Tax Services

HMRC’s approach to assessing tax governance and Senior Accounting Officer certification How HMRC is evaluating whether businesses manage tax riskeffectivelyOver recent months there have been significant developments in HMRC’s approach to governancereviews and Senior Accounting Officer (SAO) certification, following an initiative to provide trainingto Customer Relationship Managers (CRMs) by individuals who were trained in the Big 4 and havemanaged tax functions in industry. The aim is for CRMs to better assess tax governance in businessesand the work undertaken to support SAO certification.

We have recently met with the HMRC team responsible for the initiative, who provided feedbackfrom their sample review of tax governance within 50 large businesses. Some of the questions thatSAOs and heads of tax are likely to face from HMRC, and the issues to be explored by CRMs, areoutlined below.

► How did you determine who is the SAO?

HMRC is concerned that in a number of cases the person who has completed the certificate doesnot meet the statutory definition of a SAO, which is the person who ‘has overall responsibility forthe company’s financial accounting arrangements’. HMRC commented that it would seek tochallenge whether the requirements have been met if an appropriately senior person has notsigned the certificate. As part of the review HMRC will, in most cases, want to meet the SAO inperson to discuss how they approach tax governance in the business and the specific actionsthey took to assess the effectiveness of the company’s tax accounting arrangements prior tosigning the certificate.

► How do you verify that process and controls are followed as documented?

HMRC considers that it is not enough to document that a business has appropriate controls and processes, the SAO must additionally gain comfort that these are being followed. An example was provided of a business where individual business units report to the SAO how tax risks are managed in their divisions. The SAO then picks a sample of the divisions without notice and undertakes an audit in those areas to ensure that the reported controls are functioning as reported.

► How do you ensure that your people have the right skills?

HMRC recognises that a key element of managing tax risk is ensuring that the people responsible for tax within an organisation have the knowledge they need to properly carry out their role. CRMs will want to understand how businesses ensure that its people are appropriately trained and aware

Our teamWe have specialists around the UK who can assist businesses with their SAO and tax governance requirements. Please contact any of the following individuals if you wish to discuss any of these topics further.

Paul Dennis+ 44 121 535 2 611 pdennis@uk.ey.com

Andrew Hinsley+ 44 20 7951 1932 ahinsley@uk.ey.com

Geoff Lloyd+ 44 20 7951 8736 glloyd@uk.ey.com

Gabrielle McParlin + 44 161 333 2675 gmcparlin@uk.ey.com

James Egert (Tax Policy)+ 44 20 7951 0272 jegert@uk.ey.com

► Do you have a Tax Policy?

HMRC stated that organisations that are not able to shareor communicate their Tax Policy are likely to be rated‘non-low risk’ on the measure of governance. AlthoughHMRC have stated that it is not mandatory to have a formallydocumented Tax Policy, CRMs are expected to questionhow the organisation’s approach to tax governance iscommunicated throughout the business (not just the taxdepartment). Specifically, we are aware of CRMs asking howan organisation’s Tax Policy is shown within the wider or-ganisation. In our experience a formalised and Board ap-proved Tax Policy document that is then communicatedthroughout the business is becoming leading practice.

► What evidence did the SAO rely upon to support theconclusions in the certificate?

HMRC expects SAOs to be able to draw upon evidence toshow how they were able to reach the conclusions in theircertificate. Whilst the evidence is not prescribed by HMRC, itwas explained that if the business does not maintain a tax riskregister, the CRM would want to understand how the SAO isable to understand how risks are managed in the organisation.

HMRC was critical of businesses that had produceddocumentation to prepare for SAO certification in the earlyyears of the legislation, which had not subsequently beenrevisited/refreshed. HMRC’s view is that SAO certification isa real-time obligation and SAOs should be able to show howthey continually monitor the appropriateness of the tax ac-counting arrangements and have processes in place to identi-fy and manage any new tax risks.

A concern arising from HMRC’s reviews to date is that anumber of SAOs place too much reliance on the fact that theirbusiness falls within the Sarbanes Oxley (SOx) provisions,or has an internal audit function. HMRC’s view is that thesefactors are not in themselves sufficient to conclude that taxrisk is managed appropriately in a business, as typically SOxand internal audit functions will not consider tax processes or,if they do, have very different materiality thresholds.

However, it was recognised that tax process reviews can bebuilt into the internal audit checks and, where independent ofthe tax function, can help to provide assurance that controlsare being audited. In the absence of an internal audit functionwhich reviews the tax processes, HMRC explained that itexpects to see evidence of how the SAO has gained comfortthat the documented processes and controls are functioningas reported.

of the latest changes in legislation, case law and guidance.In many businesses there will be individuals with significantknowledge and responsibilities in the tax return processand CRMs will verify how the organisation manages the ‘keyman’ risk in this scenario, for example by checking whetherprocesses and controls are clearly documented.

Impact of the change in approachIt is clear that businesses which fall within SAO and have a CRMcan expect to see more scrutiny of their tax governance and thework undertaken to support the SAO certificate. HMRC expectsthat, going forward, its CRMs will deliver a more consistent androbust approach to the reviews it undertakes.

Businesses will be asked to evidence how they manage tax risk inthe organisation, for example through the Tax Policy and how ithas been communicated in the organisation, or through live riskregisters which at any point in time document the key risks facedby the business and how these are being managed. Where suchdocuments do not exist, CRMs will want to understand how thebusiness communicates the boundaries of acceptable practicesin respect of tax and ensures that tax risks are being identifiedand managed.

‘Tax governance’ is a key measure in evaluating whether a businessis ‘low risk’. If a business cannot provide evidence of strong taxgovernance, it is, therefore, unlikely that it will be granted ‘low risk’status. Where a business is ‘non-low risk’, it can expect to receivefurther HMRC scrutiny and audits across all taxes. HMRC hasalso confirmed that as a result of the closer scrutiny of the workunderpinning SAO certification it anticipates that more SAOs willreceive a £5,000 personal penalty for the failure to establish andmaintain appropriate tax accounting arrangements.

How EY can helpWe have significant experience of helping businesses tomanage tax risk, ranging from supporting the development oftax policies, helping to build a continuous SAO certificationprocess, support in risk assessment discussions with HMRC,and helping to successfully resolve tax disputes.

We have developed an approach to SAO which balancesthe needs of businesses with the requirements of HMRC,designed to help businesses evidence a strong tax governanceframework and meet the obligations of the legislation.

About EYEY is a global leader in assurance, tax, transaction and advisory services. The insights and quality services we deliver help build trust and confidence in the capital markets and in economies the world over. We develop outstanding leaders who team to deliver on our promises to all of our stakeholders. In so doing, we play a critical role in building a better working world for our people, for our clients and for our communities.

EY refers to the global organization, and may refer to one or more, of the member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients. For more information about our organization, please visit ey.com.

Ernst & Young LLPThe UK firm Ernst & Young LLP is a limited liability partnership registered in England and Wales with registered number OC300001 and is a member firm of Ernst & Young Global Limited.

Ernst & Young LLP, 1 More London Place, London, SE1 2AF.

© 2014 Ernst & Young LLP. Published in the UK. All Rights Reserved.

ED None

1488670.indd (UK) 09/14. Artwork by Creative Services Group Design.

In line with EY’s commitment to minimise its impact on the environment, this document has been printed on paper with a high recycled content.

Information in this publication is intended to provide only a general outline of the subjects covered. It should neither be regarded as comprehensive nor sufficient for making decisions, nor should it be used in place of professional advice. Ernst & Young LLP accepts no responsibility for any loss arising from any action taken or not taken by anyone using this material.

ey.com/uk

EY | Assurance | Tax | Transactions | Advisory