ECSH32915 - How to address risk

Consider how you will address each risk on the Standard Information Package (SIP)] and any other risks identified following your initial review and initial contact.

Consider which risks must be resolved during a face to face visit or whether some risks can be resolved by a phone call.  Remember, you cannot change the type of intervention from face to face to desk-based unless agreed by operational G7 Compliance leads. Multiple visits may be needed in order to fully address all of the risks.

You will need to consider the following:

  • Is there conflicting information held in different places that needs addressing?
  • Can the risks be addressed by reviewing the risk assessment and discussing the business’s understanding of risks to their business?
  • Can the risks be addressed by transaction testing or reviewing the business’s systems? See ECSH33700.
  • Does the combination of business activities increase the risks?
  • Is the business still operating? This can be checked on Companies House.  See ECSH32734. 
  • Is the business still registered? This can be checked on ETMP (ECSH32731). You may also need to re-check RCM (ECSH32732) for any involvement by authorisations, for example if the business has been recently cancelled.
  • Is information on the business’ application form missing or inaccurate? Do you need to inform them they need to update their details? If so, see ECSH82800.
  • Consider if any of the information provided on its application is false and misleading? See ECSH47125.

Having considered these, you will then need to think about:

  • Who do you need to speak to?
  • what records might you need to see on the day of the visit to test policies, controls and procedures are working in practice?
  • How long is it going to take you?

Some risks might be able to be resolved by phone but generally, face to face visits are conducted due to HMRCs supervisory requirements to effectively monitor its supervised population, on a risk-based approach. This might change throughout the life of the case; what you thought was a quick phone call could turn into a full face to face depending on what you establish.

If time is unexpectedly limited, prioritise the checks which can only be carried out whilst on the business premises (for example, transaction testing) and what can be carried out during a subsequent desk-based intervention (DBI), be that a conversation conducted by telephone or further records testing carried out remotely. It is important that you walk through at least a few transactions with the business, to understand the systems used and what documents they are subsequently sending you.