CEN/WS XBRL: Improving transparency in financial and business reporting

1
CEN/WS XBRL Improving transparency in financial
and business reporting

• CWA2 final deliveries

Emile Bartolé
CWA2
2
Objectives of CWA2

• Dual objective of CWA2 standardize
• The way of submitting instances, a container with
  standardized
• Encryption
• Digital signature
• Compression
• The way of transmitting the usual metadata that
  determine the context of an xbrl reporting
  instance
• the sender of the document
• contact details
• date and time of submission

CWA2
3
Exchange model
4
Submission container examples
5
Standards used Compression Hash
Zip as defined in http//www.pkware.com/documents
/casestudies/APPNOTE.TXT SHA256 as defined
in http//csrc.nist.gov/publications/fips/fips180
-4/fips-180-4.pdf
6
Standards used Digital signature
The file structure generated by the signature
SHALL be XAdES-BES/EPES http//uri.etsi.org/01903
/v1.4.1/ using RSA with SHA512 http//www.w3.org
/2001/04/xmldsig-morersa-sha512 implemented in
accordance with COMMISSION DECISION of 25
February 2011, establishing minimum requirements
for the cross-border processing of documents
signed electronically by competent authorities
under Directive 2006/123/EC of the European
Parliament and of the Council on services in the
internal market
7
Standards used Encryption
W3C Encryption http//www.w3.org/TR/xmlenc-core/
using key transport RSA-OAEP http//www.w3.org
/2001/04/xmlencrsa-oaep-mgf1p and encrypting
data with AES256. http//www.w3.org/2009/xmlenc11
aes256-gcm
8
Reserved names suffixes

• NAME header.xml
• exclusively reserved for headers in accordance
  with the present CWA
• SUFFIX .signed.xml
• exclusively reserved for signed files
• SUFFIX .encrypted.xml
• exclusively reserved for encrypted files
• SUFFIX .containerfeedback.xml
• exclusively reserved for files complying with the
  ContainerFeedback schema
• SUFFIX .instancefeedback.xml
• exclusively reserved for files complying with the
  InstanceFeedback schema.

9
File name change upon signature(equivalent for
encryption)
File to sign Name of the signed file Filename inside the XML signature file
Lol Lol.signed.xml Same as  File to sign 
Lol.pdf Lol.signed.xml Same as  File to sign 
Lol.zip Lol.signed.xml Same as  File to sign 
Lol.signed.xml Lol.signed.xml Same as  File to sign 
Lol.encrypted.xml Lol.signed.xml Same as  File to sign 
10
Container creation example
11
Container reception example
12
Extensible Header
See also Core Business Vocabulary as an XBRL
taxonomy at http//wikixbrl.info/index.php?titleE
uropean_Metadata_HeaderCore_Business_Vocabulary_X
BRL_taxonomy
13
BasicHeader
14
Standard vs customized Headers
Use-case Characteristics
StandardHeader BasicHeaderOnly This header imports the BasicHeader  as is , makes no extensions of it and does not import the RegisteredOrganizationVocabulary as it uses none of its fields. Namespace http//www.eurofiling.info/eu/fr/esrs/Header/BasicHeaderOnly XSD URL http//www.eurofiling.info/eu/fr/esrs/Header/BasicHeaderOnly.xsd XML sample instance URL http//www.eurofiling.info/eu/fr/esrs/Header/BasicHeaderOnly.xml
StandardHeader WithRegOrg This header structure reflects the survey made within the Eurofiling BestPractices efforts which had given the results documented in http//www.wikixbrl.info/index.php?titleBest_Practices_on_Common_European_Reporting_Structures All fields related to  Transport  issues have been removed as these are out of scope of this CWA. Namespace http//www.eurofiling.info/eu/fr/esrs/Header/StandardHeaderWithRegOrg XSD URL http//www.eurofiling.info/eu/fr/esrs/Header/StandardHeaderWithRegOrg.xsd XML sample instance URL http//www.eurofiling.info/eu/fr/esrs/Header/StandardHeaderWithRegOrg.xml
StandardHeader WithoutRegOrg This header is (with regards to its function and its content) equivalent to the previous StandardHeaderWithRegOrg, but it does not import RegOrg and creates the missing fields as equivalent simple XML fields Namespace http//www.eurofiling.info/eu/fr/esrs/Header/StandardHeaderWithoutRegOrg XSD URL http//www.eurofiling.info/eu/fr/esrs/Header/StandardHeaderWithoutRegOrg.xsd Sample instance URL http//www.eurofiling.info/eu/fr/esrs/Header/StandardHeaderWithoutRegOrg.xml
Fully customized Extend it according to your own needs !
15
Response containers
16
Feedback files

• Container feedback files - confirming (or not)
  the success of the reception of a submission
  container
• http//www.eurofiling.info/eu/fr/esrs/ContainerFe
  edback
• Instance feedback files - Result of the (XBRL-)
  validation of every submitted data file
• http//www.eurofiling.info/eu/fr/esrs/InstanceFee
  dback

17
Selected comments from consultation
Why not to use XBRL for header / containerfeedback / instancefeedback -integrating RegOrg is technically not possible -container supports multiple formats (e.g. XML, CSV etc.), not only XBRL instances -XML more appropriate to carry that type of information
Why not to restrict the CWA to only  stable, system-relevant  parts (envelope) and leave out unstable, business-related parts (header) The CWAs definition required  metadata  to be covered The chosen aproach (extensible header) should give enough flexibility to deal with unstable business-related parts
CWA2 specification unnecessarily restricts the algorithms used (to AES-256 in this case). Commonly available implementations support a much wider range of algorithms, and in principle, it should be up to the receiver to specify an acceptable set of algorithms. As the specification currently stands, it will need to be modified whenever AES-256 is no longer considered secure. The proposition to allow a choice of different algorithms was submitted to the coordination of this project as well as to the NEN. Both confirmed that in order to prevent confusion on how the standard is used, there shall be an exact requirement on how the standard is used the algorithms shall be determined in a clear, unique way. The algorithms were chosen to respect the state of the art security considerations. Should security issues occur, a follow-up CWA may be required.
The Registered Organization Vocabulary is very large, with no clear alignment with the metadata that receivers wish to collect. While its use is optional, it is doubtful that it's ever an appropriate choice. If this level of detail were required along with the main submission, XBRL would be a much more robust solution. With the mechanism of extensible headers, no one is forced to use registered organisation vocabulary. As it is an official standard supported by the European Union, we produced a header version enabling its use.
18
Thanks for your attention
emile.bartole_at_cssf.lu
Comments or questions?
Page 18
CWA2