Top 100 tax governance framework

Tax governance guidance and findings

We outline best practices, self-assessment procedures and detailed examples to assist top 100 taxpayers to review their governance frameworks in the:

• Tax risk management and governance review guide
• GST Governance, Data Testing and Transaction Testing Guide.

We publish key findings from income tax and goods and services tax (GST) assurance reviews completed in the previous year, with observations on governance, in our annual Findings report – Top 100 income tax and GST assurance programs.

GST assurance program

When reviewing your tax control framework for GST purposes, we apply the GST Governance, Data Testing and Transaction Testing Guide (the Guide).

We consider the following 3 GST controls to be fundamental:

1. Periodic internal controls testing – board-level control 4(BLC4)
2. Data controls – managerial control 4 (MLC4)
3. Documented GST control framework – managerial control 6 (MLC6).

The design of these controls directly influences the likelihood that the right amount of GST is reported.

We will review these controls as well as the other 5 common controls, BLC1, BLC3, MLC1, MLC3 and MLC7, across both income tax and GST.

Board-level control (BLC) 4: Periodic testing

To attain a Stage 2 rating for this control, your periodic internal controls testing needs to be:

• documented
• approved
• independent.

For testing frequency and scope, we need a periodic (3-to-5-year) rotating testing plan. This should cover all the controls. These include any common controls with income tax (BLC3, MLC 1, 3, 4, 6, 7). These core requirements are consistent with our income tax approach.

In addition, you should give sufficient evidence about:

• who is conducting the testing (an independent reviewer and not the control owner)
• the testing methodology (refer to section 4.3.2 Core elements of the Guide for details).

We may assign a provisional Stage 2 rating for this control in limited circumstances.

To be eligible for a provisional Stage 2 rating, we need a written undertaking. This undertaking is that you will give us your finalised and approved testing plan after the completion of our GST assurance review.

Best practice periodic controls testing program

Our view of a best practice (optimal) periodic controls testing program is as follows.

MLC4 and MLC6

MLC 4 and MLC 6 should be tested regularly for GST, given:

• the importance of these controls for accurate GST reporting
• there are 12-monthly business activity statement (BAS) returns annually.

We state in the Guide that the test frequency is ideally annually, but this isn't a core requirement.

MLC 4 and MLC 6 are to be front-loaded in the testing plan (ideally within the first 2 years).

MLC7

MLC 7 is a common control, but likely to require some intensity of review for GST separately to income tax. This is because the procedures to explain significant differences between accounting figures and the BAS or income tax return are designed differently and operate separately.

Frequency

The frequency is to be determined by the independent reviewer, subject to the principles set out in the Guide.

After first testing

Once each control has been tested, the independent reviewer should consider the following in determining the timing of re-testing:

• the outcome of that testing including the extent of any remediation action required
• changes in business, reporting or accounting systems
• significant business acquisitions or disposals
• changes in your GST profile
• changes in design of governance controls or control owners.

It needs to be established that the framework is designed and operating effectively and tested successfully (that is, post the initial testing). After that, we would expect that all controls be retested within a rolling 3 to 5-year period. Best practice is every 3 years.

If the retesting period extends beyond 5 years up to a maximum of 7 years, you can engage with us to discuss.

We would also expect controls to be retested where there have been any material changes to the controls. Examples are:

• new enterprise resource planning systems
• new subsystems
• business structure changes.

Income tax assurance program

You can find practical guidance on how we review and rate income tax governance to assist large public and multinational businesses at Reviewing tax governance for large public and multinational businesses.

More information

For more information about the Top 100 justified trust assurance program, email Top100@ato.gov.au.