Why you should care

It became clear shortly after the Chancellor of the Exchequer finished speaking on Budget Day, that Her Majesty's Revenue and Customs (HMRC) was taking a leaf out of US President Theodore Roosevelt's book: speak softly and carry a big stick (a proverb quoted by Theodore Roosevelt as a brief statement of his approach to foreign policy).

A document released on their website carried the title: HMRC approach to compliance risk management for large business. Perhaps not the memorable ring of Roosevelt's quote, but the message was clear. Companies deemed low risk will be subjected to fewer HMRC interventions, reviews and penalties – the soft-spoken approach. But a customer deemed not to be managing tax compliance risks adequately will find HMRC intervening ‘quickly and intensively’ – the metaphorical big stick.

In this approach to tax risk management, HMRC is travelling down a similar path to one already trodden by many UK corporate tax directors. In Ernst & Young's 2006 global tax risk survey Tax Risk: External Change, Internal Challenge, 58% of UK respondents told us that they had in place a documented procedure for managing tax risk. However, the 42% who did not have a documented procedure constitute a large minority who could be managing tax risk more effectively.

Tax risk management is certainly moving up the corporate agenda: in the UK and globally, tax directors consider it to be the second most important measure of the tax function. There is a difference of opinion on what constitutes the leading measure. While UK tax directors consider it is effective tax rate planning, tax directors globally consider the most important measure to be ensuring tax accounts and disclosures in financial statements are correct. That global view may be largely ascribed to the way Sarbanes-Oxley has influenced the priorities of SEC registrants. The UK focus on effective tax rate planning has increased in importance over the last two years, which may be a reflection of the falling competitiveness of the UK corporate tax rate.

Tax risk management is clearly becoming a key role of tax functions, and tax risk is potentially much broader than uncertain tax positions and vulnerabilities in tax financial controls and reporting. We define 'tax risk' to include ‘any event, action, or inaction in tax strategy, operations, financial reporting, or compliance that either adversely affects the company's tax or business objectives, or results in an unanticipated or unacceptable level of monetary, financial statement or reputational exposure.’

It should also be recognised that tax risk lies throughout the business, not just within the central tax function. A potential high-risk factor for many businesses is the significant number of people outside the tax department who deal with tax. In the UK 34% of survey respondents had over 25 people with tax responsibilities outside the tax department. The taxes dealt with outside the central tax function are often those that tax directors are least likely to consider part of their own risk management responsibilities, for example customs duties and employment taxes. In the case of customs duties, and to some extent VAT, Ernst & Young research suggests that key risk areas may be unidentified.

Thus companies are increasingly recognising the need to review tax risk across the business, either in the light of HMRC's new approach, or as part of an enterprise-wide risk review.

Addressing tax risk

In addressing tax risk challenges, UK survey respondents said a key factor was insufficient resources: without more people, process and technology investment, tax departments are not able to respond effectively to tax risks, or to fulfil their value adding potential to the business.

Tax is an enterprise-wide risk, with interfaces at varying levels of responsibility and accountability, which is becoming more important under increased scrutiny from HMRC, and which the central function is feeling insufficiently resourced to address. World class companies have already recognised that internal audit and enterprise-wide risk functions are well placed, and have the skills, to meet the challenge of managing tax risk.

Tax departments need a sustainable risk management framework to guide them, otherwise the burdens of constantly changing compliance regimes and business environments, combined with a lack of resources, will leave them struggling to meet the demands upon them. This inevitably leads to the conclusion that tax functions are significant potential users of internal audit services.

Our survey showed that some companies have already raised the importance of internal controls and risk management in their tax departments, bringing their internal audit teams into the process. The UK is some way ahead of the rest of the world in involving internal audit in tax risk management, with 51% of respondents reporting that internal audit had carried out testing to meet or exceed specific regulatory requirements. Although there is still a substantial proportion (37%) of UK companies which do not involve internal audit in this work, 34% did intend to increase their involvement.

There are a number of reasons why a sizeable proportion of companies are still failing to maximise the involvement of internal audit in their tax risk management approach. Tax has traditionally been perceived as a relatively discrete function within the business, away from the scrutiny of internal audit. Furthermore, it is a highly technical area and one where many heads of internal audit have little direct experience. Allied to this is the fact that many tax functions have limited experience of risk assessment and controls reviews.

Emerging leading practice however shows tax specialists teaming with internal audit to ensure coverage of tax risk as part of their company's internal audit programme. A holistic approach to tax risk means applying the risk management and process improvement skills internal auditors can provide to the technical skills and creativity of the tax team. The seven per cent of UK respondents who reported that the internal audit department have instituted a regular programme of tax testing and review that goes beyond specific regulatory requirements are indeed trailblazers.

A combined internal audit and tax team is best placed to identify the nature and extent of tax risk faced by the business. Even if a tax risk assessment reveals a high degree of exposure, that awareness is preferable to not knowing what those tax risks are. In addition, assessing tax risks provides an opportunity to review the effectiveness and efficiency of the tax function and may reveal opportunities for process improvement. This can enable the tax function to improve both its reliability and its ability to react to opportunities.

The tax man offers an olive branch

Businesses can realise a multitude of internal benefits from managing tax risk, but HMRC's new approach now presents a clear external benefit: a robust approach to tax risk management should result in a reduced HMRC risk rating. It is quite clear in the Budget Day document referred to earlier that companies aiming to comply and seeking to achieve a low risk rating will be approached in a spirit of cooperation by HMRC. HMRC is currently seeking to understand its clients' tax risk management processes and is looking in particular for strong governance, with: ‘well defined accountabilities, roles and responsibilities that are understood throughout the business’.

Our experience of the emerging practice of HMRC risk ratings shows that where a business has strong governance, processes, systems and skills, a low risk rating is more likely to be awarded. Under the new HMRC approach, low risk companies should be reviewed by HMRC only every two to three years which will result in less disruption to the business and reduced compliance costs. For high risk companies however, there will be at least annual risk reviews and more targeting of HMRC audits on significant risk areas. At the extremes, as long as a business remains low risk, HMRC should not routinely challenge returns, whereas very high risk companies can expect detailed scrutiny, regular audits and more chance of penalties.

The HMRC document states that successful risk management will be based on strong corporate governance, clear tax strategy, robust systems and processes, adequate supervision and training, and effective management of inherent risks. These are all clearly areas of internal audit expertise, and teaming that expertise with tax skills will result in real value to the business.

Developing internal audit's involvement in tax risk management will develop the skills of both the tax specialist and internal audit, and bring a better understanding and improved control of tax risks.

Anita Paddock is a director, tax accounting and risk advisory services practice, and Chris Oates is a partner and leader of the tax risk management practice, Ernst & Young, www.ey.com