Indonesia tax, audit and information-systems advisory for cross-border groups.

Monthly tax compliance for a PT PMA includes withholding tax filings (PPh 21 for payroll, PPh 23 for domestic services, PPh 26 for cross-border payments, PPh 4(2) for final taxes), VAT returns (PPN), and PPh 25 corporate income tax installments — all filed through Indonesia's Coretax system. Each tax type carries its own filing deadline, typically the 10th or 15th of the following month for payment and the 20th for reporting. Post-2025, all filings transit through the Directorate General of Taxes (DJP) Coretax platform, replacing the legacy e-Filing and e-Billing systems. A PT PMA must also reconcile its withholding obligations against vendor contracts and employee payroll data monthly — not at year-end — because DJP cross-references reported data against third-party submissions in real time. Late filings attract administrative penalties under Article 7 of the General Tax Provisions Law (UU KUP), and persistent non-compliance triggers audit selection under DJP's risk-based profiling system.

A PT PMA (Perseroan Terbatas Penanaman Modal Asing) is an Indonesian limited liability company with foreign ownership. Unlike a local PT, a PT PMA requires minimum paid-up capital of IDR 10 billion, is subject to BKPM investment reporting (LKPM), and must comply with the Positive Investment List (DNI). The distinction affects capital requirements, permitted business activities (KBLI codes), licensing pathways (OSS-RBA), and ongoing compliance obligations. A PT PMA must file quarterly LKPM investment activity reports to BKPM — a requirement that does not apply to purely domestic PTs. Foreign ownership percentages are governed by the Positive Investment List under PP 10/2021 (as amended), which specifies sectors open to 100% foreign ownership, sectors with caps, and sectors reserved for domestic investors. PT PMAs also face stricter scrutiny on related-party transactions, thin capitalization (PMK-169/2015), and transfer pricing documentation (PMK-22/2020). The choice between PT PMA and alternative structures should be made with full visibility of the 3-year compliance cost, not just incorporation cost.

Under PMK-22/2020, Indonesian transfer pricing documentation (master file, local file, and CbCR) is mandatory for taxpayers with related-party transactions exceeding specified thresholds: gross revenue above IDR 50 billion, or related-party transactions above IDR 20 billion (tangible goods) or IDR 5 billion (services/other). The documentation must be prepared contemporaneously — meaning before the annual tax return filing deadline, not when DJP requests it during an audit. The master file covers the multinational group's global operations, value chain, and intercompany transaction framework. The local file details the Indonesian entity's specific related-party transactions, functional analysis, and benchmarking study with comparable companies. Country-by-Country Reporting (CbCR) under PMK-213/2016 applies when the group's consolidated revenue exceeds EUR 750 million. Even below the mandatory thresholds, DJP retains authority under Article 18(3) UU PPh to challenge any related-party pricing — making voluntary documentation a defensive investment for PT PMAs with material intercompany flows.

ITGC (IT General Controls) audits evaluate access management, change management, IT operations, and data backup/recovery across financial reporting systems. Indonesian companies need ITGC for group SOX compliance, external audit reliance, UU PDP data protection compliance, and OJK regulatory requirements for financial institutions. ITGCs are the foundational layer of IT controls that support the reliability of automated financial reporting controls. If ITGCs are weak — for example, if system administrators can modify financial data without approval workflows — then no application-level control can be trusted. For Indonesian PT PMAs that are subsidiaries of listed parent companies, ITGC audit results directly feed into the group's SOX 404 or equivalent internal control assessment. Under Indonesia's UU PDP (Personal Data Protection Law), companies processing personal data must implement technical safeguards including access controls, encryption, and breach notification procedures — all of which fall within ITGC scope. For companies regulated by OJK, POJK 38/2016 on IT Risk Management requires documented IT risk assessments and control testing.

Physical inventory verification should occur at fiscal year-end (mandatory for audited entities), during ERP migrations, after warehouse relocations, before insurance renewals, during M&A due diligence, and when book-to-physical variance exceeds 2% — the threshold at which external auditors typically flag material discrepancy. For Indonesian manufacturing and distribution companies, inventory often represents 30–60% of current assets — making verification accuracy a material financial reporting issue. PSAK 14 (Inventories) requires inventory to be carried at the lower of cost or net realizable value, which means physical verification includes assessing condition, identifying obsolete or slow-moving items, and validating the NRV write-down provision. The external auditor (KAP) is required to observe the physical count for material inventory balances; if the company cannot demonstrate a reliable count process, the auditor may issue a qualified opinion — which has downstream consequences for banking covenants and investor confidence. For multi-site operations (common in Indonesian manufacturing — Java, Sumatra, Kalimantan), simultaneous counts or statistical sampling approaches must be pre-agreed with the external auditor.