the issue date.
Mistake five: Neglecting rejected and pending invoices
In phase two, a rejected tax invoice is not a valid invoice, and a simplified invoice not reported within 24 hours is a compliance gap. Yet these invoices sometimes remain untouched for days, because nobody was assigned to review them. How to avoid it: • Enable a daily report of rejected and pending invoices. • Assign a specific person to review it and resolve the causes. • Analyse recurring rejection reasons, as they usually point to a master data issue that must be fixed at the root.
Mistake six: Not notifying ZATCA during outages
Connection or device failures happen. The problem is not the failure but handling it silently. ZATCA's guidelines require notifying it through the designated form if a failure prevents the taxpayer from complying, such as being unable to report within 24 hours or an invoicing device breaking down. How to avoid it: • Write an internal outage procedure that defines who is notified when, and who notifies ZATCA. • Keep a log of outages, their dates and the actions taken. • Once the fault is fixed, make sure invoices are issued electronically and submitted for clearance or reporting.
Mistake seven: Relying on non-compliant documents
• Handwritten invoices in branches or during system outages without following the proper procedure. • Scanned paper invoices sent as if they were electronic invoices. • Invoices from Word or Excel files for certain customers or services. None of these count as electronic invoices. Make sure every source of invoices in your business, whether a branch, an online store or a services department, issues from a compliant solution.
Penalties and the cost of non-compliance
E-invoicing penalties escalate according to the type of violation and how often it is repeated. ZATCA publishes the approved violations table on its official website, and it is best to refer to it directly for up-to-date details. But the cost is not limited to fines. There are also: • Customers rejecting invoices and delaying payment. • VAT returns that do not match the records on review. • Time and effort spent on corrections and reissuing. • An impact on the business's reputation with large customers and organisations.
Frequently asked questions
How do I know my system is compliant? Check that the provider confirms compliance with both phases, then test it yourself: can an invoice be edited? Can the time be changed? Can users log in with a shared account? Is it enough that ZATCA clears my invoices? Clearance means the invoice met the technical requirements, but compliance also covers procedures, retention and notification during outages. How often should compliance be reviewed internally? Follow up on rejected invoices daily, and review settings and permissions periodically, especially after any system update. What should I do if I discover an old error? Correct it with the appropriate note, and consult your tax adviser if the error affected previous returns.
Conclusion
E-invoicing compliance is not achieved simply by buying a system. It requires controlled permissions, no editing, an intact sequence and accurate time, daily follow-up of rejections, and notification during outages. Regular internal review costs far less than fixing errors after they are discovered. At Shams Solutions, we help businesses prepare their accounting and ERP systems for e-invoicing, from the initial assessment and data cleanup to integration with the FATOORA platform, go-live and ongoing follow-up. Contact us to review your business's setup and agree on the right next steps.