Building dimension III of your tax governance framework: tax risk and control framework

What’s the tax risk and control framework about?

Dimension III of your tax governance framework, your tax risk and control framework, is all about being aware of your tax risks and managing them effectively. It basically consists of four components: 

• Tax risk definition
• Tax risk appetite
• Tax risk management
• Tax risk reporting 

It’s important to stress at this point that the tax and risk control framework can’t exist in isolation. Given that tax risks may eventually manifest in different areas of your business, different stakeholders must be aware of them. This means it’s essential to start the conversation by answering the question of whether the company already has an Enterprise Risk Management (ERM) framework . If this is the case, your tax risk and control framework should naturally be aligned with this ERM framework. 

Tax risk definition

To put a tax risk and control framework in place, you first need to define and classify your tax risks. You might already have a general definition in your ERM framework. Whatever the case, at this point it’s helpful to ask a number of questions:

• How can your tax risks be classified? There’s a distinction between measurable and non-measurable tax risks, for example. Measurable tax risks are the risks that have a quantified direct impact on the company’s financials. Non-measurable risks, by contrast, impact the company’s results indirectly rather than directly. Non-measurable tax risks can often be considered to be reputational risks.  
• Until when is a tax risk to be considered as a tax risk? Until a definitive tax audit by the tax authorities, a final ruling by a tax court or simply effectively eliminating the risk?
• Do you only want to consider existing risks, or future risks as well and how are these defined?
• What are the factors driving tax risk? In other words, what circumstances lead to the materialisation of a tax risk? These might be internal, such as errors of judgment (for example an incorrect assessment of the current state), errors of implementation (the incorrect implementation of tax law) or a failure to monitor tax law, or external factors (for example changes in the interpretation presented by the tax authorities).

Tax risk appetite

Once you’ve put the parameters of the tax risk and control framework in place, you can move to the tax risk appetite. Broadly speaking this means your company’s approach to tax risks. Your tax risk appetite should therefore take account of the tax risk strategy, developed from your tax strategy, which sets out strategic plans for risks and their management. We already examined this in our blog post on tax strategy.

When defining your tax risk appetite, it’s also essential to determine your level of acceptance of tax risks and your basic approach to managing them. We often talk about the risk-averse (who are reluctant to accept any tax risks) on the one hand and the risk lovers (willing to accept higher levels of risk) on the other. And then there’s your approach to managing risk, which can range from proactive to more passive.

The more fully you understand your tax risks, the easier it is to manage them effectively. So it’s also important to determine a tax risk profile mapping your vulnerability to specific tax risks. By the nature of their operations, some companies might be more exposed to certain tax risks than others. Multinationals, for example, can often encounter permanent establishment risks.  

Tax risk management

The process of managing tax risk basically breaks down into five components: 

• Prevention. These are the actions you take to prevent tax risks from materialising in the first place.
• Identification. These are the actions and processes for effectively identifying tax risks
  
• Measurement. This involves analysing and quantifying risks to better understand the type of risk and its impact. 
• Mitigation or response. This stage is about how you choose to respond to tax risks: reducing or even eliminating them or choosing to accept and live with them. 
• Monitoring tax risks. Finally, it’s important to monitor changes in risks and their impact. 

Some people would question whether prevention is part of tax risk management, as when you prevent a tax risk, there is no risk and therefore nothing to be managed. As often stated, there is no one correct answer and any of the approach stated might be applied by you if aligned with the approach applied by your organisation. For each of those stages it’s important to set down roles, powers and responsibilities for the risk management process as well as the controls built into the process, the documentation of processes and the use of technology. 

Tax risk reporting

Last but not least is risk reporting. Basically, this involves deciding what and when should be reported, how it should be reported and to whom.

It is of the utmost importance to have an efficient tax risk reporting process in place in order to keep valid stakeholders informed on time. It this respect, a very supportive tool is the so-called Tax Decision Matrix assigning approval powers for risks with certain impact and probability thresholds. The Tax Decision Matrix must be aligned with wider ERM framework to avoid duplication or absence in reporting.

What are the challenges?

Establishing a tax risk and control framework along the lines described in this post may seem pretty straightforward. The real challenge is to raise awareness of tax risks within your organisation, among non-tax specialists as well. As we pointed out at the beginning of this post, a risk may appear in different areas of your business activities. This can be a problem, especially if the group tax function doesn’t have a full overview of the company’s operations. This means it’s extremely important to maintain communications between tax and the business and other functions so that tax is aware of operations and the business is aware of tax. Only by cooperating in this way can you effectively manage tax risk. This applies especially to prevention. 

What should you do now?

The most fruitful next step is probably to initiate a discussion around risk management in your company and find out whether there’s an established ERM framework in place. On this basis you can set about establishing your tax risk and control framework. Another important step is to make employees aware of tax and your tax risk and control framework. And naturally once your framework is in place, you have to run it efficiently.