ISO/TS 21377:2023

ISO/TS 21377:2022(E)
ISO/TC 295
Date: 2022-10-1211-17
Exchange formats for the audit data collection standard: XML and JSON

For Publication

Warning for WDs and CDs
This document is not an ISO International Standard. It is distributed for review and comment. It is subject to
change without notice and may not be referred to as an International Standard.
Recipients of this draft are invited to submit, with their comments, notification of any relevant patent rights of
which they are aware and to provide supporting documentation.


A model manuscript of a draft International Standard (known as “The Rice Model”) is available at

---------------------- Page: 1 ----------------------
ISO/TS 21377-1:2022(E)
© ISO 2022
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part
of this publication may be reproduced or utilized otherwise in any form or by any means, electronic or
mechanical, including photocopying, or posting on the internet or an intranet, without prior written
permission. Permission can be requested from either ISO at the address below or ISO’s member body
in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Email: copyright@iso.org
Website: www.iso.orgwww.iso.org
Published in Switzerland
© ISO 2022 – All rights reserved
ii © ISO 2022 – All rights reserved

---------------------- Page: 2 ----------------------
ISO/TS 21377-1:2022(E)
Contents
Foreword .iv
Introduction . v
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 2
4 Exchange formats . 3
4.1 General . 3
4.2 XML . 4
4.2.1 General . 4
4.2.2 Technical requirements . 4
4.2.3 XML schema . 5
4.2.4 XML sample . 11
4.3 JSON . 12
4.3.1 General . 12
4.3.2 Technical requirements . 12
4.3.3 JSON schema . 15
4.3.4 JSON sample . 19
4.4 CSV . 21
4.4.1 General . 21
4.4.2 Technical requirements . 21
4.4.3 CSV sample . 22
4.5 Mapping ADCS tables to XML and JSON . 23
4.5.1 General . 23
4.5.2 Mapping table sample . 23
4.6 Cross topics . 25
4.6.1 General . 25
4.6.2 Character encoding conventions. 25
4.6.3 Versioning . 25
4.6.4 Multi-platform and multi-system data transfer . 26
4.6.5 Conventions of folder naming and file naming . 26
4.6.6 File compression . 27
4.6.7 Representation of special field types . 28
4.6.8 Extension methodology and rules . 28
4.6.9 Encryption of sensible data . 28
Annex A (informative) XML tags abbreviation list . 30
Annex B (informative) List of XML schemas . 35
Annex C (informative) List of JSON schemas . 38
Annex D (informative) Data model . 41
Annex E (informative) XML and JSON schemas . 51
Bibliography . 52

© ISO 2022 – All rights reserved © ISO 2022 – All rights iii
reserved

---------------------- Page: 3 ----------------------
ISO/TS 21377-1:2022(E)
Foreword
ISO (the International Organization for Standardization) is a worldwide federation of national standards
bodies (ISO member bodies). The work of preparing International Standards is normally carried out
through ISO technical committees. Each member body interested in a subject for which a technical
committee has been established has the right to be represented on that committee. International
organizations, governmental and non-governmental, in liaison with ISO, also take part in the work. ISO
collaborates closely with the International Electrotechnical Commission (IEC) on all matters of
electrotechnical standardization.
The procedures used to develop this document and those intended for its further maintenance are
described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the
different types of ISO documents should be noted. This document was drafted in accordance with the
editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives).
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. ISO shall not be held responsible for identifying any or all such patent rights. Details of any
patent rights identified during the development of the document will be in the Introduction and/or on
the ISO list of patent declarations received (see www.iso.org/patents).
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and
expressions related to conformity assessment, as well as information about ISO's adherence to the World
Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT), see
www.iso.org/iso/foreword.html.
This document was prepared by Technical Committee ISO/TC 295, Audit Data Servicesdata services.
Any feedback or questions on this document should be directed to the user’s national standards body. A
complete listing of these bodies can be found at www.iso.org/members.html.
© ISO 2022 – All rights reserved
iv © ISO 2022 – All rights reserved

---------------------- Page: 4 ----------------------
ISO/TS 21377-1:2022(E)
Introduction
Accounting and enterprise resource planning (ERP) software packages are widely used in businesses and
by various government organizations to manage and track business processes, post transactions and
produce financial reports. Because of the nature of the information contained within the ERP systems,
the data isare also leveraged by internal and external auditors to assess the business controls, processes
and financial reporting. There are numerous ERP packages that are used by businesses and government
organizations, which can vary greatly in design (e.g.,. interfaces, data content, data formats, operational
reports, management reports, financial reports). These and other design differences present challenges
in the collection of data for auditing supervision management purposes.
This document concerns the specification of technical exchange formats as output file formats for the
functional content defined in ISO 21378.
© ISO 2022 – All rights reserved © ISO 2022 – All rights v
reserved

---------------------- Page: 5 ----------------------
TECHNICAL SPECIFICATION ISO/TS 21377:2022(E)

Exchange formats for audit data collection standard: XML and
JSON
1 Scope
ISO 21378, the audit data collection standard (ADCS)), defines the functional requirements for
exchanging audit data in flat file format. This document concerns the specification of technical exchange
formats in extensible markup language (XML), javascriptJavaScript object notation (JSON) and flat
filecomma-separated values (CSV) as output file formats for the functional content defined in ISO 21378.
This document also contains the following schemas and sample files for tables in ISO 21378.
— XML schema,;
— XML sample file,;
— JSON schema,;
— JSON sample file.
To keep the three exchange formats (XML, JSON, and CSV) consistent, this document also specifies how
to use the technical solution in the CSV format.
2 Normative references
The following documents are referred to in the text in such a way that some or all of their content
constitutes requirements of this document. For dated references, only the edition cited applies. For
undated references, the latest edition of the referenced document (including any amendments) applies.
ISO 21378:2019, Audit data collection
ISO 8601--1, Date and time — Representations for information interchange –— Part 1: Basic Rules rules
ISO/IEC 21778:2017, Information technology — The JSON data interchange syntax
W3C Extensible Markup Language (XML) 1.0 (Fifth Edition). Available at
https://www.w3.org/TR/2008/REC-xml-20081126/https://www.w3.org/TR/2008/REC-xml-
20081126/
W3C XML Schema Part 1: Structures Second Edition. Available at https://www.w3.org/TR/2004/REC-
xmlschema-1-20041028/https://www.w3.org/TR/2004/REC-xmlschema-1-20041028/
W3C XML Schema Definition Language (XSD) 1.1 Part 2: Datatypes. Available at
https://www.w3.org/TR/2012/REC-xmlschema11-2-20120405/https://www.w3.org/TR/2012/REC-
xmlschema11-2-20120405/
© ISO 2022 – All rights reserved 1

---------------------- Page: 6 ----------------------
ISO/TS 21377:2022(E)
JSON Schema: A Media Type for Describing JSON Documents. Available at https://json-
schema.org/draft/2020-12/json-schema-core.htmlhttps://json-schema.org/draft/2020-12/json-
schema-core.html
3 Terms and definitions
For the purposes of this document, the following terms and definitions apply.
ISO and IEC maintain terminology databases for use in standardization at the following addresses:
— ISO Online browsing platform: available at https://www.iso.org/obp
— IEC Electropedia: available at https://www.electropedia.org/
3.1
data
reinterpretable representation of information in a formalized manner suitable for communication,
interpretation or processing
[SOURCE: ISO/IEC 11179-1:2015(en), 3.2.6], 3.2.6, modified — Notes to entry have been deleted.]
3.2
data element
basic unit of identifiable and definable data (3.1)
[SOURCE: ISO 2146:2010, 3.4, modified — The admitted term "element" has been deleted.]
3.3
data file
collection of data (3.1) records having a homogeneous structure
[SOURCE: ISO 14825:201121378:2019, 3.1.2, modified — The word "related" and the note to entry have
been deleted.]4]
3.4
data structure
framework comprising a number of data elements (3.2) in a prescribed form
[SOURCE: ISO 21007-1:2005, 2.16, modified —"— The word "element" has been deleted from the term.]
3.5
syntax
set of rules, principles and processes that govern the data structure (3.4)
3.6
data model
graphical and/or lexical representation of data (3.1), specifying their properties, structure, and inter-
relationships
© ISO 2022 – All rights reserved
2 © ISO 2022 – All rights reserved

---------------------- Page: 7 ----------------------
ISO/TS 21377:2022(E)
[SOURCE: ISO/IEC 11179-1:2015(en),, 3.2.7]
3.7
entity
group of data elements (3.2) describing an object
Note 1 to entry: EquivalentIt is equivalent to “Object Classobject class” in ISO/IEC 11179-1:2015.
3.8
relation
relationship between two entities (3.7)
3.9
attribute
data element (3.2) describing an object
Note 1 to entry: EquivalentIt is equivalent to “Propertyproperty” in ISO/IEC 11179-1:2015.
3.10
domain
set of properties to define the value space of attributes (3.9)
Note 1 to entry: containA domain contains code lists (3.11) and code values. Equivalent (3.12). It is equivalent to
“Representationrepresentation” in ISO/IEC 11179-1:2015.
3.11
code list
standardized list of code values (3.12) with a common scope
3.12
code value
one value from a code list (3.11)
4 Exchange formats
4.1 General
The data format is the carrier of data exchange between auditor and auditee. So, it is necessary to make
an agreement on data format between the two sides in data exchange. There are multiple options for
output data formats.
In the case of ADCS, three exchange formats are specified:
— XML data files defined by XML schema specification (W3C);
— JSON data files defined by JSON schema specification (json-schema.org);
— CSV data files.
These three formats shall contain the same functional ADCS content specification in accordance with
ISO 21378 but differ on the technical level only.
© ISO 2022 – All rights reserved © ISO 2022 – All rights 3
reserved

---------------------- Page: 8 ----------------------
ISO/TS 21377:2022(E)
This means that these exchange formats are convertible from one to the other. For instance, convertingit
is possible to convert XML data files to CSV data files or CSV data files to JSON data files.
To generate the XML and JSON schemas in a consistent way, a data model is set up from ISO 21378
according to ISO/IEC 11179-1:2015. This data model is used to create consistent exchange format
specifications.
Each ADCS table is modelled into a “Parent Entity” and reusable data groups within a table are modelled
into “Child Entities”, e.g.,for example, “Physical Address”, “Billing Address”, “Tax”, “Created”, “Modified”,
“Posted” etc.,”, completely in line with ISO 21378. This way guarantees that all reusable groups that occur
in multiple tables are defined in the same way.
As the data model is not in scope of this document, it is only documented for reference purposes in
Annex D.
The various technical specifications are explained in this document,; and the additional packaging and
communication agreements are defined.
4.2 XML
4.2.1 General
This subclause describes how to exchange the ADCS tables using XML data files.
XML data files shall be created in accordance with the syntax specifications written in W3C Extensible
Markup Language (XML) 1.0 (Fifth Edition) and also in accordance with the functional requirements
written in ISO 21378.
4.2.2 Technical requirements
4.2.2.1 General
Only one ADCS table, with a number of lines, shall be sent in one XML data file.
The filename shall comply with the rules described in Subclause 4.6.5.
Each ADCS table has its own XML schema to define its XML file. When there are 71 tables, there are 71
XML schemas.
Such an XML data file contains (schematic):

  xsi:schemaLocation='name-space xml-schema-name.xsd'
  xmlns='name-space'
  xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'>
  
    value
    
      value
    
  

Italics printed
© ISO 2022 – All rights reserved
4 © ISO 2022 – All rights reserved

---------------------- Page: 9 ----------------------
ISO/TS 21377:2022(E)
Italicized text shall be replaced by the definitions in this document.
4.2.2.14.2.2.2 4.2.2.1 Root tag
The root tag equals "Adc" followed by the ADCS table name like: “AdcApAdjustments”.
4.2.2.24.2.2.3 4.2.2.2 Target name space definition
The target name space equals "http://schemas.iso.org/AdcsML/Messages/" followed by the message
name and message version, like "http://schemas.iso.org/AdcsML/Messages/AdcApAdjustments-v1".
4.2.2.34.2.2.4 4.2.2.3 XML tags
Table-line-tag, group-tag and data-element-tag are XML tags which are defined in the related XML
schema.
XML tags are in the first step derived from the full data element names, and in the second step shortened
in a consistent manner, according to an abbreviation list (see Annex A).
Because auditors and auditees usually exchange bulk files according to ADCS, abbreviated tags can reduce
the file sizes by 30% - % to 40%. %.
Full data element names and abbreviated XML tags are together specified in ADCS to XML mapping tables
(see explanation and example of mapping tables in Subclause 4.5).
In XML schemas the full data element names are documented as annotations.
This means that programmers can have easy access to the full data element names, either from the
mapping tables or from the XML schemas.
4.2.2.44.2.2.5 4.2.2.4 Optional fields
Optional fields and optional groups of fields can be omitted from the XML data file, only if these data fields
are not available in the source system that delivers the audit data.
4.2.2.54.2.2.6 4.2.2.5 Repeating groups
Repeating groups like “Tax” can occur up to the maximum number that is defined in the XML schema.
4.2.2.64.2.2.7 4.2.2.6 Special characters to be escaped
The following special characters shall be escaped in XML data files as follows:
< (less than) to be replaced with <
> (greater than) to be replaced with >
& (ampersand) to be replaced with &
‘ (apostrophe) to be replaced with '
“ (quotation mark) to be replaced with "
4.2.3 XML schema
4.2.3.1 4.2.3.1 General
Each ADCS file is technically specified by an XML schema and can also be validated by using that schema.
© ISO 2022 – All rights reserved © ISO 2022 – All rights 5
reserved

---------------------- Page: 10 ----------------------
ISO/TS 21377:2022(E)
XML schema files shall be created in accordance with the syntax specifications written in W3C Extensible
Markup Language (XML) 1.0 (Fifth Edition), W3C XML Schema Part 1: Structures Second Edition, W3C
XML Schema Definition Language (XSD) 1.1 Part 2: Datatypes and also in accordance with the functional
requirements written in ISO 21378.
Table 1 shows ISO 21378:2019 representation formats and the equivalents used in XML schema.
Table 1 — Representation specification in XML schema
ISO 21378:2019 representation XML schema representation

%ns


%nc



%m.nf




%nd

Table 2 shows ISO 21378:2019 datatypes and the equivalents used in XML schema.
Table 2 — Datatypes in XML schema
ISO 21378:2019 datatype XML schema datatype
Date
Time
String
Decimal
Integer
Boolean
All schema files are bundled in one official ISO delivery package. Another development package is also
available.
a) Official ISO delivery package: This package contains the schemas established asin this document and
ISO 21378 for exchanging the audit data.
© ISO 2022 – All rights reserved
6 © ISO 2022 – All rights reserved

---------------------- Page: 11 ----------------------
ISO/TS 21377:2022(E)
b) Development package: This package contains the schemas that are used to develop new versions of
the existing schemas and for the development of extensions.
The electronic version of these XML schemas can be downloaded from the URL which can be found in
Annex E.
4.2.3.2 4.2.3.2 Official ISO delivery package
All schema files in this package have one and the same version number, which can be found in the schema
file itself.
The first delivery of the package has version number 1. After a certain period, if there are sufficient
reasons for this, a new package of schemas will be delivered with a successor version number, for
example, version number 2.
This package contains:
a) All ADCS table schemas. The name of the xml schema file equals “Adc” followed by the ADCS table
name and then followed by “.xsd”, such as "AdcApAdjustments.xsd".
b) One data types schema named “Adc_DataTypes.xsd”. This schema is imported into all ADCS table
schemas.
A list of these XML schemas can be found in Annex B.
Example: EXAMPLE 1 Part of “AdcApAdjustments.xsd”:






xmlns:str="http://schemas.iso.org/AdcsML/Messages/AdcApAdjustments-v1"
        xmlns:cdt="http://schemas.iso.org/AdcsML/Adc_DataTypes-
v1"
        xmlns:xsd="http://www.w3.org/2001/XMLSchema"

targetNamespace="http://schemas.iso.org/AdcsML/Messages/AdcApAdjustments-
v1"
        elementFormDefault="qualified"
attributeFormDefault="unqualified" version="1.0">

  schemaLocation="Adc_DataTypes.xsd"/>
 
  
    MESSAGE
  
© ISO 2022 – All rights reserved © ISO 2022 – All rights 7
reserved

---------------------- Page: 12 ----------------------
ISO/TS 21377:2022(E)
  
    
     
       
        AP ADJUSTMENT
       
       
        

          minOccurs="1" maxOccurs="1">
           
             Adjustment
ID
           
         

          minOccurs="0" maxOccurs="1">
           
             Adjustment
Number
           
         

        
       
     
    
  
 

Example:
EXAMPLE 2 Part of Adc_DataTypes.xsd:






      xmlns:xsd="http://www.w3.org/2001/XMLSchema"
      targetNamespace="http://schemas.iso.org/AdcsML/Adc_DataTypes-
v1"
© ISO 2022 – All rights reserved
8 © ISO 2022 – All rights reserved

---------------------- Page: 13 ----------------------
ISO/TS 21377:2022(E)

elementFormDefault="qualified"attributeFormDefault="unqualified"
version="1.0">



 
   
   




 
     
    
 




4.2.3.44.2.3.3 4.2.3.3 Development package
This package contains the schemas that are used to develop new versions of the existing schemas and for
the development of extensions.
In this package each schema has its own version number, which is included in the version attribute and
which is added to the name of the XML schema file. In the first delivery of this package, all schemas have
version 1.0 like “AdcApAdjustments-v1.0.xsd”. When a schema changes, the minor version number is
incremented each time (e.g.,. version number changes from 1.0 to 1.1).
In this package, all schemas contain their own data type definitions, so that they can be further developed
independently and there is no common data type schema.
After a certain period of time, if there are sufficient reasons to do this, a new official ISO delivery package
will be delivered with the next successor major version number, for example, version number 2 (see
Subclause 4.2.3.2),); and the new common data type schema (Adc_DataTypes.xsd) will be delivered.
Also a new development package will be delivered, in which all schemas will have version 2.0.
Example: EXAMPLE Part of “AdcApAdjustments-v1.1.xsd”:






xmlns:str="http://schemas.iso.org/AdcsML/Messages/AdcApAdjustments-v1"
© ISO 2022 – All rights reserved © ISO 2022 – All rights 9
reserved

---------------------- Page: 14 ----------------------
ISO/TS 21377:2022(E)
      xmlns:xsd="http://www.w3.org/2001/XMLSchema"

targetNamespace="http://schemas.iso.org/AdcsML/Messages/AdcApAdjustments-
v1"

elementFormDefault="qualified"attributeFormDefault="unqualified"
version="1.1">

 
  
   MESSAGE
  
  
   

...

TECHNICAL ISO/TS
SPECIFICATION 21377
First edition
Exchange formats for the audit data
collection standard: XML and JSON
PROOF/ÉPREUVE
Reference number
ISO/TS 21377:2022(E)
© ISO 2022

---------------------- Page: 1 ----------------------
ISO/TS 21377:2022(E)
COPYRIGHT PROTECTED DOCUMENT
© ISO 2022
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Email: copyright@iso.org
Website: www.iso.org
Published in Switzerland
ii
PROOF/ÉPREUVE © ISO 2022 – All rights reserved

---------------------- Page: 2 ----------------------
ISO/TS 21377:2022(E)
Contents Page
Foreword .iv
Introduction .v
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Exchange formats . 3
4.1 General . 3
4.2 XML . 3
4.2.1 General . 3
4.2.2 Technical requirements . 3
4.2.3 XML schema . 5
4.2.4 XML sample . 8
4.3 JSON . 9
4.3.1 General . 9
4.3.2 Technical requirements . 10
4.3.3 JSON schema . 11
4.3.4 JSON sample . 15
4.4 CSV . 16
4.4.1 General . 16
4.4.2 Technical requirements . 16
4.4.3 CSV sample. 17
4.5 Mapping ADCS tables to XML and JSON . 17
4.5.1 General . 17
4.5.2 Mapping table sample . 18
4.6 Cross topics . 19
4.6.1 General . 19
4.6.2 Character encoding conventions . 19
4.6.3 Versioning . 19
4.6.4 Multi-platform and multi-system data transfer . 19
4.6.5 Conventions of folder naming and file naming . 20
4.6.6 File compression . 21
4.6.7 Representation of special field types . 21
4.6.8 Extension methodology and rules . 21
4.6.9 Encryption of sensible data . 22
Annex A (informative) XML tags abbreviation list .23
Annex B (informative) List of XML schemas .27
Annex C (informative) List of JSON schemas .30
Annex D (informative) Data model .33
Annex E (informative) XML and JSON schemas.42
Bibliography .43
iii
© ISO 2022 – All rights reserved PROOF/ÉPREUVE

---------------------- Page: 3 ----------------------
ISO/TS 21377:2022(E)
Foreword
ISO (the International Organization for Standardization) is a worldwide federation of national standards
bodies (ISO member bodies). The work of preparing International Standards is normally carried out
through ISO technical committees. Each member body interested in a subject for which a technical
committee has been established has the right to be represented on that committee. International
organizations, governmental and non-governmental, in liaison with ISO, also take part in the work.
ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of
electrotechnical standardization.
The procedures used to develop this document and those intended for its further maintenance are
described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the
different types of ISO documents should be noted. This document was drafted in accordance with the
editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives).
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. ISO shall not be held responsible for identifying any or all such patent rights. Details of
any patent rights identified during the development of the document will be in the Introduction and/or
on the ISO list of patent declarations received (see www.iso.org/patents).
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and
expressions related to conformity assessment, as well as information about ISO's adherence to
the World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT), see
www.iso.org/iso/foreword.html.
This document was prepared by Technical Committee ISO/TC 295, Audit data services.
Any feedback or questions on this document should be directed to the user’s national standards body. A
complete listing of these bodies can be found at www.iso.org/members.html.
iv
PROOF/ÉPREUVE © ISO 2022 – All rights reserved

---------------------- Page: 4 ----------------------
ISO/TS 21377:2022(E)
Introduction
Accounting and enterprise resource planning (ERP) software packages are widely used in businesses
and by various government organizations to manage and track business processes, post transactions
and produce financial reports. Because of the nature of the information contained within the ERP
systems, the data are also leveraged by internal and external auditors to assess the business controls,
processes and financial reporting. There are numerous ERP packages that are used by businesses and
government organizations, which can vary greatly in design (e.g. interfaces, data content, data formats,
operational reports, management reports, financial reports). These and other design differences
present challenges in the collection of data for auditing supervision management purposes.
This document concerns the specification of technical exchange formats as output file formats for the
functional content defined in ISO 21378.
v
© ISO 2022 – All rights reserved PROOF/ÉPREUVE

---------------------- Page: 5 ----------------------
TECHNICAL SPECIFICATION ISO/TS 21377:2022(E)
Exchange formats for the audit data collection standard:
XML and JSON
1 Scope
ISO 21378, the audit data collection standard (ADCS), defines the functional requirements for
exchanging audit data in flat file format. This document concerns the specification of technical exchange
formats in extensible markup language (XML), JavaScript object notation (JSON) and comma-separated
values (CSV) as output file formats for the functional content defined in ISO 21378.
This document also contains the following schemas and sample files for tables in ISO 21378.
— XML schema;
— XML sample file;
— JSON schema;
— JSON sample file.
To keep the three exchange formats (XML, JSON and CSV) consistent, this document also specifies how
to use the technical solution in the CSV format.
2 Normative references
The following documents are referred to in the text in such a way that some or all of their content
constitutes requirements of this document. For dated references, only the edition cited applies. For
undated references, the latest edition of the referenced document (including any amendments) applies.
ISO 21378:2019, Audit data collection
ISO 8601-1, Date and time — Representations for information interchange — Part 1: Basic rules
ISO/IEC 21778, Information technology — The JSON data interchange syntax
W3C Extensible Markup Language (XML) 1.0 (Fifth Edition). Available at https:// www .w3 .org/ TR/ 2008/
REC -xml -20081126/
W3C XML Schema Part 1: Structures Second Edition. Available at https:// www .w3 .org/ TR/ 2004/ REC
-xmlschema -1 -20041028/
W3C XML Schema Definition Language (XSD) 1.1 Part 2: Datatypes. Available at https:// www .w3 .org/
TR/ 2012/ REC -xmlschema11 -2 -20120405/
JSON Schema: A Media Type for Describing JSON Documents. Available at https:// json -schema .org/ draft/
2020 -12/ json -schema -core .html
3 Terms and definitions
For the purposes of this document, the following terms and definitions apply.
ISO and IEC maintain terminology databases for use in standardization at the following addresses:
— ISO Online browsing platform: available at https:// www .iso .org/ obp
— IEC Electropedia: available at https:// www .electropedia .org/
1
© ISO 2022 – All rights reserved PROOF/ÉPREUVE

---------------------- Page: 6 ----------------------
ISO/TS 21377:2022(E)
3.1
data
reinterpretable representation of information in a formalized manner suitable for communication,
interpretation or processing
[SOURCE: ISO/IEC 11179-1:2015, 3.2.6, modified — Notes to entry have been deleted.]
3.2
data element
basic unit of identifiable and definable data (3.1)
[SOURCE: ISO 2146:2010, 3.4, modified — The admitted term "element" has been deleted.]
3.3
data file
collection of data (3.1) records having a homogeneous structure
[SOURCE: ISO 21378:2019, 3.4]
3.4
data structure
framework comprising a number of data elements (3.2) in a prescribed form
[SOURCE: ISO 21007-1:2005, 2.16, modified — The word "element" has been deleted from the term.]
3.5
syntax
set of rules, principles and processes that govern the data structure (3.4)
3.6
data model
graphical and/or lexical representation of data (3.1), specifying their properties, structure, and inter-
relationships
[SOURCE: ISO/IEC 11179-1:2015, 3.2.7]
3.7
entity
group of data elements (3.2) describing an object
Note 1 to entry: It is equivalent to “object class” in ISO/IEC 11179-1.
3.8
relation
relationship between two entities (3.7)
3.9
attribute
data element (3.2) describing an object
Note 1 to entry: It is equivalent to “property” in ISO/IEC 11179-1.
3.10
domain
set of properties to define the value space of attributes (3.9)
Note 1 to entry: A domain contains code lists (3.11) and code values (3.12). It is equivalent to “representation” in
ISO/IEC 11179-1.
3.11
code list
standardized list of code values (3.12) with a common scope
2
PROOF/ÉPREUVE © ISO 2022 – All rights reserved

---------------------- Page: 7 ----------------------
ISO/TS 21377:2022(E)
3.12
code value
one value from a code list (3.11)
4 Exchange formats
4.1 General
The data format is the carrier of data exchange between auditor and auditee. So, it is necessary to make
an agreement on data format between the two sides in data exchange. There are multiple options for
output data formats.
In the case of ADCS, three exchange formats are specified:
— XML data files defined by XML schema specification (W3C);
— JSON data files defined by JSON schema specification (json-schema.org);
— CSV data files.
These three formats shall contain the same functional ADCS content specification in accordance with
ISO 21378 but differ on the technical level only.
This means that these exchange formats are convertible from one to the other. For instance, it is possible
to convert XML data files to CSV data files or CSV data files to JSON data files.
To generate the XML and JSON schemas in a consistent way, a data model is set up from ISO 21378
according to ISO/IEC 11179-1. This data model is used to create consistent exchange format
specifications.
Each ADCS table is modelled into a “Parent Entity” and reusable data groups within a table are modelled
into “Child Entities”, for example, “Physical Address”, “Billing Address”, “Tax”, “Created”, “Modified”,
“Posted”, completely in line with ISO 21378. This way guarantees that all reusable groups that occur in
multiple tables are defined in the same way.
As the data model is not in scope of this document, it is only documented for reference purposes in
Annex D.
The various technical specifications are explained in this document; and the additional packaging and
communication agreements are defined.
4.2 XML
4.2.1 General
This subclause describes how to exchange the ADCS tables using XML data files.
XML data files shall be created in accordance with the syntax specifications written in W3C Extensible
Markup Language (XML) 1.0 (Fifth Edition) and also in accordance with the functional requirements
written in ISO 21378.
4.2.2 Technical requirements
4.2.2.1 General
Only one ADCS table, with a number of lines, shall be sent in one XML data file.
The filename shall comply with the rules described in 4.6.5.
3
© ISO 2022 – All rights reserved PROOF/ÉPREUVE

---------------------- Page: 8 ----------------------
ISO/TS 21377:2022(E)
Each ADCS table has its own XML schema to define its XML file. When there are 71 tables, there are 71
XML schemas.
Such an XML data file contains (schematic):

  xsi:schemaLocation='name-space xml-schema-name.xsd'
  xmlns='name-space'
  xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'>
  
    value
    
      value
    
  


Italicized text shall be replaced by the definitions in this document.
4.2.2.2 Root tag
The root tag equals "Adc" followed by the ADCS table name like: “AdcApAdjustments”.
4.2.2.3 Target name space definition
The target name space equals "http:// schemas .iso .org/ AdcsML/ Messages/ " followed by the message
name and message version, like "http:// schemas .iso .org/ AdcsML/ Messages/ AdcApAdjustments -v1".
4.2.2.4 XML tags
Table-line-tag, group-tag and data-element-tag are XML tags which are defined in the related XML
schema.
XML tags are in the first step derived from the full data element names, and in the second step shortened
in a consistent manner, according to an abbreviation list (see Annex A).
Because auditors and auditees usually exchange bulk files according to ADCS, abbreviated tags can
reduce the file sizes by 30 % to 40 %.
Full data element names and abbreviated XML tags are together specified in ADCS to XML mapping
tables (see explanation and example of mapping tables in 4.5).
In XML schemas the full data element names are documented as annotations.
This means that programmers can have easy access to the full data element names, either from the
mapping tables or from the XML schemas.
4.2.2.5 Optional fields
Optional fields and optional groups of fields can be omitted from the XML data file, only if these data
fields are not available in the source system that delivers the audit data.
4.2.2.6 Repeating groups
Repeating groups like “Tax” can occur up to the maximum number that is defined in the XML schema.
4.2.2.7 Special characters to be escaped
The following special characters shall be escaped in XML data files as follows:
< (less than) to be replaced with <
4
PROOF/ÉPREUVE © ISO 2022 – All rights reserved

---------------------- Page: 9 ----------------------
ISO/TS 21377:2022(E)
> (greater than) to be replaced with >
& (ampersand) to be replaced with &
‘ (apostrophe) to be replaced with '
“ (quotation mark) to be replaced with "
4.2.3 XML schema
4.2.3.1 General
Each ADCS file is technically specified by an XML schema and can also be validated by using that schema.
XML schema files shall be created in accordance with the syntax specifications written in W3C
Extensible Markup Language (XML) 1.0 (Fifth Edition), W3C XML Schema Part 1: Structures Second
Edition, W3C XML Schema Definition Language (XSD) 1.1 Part 2: Datatypes and also in accordance with
the functional requirements written in ISO 21378.
Table 1 shows ISO 21378 representation formats and the equivalents used in XML schema.
Table 1 — Representation specification in XML schema
ISO 21378 representation XML schema representation

%ns



%nc



%m.nf



%nd


Table 2 shows ISO 21378 datatypes and the equivalents used in XML schema.
Table 2 — Datatypes in XML schema
ISO 21378 datatype XML schema datatype
Date

Time

String

Decimal

Integer
Boolean
5
© ISO 2022 – All rights reserved PROOF/ÉPREUVE

---------------------- Page: 10 ----------------------
ISO/TS 21377:2022(E)
All schema files are bundled in one official ISO delivery package. Another development package is also
available.
a) Official ISO delivery package: This package contains the schemas established in this document and
ISO 21378 for exchanging the audit data.
b) Development package: This package contains the schemas that are used to develop new versions of
the existing schemas and for the development of extensions.
The electronic version of these XML schemas can be downloaded from the URL which can be found in
Annex E.
4.2.3.2 Official ISO delivery package
All schema files in this package have one and the same version number, which can be found in the
schema file itself.
The first delivery of the package has version number 1. After a certain period, if there are sufficient
reasons for this, a new package of schemas will be delivered with a successor version number, for
example, version number 2.
This package contains:
a) All ADCS table schemas. The name of the xml schema file equals “Adc” followed by the ADCS table
name and then followed by “.xsd”, such as "AdcApAdjustments.xsd".
b) One data types schema named “Adc_DataTypes.xsd”. This schema is imported into all ADCS table
schemas.
A list of these XML schemas can be found in Annex B.
EXAMPLE 1 Part of “AdcApAdjustments.xsd”:






        xmlns:cdt="http://schemas.iso.org/AdcsML/Adc_DataTypes-v1"
        xmlns:xsd="http://www.w3.org/2001/XMLSchema"
        targetNamespace="http://schemas.iso.org/AdcsML/Messages/
AdcApAdjustments-v1"
        elementFormDefault="qualified" attributeFormDefault="unqualified"
version="1.0">

  schemaLocation="Adc_DataTypes.xsd"/>
 
  
    MESSAGE
  
  
    
     
       
        AP ADJUSTMENT
       
       
        

          maxOccurs="1">
           
             Adjustment ID
           
6
PROOF/ÉPREUVE © ISO 2022 – All rights reserved

---------------------- Page: 11 ----------------------
ISO/TS 21377:2022(E)
         

          maxOccurs="1">
           
             Adjustment Number
           
         

        
       
     
    
  
 


EXAMPLE 2 Part of Adc_DataTypes.xsd:






      xmlns:xsd="http://www.w3.org/2001/XMLSchema"
      targetNamespace="http://schemas.iso.org/AdcsML/Adc_DataTypes-v1"
      elementFormDefault="qualified"attributeFormDefault="unqualified"
version="1.0">



 
   
   




 
     
    
 



4.2.3.3 Development package
This package contains the schemas that are used to develop new versions of the existing schemas and
for the development of extensions.
In this package each schema has its own version number, which is included in the version attribute and
which is added to the name of the XML schema file. In the first delivery of this package, all schemas have
version 1.0 like “AdcApAdjustments-v1.0.xsd”. When a schema changes, the minor version number is
incremented each time (e.g. version number changes from 1.0 to 1.1).
In this package, all schemas contain their own data type definitions, so that they can be further
developed independently and there is no common data type schema.
After a certain period of time, if there are sufficient reasons to do this, a new official ISO delivery
package will be delivered with the next successor major version number, for example, version number 2
(see 4.2.3.2); and the new common data type schema (Adc_DataTypes.xsd) will be delivered.
Also a new development package will be delivered, in which all schemas will have version 2.0.
EXAMPLE Part of “AdcApAdjustments-v1.1.xsd”:
7
© ISO 2022 – All rights reserved PROOF/ÉPREUVE

---------------------- Page: 12 ----------------------
ISO/TS 21377:2022(E)






      xmlns:xsd="http://www.w3.org/2001/XMLSchema"
      targetNamespace="http://schemas.iso.org/AdcsML/Messages/AdcApAdjustments-v1"
      elementFormDefault="qualified"attributeFormDefault="unqualified"
version="1.1">

 
  
   MESSAGE
  
  
   
    
     
      AP ADJUSTMENT
     
     
       ...