Show download pdf controls
  • Tax risk management and governance

    We consider the existence, design and operation of a tax control framework for income tax focusing on the 6 controls set out in the director's summary in the Tax Risk Management And Governance Review guide (the Guide).

    The Guide:

    • sets out principles for board-level and managerial-level responsibilities
    • provides examples of evidence that demonstrates the design and operational effectiveness of tax control frameworks
    • focuses on the processes and controls in place and may not necessarily reflect the tax risk appetite or capabilities and experience of the tax or finance team, or their advisers.

    Ratings

    We apply a consistent rating system when reviewing and assessing tax governance. To find out more, see our practical guidance about how we rate tax governance.

    Stage 3

    You provided evidence to demonstrate that a tax control framework exists, has been designed effectively and is operating effectively in practice.

    Stage 2

    You provided evidence to demonstrate that a tax control framework exists and has been designed effectively.

    Stage 1

    You provided evidence to demonstrate a tax control framework exists.

    Not evidenced or concerns

    You have not provided sufficient evidence to demonstrate a tax control framework exists or we have significant concerns with your tax risk management and governance.

    While there has been no significant change in the ratings for tax risk management and governance since the last Findings Report in March 2019, we are observing increased awareness of our expectations in this area.

    As part of new Top 1,000 combined assurance program, we will evaluate whether our recommendations have been implemented for practices of previously reviewed businesses.

    The reviews completed up to the end of January 2019 and tax risk management and governance June 2020 resulted in the following ratings:

    Tax Risk Management and Governance assurance ratings, January 2019

    Donut graph depicts the tax risk management and governance assurance ratings as at January 2019. 70% of taxpayers are in stage one, 24% stage two, 1% stage three, 5% red flag.

    Tax Risk Management and Governance assurance ratings, June 2020 Donut graph depicts the tax risk management and governance assurance ratings as at June 2020 67% of taxpayers are in stage one, 26% stage two, 2% stage three, 4% red flag and 1% unrated.

    Observations

    In our reviews we focus on the following controls set out in the Guide which are aligned with the following justified trust objectives:

    Stage 1 rating

    The most common rating continues to be Stage 1. This reflects that many large businesses are still in the process of documenting and formalising their tax control frameworks and/or lack objective evidence that their tax control framework is designed effectively.

    Some taxpayers have enterprise-wide policies and governance frameworks that may encompass the tax function rather than having a specific tax risk management and governance framework that is in accordance with the Guide. While such enterprise-wide policies/frameworks may demonstrate some level of tax control framework exists, they are often too general in nature and lack some of the specific features we require to evidence an effective tax control framework. We encourage taxpayers to put in place a tax risk management and governance framework that meets the recommendations in the Guide.

    While many taxpayers remain in the Stage 1 category, we are seeing more taxpayers at the upper end of this band. It is not uncommon for taxpayers to fail to obtain Stage 2 as their tax control framework did not include a requirement to undertake periodic testing of their tax controls. We encourage these taxpayers to start taking steps to move to Stage 2.

    Stage 2 rating

    A Stage 2 rating gives taxpayers, and us, confidence that the tax control framework is effective. For many taxpayers, a Stage 2 rating will be a satisfactory assurance rating. We continue to encourage taxpayers to improve their governance framework to achieve this level of assurance.

    To obtain a Stage 2 rating for tax governance, the tax control framework must be designed effectively. This requires clients to have addressed all relevant Justified Trust controls in their tax control framework including BLC 4 (periodic controls testing).

    We are seeing more taxpayers undertaking a gap analysis and presenting this to us during the review. Where the gap analysis highlights areas where changes are recommended, to obtain Stage 2 we need to see:

    • that these recommended changes have been implemented
    • a description of your compensating controls, or
    • documentation setting out why particular aspects of the Guide may not be applicable to your circumstances.

    We observe Top 1,000 clients failing to distinguish between:

    • having periodic control testing as part of their tax governance framework (which is needed to get to stage 2), and
    • actually undertaking testing of the controls (the results of which confirm that the controls are operating in practice for stage 3).

    To obtain stage 2, there must be a periodic control testing plan within the tax governance framework. While most clients in Top 1,000 now have a tax governance framework, many do not have a periodic control testing plan as part of their tax governance framework.

    Having someone (for example, an independent adviser) undertake testing of the controls as a 'one-off' for the purposes of an assurance review does not meet the requirements for a tax control framework to be designed effectively. This is a common scenario which results in many clients only obtaining a Stage 1 rating for tax governance.

    Where Top 1,000 clients can demonstrate that they have a definite plan endorsed by senior management to undertake periodic controls testing as part of their tax governance framework, the taxpayer can obtain a stage 2 rating.

    Finally, we note that in assessing BLC 4 for income tax we apply the same broad principles as set out at section 4.3 of our new GST Governance, Data Testing and Transaction Testing guide.

    Stage 3 rating

    To obtain a Stage 3 rating we look for evidence that the documented tax control framework is designed effectively and is operating effectively in practice. It continues to be the case that few taxpayers can provide evidence that they have independently tested the operation of the framework in practice.

    This stage requires evidence in the form of a report of findings by an independent party (such as an internal auditor) that have tested the operation of the framework in practice. The report of findings should conclude that the documented tax control framework is operating effectively. Where improvements or enhancements are recommended, we will seek to understand whether these have been (or will be) implemented.

    Some taxpayers with well documented tax control frameworks do not obtain a Stage 3 rating because evidence obtained during the review (e.g. substantial errors demonstrates that their framework is not operating effectively in practice.

    Red flag rating

    A red flag rating is only applied after careful consideration where we have significant concerns with the taxpayer’s tax control framework as evidenced by:

    • the high level of errors identified, and/or
    • fundamental concerns about the robustness of existing tax processes.

    At this stage of the program, there were still several taxpayers that were not able to demonstrate that a tax control framework exists. Nevertheless, this remains a small percentage of the overall Top 1,000 population.

    Not rated

    In rare instances, we may not provide an assurance rating for tax governance. This is generally where the taxpayer joins a new tax consolidated or MEC group and we provide an assurance rating for the tax control framework of the group that acquired the taxpayer under review.

      Last modified: 02 Oct 2020QC 63840