We suggest a three-step approach to strengthening your tax risk management framework and ensuring it is fit for purpose.

Organisations should undertake an initial assessment of the current state of their tax governance position. To help you develop an initial assessment or benchmark we can use Tax Risk Cube (“The Tax Cube”), a risk assessment diagnostics tool. The Tax Cube is a comprehensive set of questions based on best practice in the area of tax risk management and is completed in a workshop with your tax / finance team and other key stakeholders.

The results of the workshop are summarised in a heat map which will then enable you to identify priorities for change and clear actions to take forward.

Risks identified during the Assess phase can be responded to by implementing a robust tax control framework or refining an existing framework where one already exists.

What is a Tax Control Framework?

A Tax Control Framework incorporates board level controls, the organisations risk appetite and approach to risk management, and embeds this in internal controls, policies and procedures so the organisations tax strategy can be implemented in practice.

The essential components of a Tax Control Framework should include:

• Defining tax risk – what are we trying to manage?
• Tax risk management processes – how do we go about managing risk?
• Tax risk appetite – what risks are we willing to take?
• Tax risk management segregation of duties – who is responsible for what?
• Tax risk governance – how do we oversee tax risk management?

There are several elements to consider when putting in place a robust tax control framework. These can be categorised under the five interrelated components of the Tax Risk Cube: Governance, People, Process, Data & Systems, and Technology. Tax controls should be applied comprehensively to cover all transactions that have an impact on all relevant tax positions.

Once in place, the tax frameworks and control documentation should take a top down approach, with the Board having overall responsibility for the tax strategy for the organisation.

Documentation should include:

• Tax strategy document set and owned by the Board covering areas such as the organisation’s tax risk tolerance and approach to relationships with tax authorities;
• Tax control framework to assist management with managing tax risks, including tax management plans and tax risk registers;
• Tax control processes for each specific tax type;
• Tax policies and procedures to provide guidance at a day to day operational level.

If risks in relation to specific tax types have been identified during the Assess phase, we can assist clients undertake more focused reviews on certain tax types. This will help close any gaps in the tax control framework, tax policies and procedures and ensure the risk is better managed going forward.

Given Inland Revenue’s increasing use of data analytics to identify risks, our reviews are more and more data analytics focused.

Even if risks regarding a specific tax type are not identified at the Assess phase, it is best practice to have rolling independent reviews of key tax risk areas for the business (for example, fixed assets, GST, customs, PAYE, FBT and other indirect taxes), including a review of the tax controls in those areas.

As with any process, tax governance is not a “set and forget” exercise but requires regular attention and testing to ensure it meets the organisation’s needs.

Ongoing monitoring and regular reporting to the Board and other stakeholders is essential to ensure that tax risks are continually monitored and reviewed. To facilitate this, the Tax Cube can be re-performed to see how an organisation is tracking against the original benchmark assessment.

Tax control testing is also a really vital part of the monitor phase to ensure that the tax controls are working as intended. The Inland Revenue also expect that tax controls and the tax control framework is tested independently every three years.

We can help to test tax controls in many ways including a walkthrough of tax compliance controls, testing the operational effectiveness of controls and assessing the design effectiveness of controls.

If you would like to discuss tax governance further or are interested in running a Tax Cube diagnostic workshop, then please get in touch. We can also help to test the design and operational effectiveness of tax controls for those companies that have put tax governance policies and controls in place.

We will be running a tax governance webinar for our clients on 20 October 2021. The webinar will provide an overview of what good tax governance means, what a tax control framework looks like, and the various phases involved in its maintenance. A representative from Inland Revenue will also be attending to share their views.