Gloal Tax Alert | 13 September 2017
UK Tax Authority reconsiders its approach to evaluating tax risk profile of large businesses
The UK HM Revenue & Customs (HMRC) has launched a consultation into its process of evaluating the tax risk profile of the UK’s largest businesses. This Alert examines the key issues that the consultation is attempting to address, whether the current process is fit for purpose and how HMRC could move to a truly ”risk-based” approach.
What is HMRC’s current process for evaluating the tax risk profile of large businesses?
The Business Risk Review (BRR) is the mechanism by which HMRC assesses the risk profile of the largest businesses in the UK, typically those with a turnover of £200m or more. Qualifying businesses are currently allocated either a low risk or non-low risk rating based on a holistic assessment of a number of inherent and behavioral risk factors which HMRC considers relevant to a business’ tax compliance risk profile. The risk rating that is awarded by HMRC drives the level of scrutiny that it applies, enabling HMRC to focus its resources on what are perceived to be the highest risk businesses, with the aim of more effectively closing the tax gap.
Under the current process, to be awarded a low risk status, a business must demonstrate that it maintains an open and transparent relationship with HMRC, is able to effectively manage tax compliance risk and only engages in tax planning which supports genuine commercial activity.
Why does it matter to businesses?
The risk status that is awarded from the BRR, is a key determinant of how HMRC interacts with large businesses, with lower risk businesses benefitting from fewer HMRC interactions, quicker responses to requests for clearances and more certainty on their tax liabilities.
What issues is the consultation attempting to address?
The consultation is wide ranging in its scope, considering the procedural elements of the BRR as well as asking wider questions on how else the behaviors of large business can be influenced.
In particular, the consultation considers the frequency of the BRR, the criteria which are used to assess inherent and behavioral risk factors (and their respective weightings), how the use of tax planning is assessed, the nature of the evidence that can be shared with HMRC as part of the review and the nature of the risk rating itself. On the latter there is particular emphasis on whether the ratings and the criteria which underpin the ratings provide sufficient direction to businesses on how they may go about moving to low risk.
More broadly, the consultation considers the need to evaluate the risk status of a business in a manner which is more closely aligned to the specific taxes that it pays and the consultation challenges whether the BRR should be more closely aligned with international guidance on tax control frameworks (TCFs), such as that produced by the Organisation for Economic Co-operation and Development (OECD). There is a recognition however that the existing process may already encapsulate much of this.
The consultation does challenge how the burden on low risk businesses could be reduced, and there is contemplation of the dropping of certain risk areas where it is deemed that there is negligible activity.
A core purpose of the BRR is to help to influence the behaviors of large business, and HMRC, through the consultation, is seeking views on what other opportunities are available to encourage lower risk behaviors (possibly outside of the BRR).
HMRC has also recognized that the use of auditable, objective criteria may introduce greater confidence in the process and its findings, although the consultation does not include a question which specifically addresses this point. This lack of emphasis is surprising given the increased use of technology by both tax authorities and tax functions, in particular the greater use of data analytics to identify tax risk.
Why is HMRC consulting on the BRR now?
HMRC accepts that there has been limited change to the BRR process in the last 10 years and businesses have been demanding greater clarity on certain aspects of it. HMRC also views this as another opportunity to enhance the shift in the compliance behaviors of large businesses.
The broader economic context should also not be ignored, and with the Government currently reaffirming that the UK will be ”open for business” post Brexit, there is a need to demonstrate that institutions such as HMRC are adopting a more measured approach to their policing of large business. Furthermore, continued resource constraints on government departments drives the need for HMRC to adopt a more focused and resource efficient approach to the BRR.
Is the current process fit for purpose?
The BRR, if effective, should yield benefits for both HMRC and business, allowing HMRC to focus its resource on the highest risk businesses and reducing the burden on low risk businesses through reduced challenge from HMRC. Is the current process however delivering these benefits? The jury is out.
Firstly, HMRC highlights that the assessment process is risk-based, however in practice, this is not always the case, with undue focus often attributed to easily identifiable but immaterial areas of risk. Furthermore, Customer Relationship Managers (CRMs) at HMRC who oversee the process, will typically maintain different perceptions of risk, possibly based on their previous experiences, and because of this, may inconsistently apply the framework of assessment. The consultation does not address concerns with the training of CRMs.
Secondly, HMRC continues to emphasize that maintaining a high level of inherent risk, evaluated with regards to scale, complexity and change, but low level of behavioral risk, assessed in terms of the robustness of processes, openness with HMRC and nature of tax planning, should yield a low risk status. In practice however, a number of businesses will still receive a ”non-low” risk rating despite being able to evidence what they consider to be a robust tax risk management and governance framework. The subjectivity of elements of the process can also cause confusion and frustration among businesses and it is encouraging that HMRC has made reference to the objectivity of the process in the consultation.
Thirdly, the way in which HMRC classifies businesses as low or non-low risk does not allow for much differentiation. The inherent and behavioral risk factors are scored with reference to whether they increase or decrease risk which provides little direction to businesses on how they should go about improving their risk status.
A more fundamental question is whether there is enough of an incentive for non-low risk businesses to change their behaviors in order to be classified as low risk. The extent to which the assumed benefits of becoming low risk transpires into the interactions between businesses and HMRC is unclear. Moreover, if a business has moved from being non-low risk to low risk then that should be actively rewarded, but the current process does not provide for such incentives.
But what of the framework of assessment itself? Beyond tax risk management, there are a number of different risk management standards. Examples of such frameworks include ISO31000 and the COSO ERM Standard. Each of these standards is subtly different in their suggested approach to identifying, analyzing, evaluating and treating risk and allow for flexibility in their application. Instead, HMRC’s BRR process involves a fairly rigid framework of assessment, setting out what HMRC considers to be best practice.
This lack of flexibility in the framework of assessment needs to be overcome as the risk architecture of businesses will differ, with varied levels of decentralization and formality. Listed businesses for example are typically required to adhere to a number of corporate governance or internal control standards, such as the UK’s Corporate Governance Code or the Sarbanes Oxley Act in the United States. These very formal risk management frameworks, when applied to tax risk, are more closely aligned to HMRC’s expectations of best practice. Is it however realistic to expect all businesses that are subject to the BRR to have to meet these standards?
The points raised above are only some of the concerns that have been identified with the current process.
How could HMRC move to a truly “risk-based” approach?
It is positive that HMRC is engaging on this topic and it appears that the wide scope of the consultation seeks to address the concerns that have been raised by businesses to date on the BRR. As explained above, the current process is not as effective as it could be and is not completely risk based. How could this be addressed?
- Should it be determined that a business presents a low level of inherent risk, a move to a more targeted approach to the behavioral risk assessment is advisable and would reduce the level of resource that both business and HMRC need to deploy in order to arrive at a risk rating.
- When evaluating the effectiveness of a business’s tax risk management, the starting point needs to be the business’s ability to deliver accurate and timely tax returns and the nature of the positions adopted within those returns. This can be easily quantified and forms an objective basis for the remainder of the review process.
- A greater emphasis on the taxes paid by the business under review and the relative materiality of those taxes would also enable greater focus. Businesses with effective tax risk management processes should be focusing on the most significant risks which impact their most material tax positions. HMRC’s approach to assessing a business’s tax risk profile should mirror that. The consultation considers the option to drop certain areas of risk as part of the assessment if they are deemed negligible.
As discussed above, the process should be less prescriptive, appreciating the differences in how organizations approach their risk management and instead focused on determining whether the formal or indeed informal controls in place do in fact control the relevant risks and behaviors to an acceptable level.
A natural consequence of adopting a more risk-based approach should be a reduced burden on businesses and HMRC alike. A reduction in the duplication of review will need to be a key consideration, as should the greater use of technology to identify potential risks. In evaluating a business’s tax risk management and governance, there should be greater reliance on the process by which the Senior Accounting Officer (SAO) obtains assurance that there are appropriate tax arrangements in place and the extent to which businesses have operationalized their published tax strategies. Effective compliance with these two requirements should go a long way to indicating where a business sits on the tax risk spectrum and would address HMRC’s interest in aligning the BRR more closely with the OECD’s Tax Control Framework (TCF) Guidance. Greater alignment to this guidance is encouraged as it would allow businesses to adopt a more consistent approach to their tax risk management cross-border.
There is a question as to whether all businesses would benefit from implementing all elements of the OECD’s TCF guidance or whether this should be focused on only certain businesses. More broadly, there are an increasingly wide range of obligations on business, with Country-by-Country Reporting (CbCR) and the corporate criminal offense for the failure to prevent the facilitation of tax evasion as recent examples. There is a need to consider how these requirements are to contribute to the BRR as part of a more unified risk assessment. Indeed, such a risk assessment may move to being multilateral in nature and the OECD’s new International Compliance Assurance Project (ICAP) pilot, in which a group of countries will multilaterally risk assess multinational groups primarily on the basis of their CBCR documentation, is indicative of this trend.
Whether the BRR process is improved will depend on the valuable contribution to this consultation from business. The deadline for representations is 6 December 2017 and as many qualifying businesses as possible should use this opportunity to express their views.
For additional information with respect to this Alert, please contact the following:
Ernst & Young LLP (United Kingdom), London
- Jim Wilson
+44 20 7951 5912
- Geoff Lloyd
+44 20 7951 8736
- John Georgiou
+44 20 7951 2831
Ernst & Young LLP, UK Tax Desk, New York
- James A. Taylor
+1 212 773 5256
EYG no. 05207-171Gbl