The Audit-Ready Ledger: Architecting a Cash Register to Survive a DGI Check in Cameroon

When an agent from the Direction Generale des Impots (DGI) walks into a shop in Douala or Yaounde, the question is rarely whether sales happened. It is whether the record of those sales can be trusted. A cash register that lets a cashier quietly delete a line, back-date a receipt, or reprint a total with a different figure is not a record at all. It is a suggestion. This article is about the opposite: architecting a point-of-sale ledger that is designed, from the first line of code, to survive a DGI inspection.

CEMAC POS is a live, offline-first, OHADA-compliant POS built for Cameroon and the wider CEMAC region by Opesware SARL. Everything below describes how it is actually built. To be precise about scope from the start: this is a locally tamper-evident, audit-ready ledger. It is not a live connection to DGI servers, and it does not claim government certification. What it does is make your own records defensible.

What a DGI inspector actually looks for

A tax control is a search for gaps and inconsistencies. An experienced inspector is not reading every receipt; they are looking for the seams where numbers could have been changed. In practice that means a small number of very specific questions:

• Are the fiscal document numbers sequential, with no gaps? A missing number 1044 between 1043 and 1045 suggests a suppressed sale.
• Can a total be changed after a receipt was issued? If yes, every total is suspect.
• How are refunds and cancellations recorded? Silent voids are the classic way to skim cash.
• Does the declared VAT at 19.25% reconcile with the sum of taxable lines in the register?
• Can the sales journal be reconciled against a proper SYSCOHADA trial balance?
• For mobile-money sales, is there a reference that ties the receipt to an actual MTN MoMo or Orange Money transfer?

Notice that none of these require an internet connection to a tax authority. They are all questions about the internal integrity of your own data. That is the whole game, and it is winnable by design.

A ledger that cannot be quietly rewritten

The foundation of CEMAC POS is an immutable, hash-chained sales ledger. Each finalized sale carries a cryptographic hash that incorporates the hash of the sale before it. The sales form a chain: alter any single transaction and its hash changes, which breaks the link to every sale that followed it. You cannot edit one receipt in the middle of the day without the whole chain after it failing verification. Tampering stops being a quiet edit and becomes a visible, provable break.

On top of the chain sit two more guarantees. First, every sale is assigned a sequential fiscal document number with no gaps, so the inspector's first question answers itself. Second, once a receipt is finalized and printed, its data row is locked and becomes read-only. There is no screen, and no permission level, that lets someone reopen a printed sale and change the figure. The immutability is structural, not a matter of policy that a busy manager might waive.

Returns without breaking the trail

Real shops have returns, price corrections, and mistakes. A naive system handles these by editing or deleting the original sale, which is exactly the behaviour that destroys an audit trail. CEMAC POS never does this. A return or adjustment goes through a separate CREDIT NOTE flow that references the original transaction and posts an offsetting entry. The original sale stays exactly as it was recorded; the correction is a new, linked, equally immutable document.

This is the same principle a SYSCOHADA accountant would insist on: you do not erase a mistaken entry, you post a contra entry. An inspector reviewing the ledger sees the full story, the original sale and the credit note that reversed it, rather than a suspicious hole where a transaction used to be.

VAT that posts to the right account

Cameroon applies VAT (TVA) at 19.25% on taxable goods, and prices in CEMAC POS are stored VAT-inclusive (TTC). But not everything is taxable, and mixing exempt items into the VAT base is a reliable way to fail a control. CEMAC POS uses VAT groups to distinguish taxable from exempt items at the product level, and each group posts to the correct SYSCOHADA account. When it is time to reconcile, the declared VAT is not a hand-typed figure; it is the sum of what the register actually recorded, line by line.

Mobile money: the reference is not optional

A large share of Cameroonian retail is settled over MTN MoMo and Orange Money. The audit weakness here is obvious: a payment marked "MoMo" with no reference is indistinguishable from cash that never entered the till. CEMAC POS closes that gap by making the transaction reference a required input before the receipt can print. The cashier cannot skip it, so every mobile-money sale carries a reference that ties the locked ledger entry to a real transfer.

[Sale confirmed] -> [Select payment: MTN MoMo / Orange Money] -> [Force input: transaction reference] -> [Locked audit-trail entry] -> [Bilingual receipt]

To be clear about the boundary: CEMAC POS captures and locks that reference into the audit trail. It does not perform a live verification against MTN or Orange operator APIs. The value is that the reference exists, is mandatory, and cannot be altered after the fact, so an inspector can cross-check it against the operator statement if they choose.

Who did what, and when

Integrity of data is only half the story; the other half is accountability. CEMAC POS uses per-user accounts with roles (owner, manager, cashier), so every sale is attributable to a named person. An audit log records sensitive actions, so if a credit note is issued at 21:40, there is a record of who issued it. Combined with the QR code that every document carries, which lets a receipt be verified after the fact, the shop can answer not just "what was sold" but "who recorded it and can this document be trusted".

From register to accounts

The final piece is that the register speaks the language of the accountant. CEMAC POS produces SYSCOHADA journal entries from the sales themselves, and rolls them up into a trial balance and an income statement. There is no manual re-keying between the till and the books, which is where discrepancies normally creep in. When the inspector asks to reconcile the sales journal against the accounts, the two already come from the same source.

The offline reality

Power and connectivity in Cameroon are not guaranteed, and a POS that only behaves correctly while online is not fit for the market. CEMAC POS is offline-first: sales are captured, numbered, hash-chained, and locked on the device even with no connection, then synced. The audit guarantees hold whether the shop in Bafoussam had internet that afternoon or not. Compliance does not depend on the network being up.