What is a Tax Control Framework and why do I need one?

Is tax increasingly on your Board’s agenda? Are you under pressure to demonstrate a clear vision for your tax operations and managing tax risk? Stakeholders may also be demanding that you demonstrate assurance over your tax activities and efficiencies in terms of how tax operates across your business.

What is a Tax Control Framework?

A tax control framework is the structure that supports your tax risk management and underpins tax compliance. It includes the building blocks of how tax operates in the business; tax strategy, tax policy and roles and responsibilities relating to tax. 

You have to manage a number of interconnected moving parts in your tax risk management and governance; legal requirements, your relationship with HMRC, best practice and the demands of your stakeholders. Nonetheless, we believe effective tax risk management can be simple. 

A straightforward and holistic approach can demonstrably improve the effective identification, assessment and management of tax risk. Developing a strong tax control framework with good governance and risk management will create an environment of ‘no surprises’ in relation to how tax risk and compliance are managed globally. 

Why do you need a tax control framework? 

The days when tax was a back-office function that warranted little attention are long gone. Tax activity and taxpayer behaviours are very much under the magnifying glass, and it can be damaging for all those involved when tax goes wrong.

No business wants to be landed with the unexpected financial burden of correcting a tax issue. Equally the impact of tax mistakes or perceived unethical behaviours on all stakeholders can be significant: 

• a drop in investor confidence can lower share prices
• damaged relationships with tax authorities may result in greater compliance burdens
• businesses may experience problems with regulators or in maintaining government contracts 
• customers or clients could turn to competitors 

There are also a number of trends in the global tax environment that make a strong tax control framework an important tool:

• increasing pressure for global tax transparency through both legislation (CbC reporting, tax strategy requirements) and the rise of ESG agendas
• increased tax authority collaboration globally (Exchange of Information Agreements, ICAP international tax reviews) and in the UK with HMRC working in a more joined up way
• CCO legislation means businesses are being held responsible for the actions of associated persons, including supply chains
• Increasing media interest in tax-related stories
• COVID-19; increased remote working and changed businesses processes have contributed to increased fraud and evasion as well as forcing businesses to review their tax policies

The cost of non-compliance can very high and very public – ignoring tax risk is no longer an option. 

Tax risk biosphere 

Your tax risk biosphere is all those parts of your businesses where tax risk exists. Broadly, these fall into 4 areas.

1. Tax compliance & reporting
   Mistakes in your tax returns or paying your tax, risks inherent in responding to HMRC enquiries, and dealing with other compliance requirements such as SAO, and going forward Uncertain Tax Treatment disclosures.
    
2. Financial risks
   These risks include issues such as getting the tax figures for your accounts significantly wrong, as well as considering the tax implications of complex transactions or uncertainty over tax law interpretation.
    
3. Strategic risks
   These are the risks associated with tax planning, particularly implementation, risks inherent in mergers and acquisitions and other strategic transactions.
    
4. Operational risks.
   The commonly quoted statistic is that 80% of your tax risk will come from the routine, everyday operations of the wider business. The 80% number may not be completely accurate but essentially, this is where parts of the business are making decisions without any consideration or understanding of potential tax consequences. This might be the HR team implementing redundancy or relocation programmes, your sales team introducing a rewards scheme or employing someone in an overseas jurisdiction or your commercial setting up a significant promotions scheme. Other examples might be a major property acquisition or disposal or a business merger or share acquisition.

Managing your tax risk is all about not letting the business get into that position in the first place, but instead creating a culture of no surprises where risks are known, and there are no “unknown unknowns”.

How do you develop a robust Tax Risk Framework to manage these risks? 

Step 1: Conduct a Tax Risk Review 

The first step is to conduct a Tax Risk Review. This will help identify the strengths and weaknesses of your current tax risk management set up. Using established tools for identifying the tax risks relevant to your business helps to build a clear methodology for your tax risk framework which those in your business and HMRC will understand. An essential part of your tax risk review is to assess the current state of your tax operations – a maturity assessment to help identify key risk areas to focus upon to grow and build your tax control and tax risk management framework. The best methodologies identify risks in a way that allows you to track them, for example using a tax risk register and/or Enterprise Risk Management Software.    

Consider the following questions:

• How is tax risk currently identified, assessed and escalated?
• Is there an existing global tax risk register? How is this maintained?
• What concerns do your senior management have in terms of your main tax risk areas?
• What are your ‘known knowns’ and are there any ‘unknown unknowns‘?
• Are these risks consistent on a global basis? 
• Are there jurisdictions/business units where tax risk is concern because you have less confidence or visibility?
• Can jurisdictions/business units be placed into tiers based on their risk profiles?
• Are tax accountabilities and responsibilities clearly defined?

Step 2: Assess the risks identified and remediate any high risks 

You then need a process to assess the risks identified, qualitatively and quantitatively in terms of the potential impact on the business. This supports an agreed methodology for what to do about those risks. For some businesses, this means introducing a defined risk appetite model which has senior level approval and with risk thresholds matched to an action. This is also known as a take/treat/terminate approach.

Defining tax risk appetite is the most difficult of the four areas that large businesses are required to comment on as part of their tax strategy. Many businesses don’t have a defined model. They rely on risks being considered as they arise, which is fine as long as there is a robust process for making sure that those new risks do come to the attention of the right people at the right time.

High risks typically include:

• transfer pricing
• contractor status
• mobile employees
• commercial substance of corporate structure
• tax optimisation (R&D and tax depreciation)

Step 3:  Managing your tax risks

Managing your tax risks means having clearly defined accountabilities and responsibilities. You will need clear reporting lines to communicate risks in a timely manner both periodically and on an ad hoc basis as well as appropriate escalation procedures and embedded tax controls.

You should be aiming for a 3 line of defence – comprising your operational business teams, your group tax/compliance function and any independent reviewers, all working together to ensure risks are identified, assessed and managed.

It is important you consider the use of established, purpose-built tools as this will support your three lines of defence. It is fundamental to ensure you can evidence your tax risk control framework and how you are maintaining it. Established tools provide a clear methodology which makes it easy to communicate to and engage stakeholders around the business.

Using established tools can also support collaboration across functions by providing a shared framework. For example, the normal internal audit process may not drill down far enough to the tax risks.

For some businesses a robust Tax Risk Framework may even require the employment of a full time Tax Risk Manager. 

It is important to note that this is not necessarily about minimising risk - your business may be happy to carry a higher level of risk – but it is about having a system in place to make sure risks are known, evaluated, and responded to in line with your risk appetite. It is about doing your best to makes sure that there are surprises.

Next steps for managing your tax risks

Maybe you are a new Tax Director or CFO. Or simply, in this new working world, the time is right for you to refresh your tax operations. We are here to support you on your journey, be that assessing your current tax controls and risk framework or helping you take the first steps towards effective tax risk controls. 

Speak to our Tax Assurance and Risk Management team about establishing a culture of no surprises or request information about our Tax Control Framework Workshop.