CH201620 - How to do a compliance check: using the internet for risk assessment and research: introduction

This guidance explains how you can use the internet to find information about businesses and individuals. Following this guidance carefully will make sure that you comply with the Civil Service Code.

Who will use this guidance?

  • Customer Compliance Group caseworkers – following receipt of a case selected for a compliance check because risks have been identified.
  • RIS Production and Case Delivery teams – when developing a case for a potential compliance check.
  • RIS Analysis teams – undertaking continuous assessment and case support activities.

This list is not exhaustive.

What type of research can be undertaken?

When HMRC officers conduct checks of open source internet information, including social networking sites such as Facebook, it is important that they comply with the law governing such activity. This includes the

  • European Convention of Human Rights (ECHR)
  • Human Rights Act (HRA)
  • Regulation of Investigatory Powers Act 2000 (RIPA), and
  • Home Office Covert Surveillance Code of Practice.

 All of the above underpin HMRC’s work in this area.

Internet research must only be used for the purpose of HMRC functions - including checking a customer’s tax position. You may only search the internet when it is reasonable and proportionate to do so, guidance at CH21360 refers.

Open source research

You can use the internet to find information about businesses and individuals. This is known as open source research and includes the

  • collection
  • evaluation and
  • analysis

 of material published on the internet.

Open source or internet research is a powerful risk assessment and compliance tool and you should consider using this tool when carrying out risking activity and compliance activity.

However, there are a number of things you should consider before carrying out any open source research, see CH201640 for further guidance on HMRC open source policy.

Social media

Social media is the name given to websites and applications that enable users to create and share content or to participate on social networking sites, for example Facebook, X (Twitter) and Instagram.

Many businesses set up social media accounts and you can access those accounts to obtain information about the business activities.

You can also use social media to gather information about assets and lifestyles of individuals when checking the tax position of an individual, see detailed guidance at CH201680.

When will I need to carry out internet research?

Risk analysts and intelligence will carry out internet research whenever the project document sets out that such research is reasonable and proportionate. The project document will indicate the type of search required. Searches could include business webpages, lifestyle checks, and company databases such as Bureau van Dijk, Dun and Bradstreet. Risk analysts will provide results of searches as part of the package delivered to compliance teams. Intelligence analysts will record results of searches undertaken as part of product delivery to Key Stakeholders and Project Sponsors.

However, internet research is not restricted to the initial risk assessment stage of compliance work. There will be several stages during a compliance check where it may be reasonable to carry out internet research.

You may want to carry out research

  • at the beginning of the compliance check - for example to see what on line trading is taking place
  • during the compliance check to verify information you have obtained
  • at the end of your compliance check to provide evidence to support a tax assessment.

As your work progresses you should always consider whether your research is reasonable and proportionate.