TCRM3360 - The Business Risk Review (BRR+): Business Risk Review (BRR+) Assessment indicators: Deciding whether a customer is Low Risk

A customer can be Low, Moderate, Moderate-High or High Risk.

A customer will be able to make various reflective statements depending upon the category that they fall within. For example, a Low Risk customer will be able to say, “I maintain an open and transparent relationship with HMRC and can be trusted to file returns accurately and on time”, whereas a High Risk customer might say, “I am regularly in dispute with HMRC over significant amounts of tax”.

All risk statements and risk criteria will be considered collectively in the decision-making process by the CCM and supporting Tax Specialists; including Audit and any other relevant specialist. The HMRC case team will collectively consider which of the four risk categories a customer will sit within. Although not an exhaustive list, example statements for each risk rating are provided in ‘Which customers might expect to fit in each risk-rating’.

Which customers might expect to fit in each risk-rating

Classifying a business as Low Risk for the first time may possibly represent a significant turning point in HMRC’s compliance approach to a particular customer. As such, decisions by CCMs to classify a customer as Low Risk need to be consistent and supported by evidence that can withstand scrutiny (i.e. internal governance or external reviews) and has been countersigned by the BRR+ Countersigning Officer (see TCRM3430). We have therefore provided examples below of what Low Risk behaviour might look like in practice for the BRR+ indicators.

In order to be regarded as Low Risk, a customer must not fail any of the Low Risk criteria in any material aspect (although there is one exception to this for Systems and Delivery which is detailed below). The phrase ‘in any material respect’ is taken from Senior Accounting Officer legislation and recognises that in large groups absolute perfection is not attainable. There will be cases where a customer does not meet one or more of the criteria but the failure is unlikely to indicate any significant or ongoing risk. For example, a customer may have made a relatively small error in one regime however, the error is unlikely to re-occur because they have put in place controls to prevent it or it was entirely unforeseeable. The CCM may reasonably decide that, on balance, for that particular criterion, the customer can be regarded as meeting it. Deployment of HMRC and customer resource on non-material issues does not represent efficient working practices.

The risk criteria will be considered for each individual tax regime separately e.g. VAT and Corporation Tax. Each Tax Specialist will complete the appropriate section of the BRR+ template for their regime to record the findings from their risk assessment. This includes recommendation for risk status, based on a comparison of their findings against the indicators for risk. If an indicator is not relevant to a particular tax regime, it should be disregarded when considering the indicators of risk.

If there is insufficient information on a particular indicator, this cannot be used in isolation and without explanation, to mark a Low Risk indicator as not being met. Instead, the regime Tax Specialist and/or CCM will use their knowledge and experience of the customer to consider the risk arising from not knowing this information. For example, it could be systems and process concerns after a merger/acquisition or concerns due to the complexities of a transaction and the need to understand it better. Each BRR+ narrative will be bespoke and if the Tax Specialist and/or CCM determines that not knowing particular information is a risk, they must articulate this concern in the BRR+ narrative. This narrative must go on to explain what actions will be undertaken to address this, by whom and over what period.

It is the role of the CCM to collaborate with the Tax Specialists and discuss the individual ratings for each regime. The CCM will arrive at an overall risk rating for the customer through the application of their knowledge, skills and experience while considering the overall context of risk for the business

It is not possible to define exactly what each criterion means in practice as this will vary slightly from customer to customer. However, the following provides some general examples for each of the BRR+ criteria.

Low Risk Criteria

1. Systems and Delivery

Providing indicators 1 and 2 for Systems and Delivery are met (1.1 and 1.2 below), then a Low Risk rating can be achieved if no more than one of the other indicators is not met.

1.1 Systems and Processes: The customer employs sufficient resource to deliver timely and accurate returns, declarations, payments and claims, including accounting systems and processes that are suitable for the size and complexity of the business.

What this might mean in practice:

• systems and processes are in place to be able to deliver the right tax at the right time
• processes are fit for purpose and are not under-funded or allowed to degrade

1.2 Sufficiently Resourced Tax Team: The customer employs sufficient resource to deliver timely and accurate returns, declarations, payments and claims, including sufficiently skilled resource in the Finance/Tax teams.

What this might mean in practice:

• tax team have adequate skills and knowledge with suitable training and development
• tax team are sufficiently staffed and are not regularly short-staffed/over-stretched

1.3 All returns and payments are made on time.

What this might mean in practice:

• no returns and/or payments have been submitted/paid late

1.4 HMRC interventions have not identified significant errors.

What this might mean in practice:

• HMRC interventions have not yielded any significant amounts of incorrectly declared or claimed tax
• HMRC interventions have not identified any evidence that tax-related decisions are significantly incorrect or a cause for concern

1.5 The customer maintains a tax risk and controls matrix and shares this on request from HMRC.

What this might mean in practice:

• customer identifies areas where potential errors may occur and documents these along with detailed steps that have been put in place to mitigate the risk of error. HMRC does not require a register of uncertain tax positions adopted by the customer which are currently disputed or open to interpretation

1.6 The customer maintains documented tax policies and procedures and shares these on request from HMRC.

What this might mean in practice:

• the customer is able to share documents ranging from, for example, ‘seat notes’ detailing how a job-holder is expected to compile a return; management procedures for sign-off checks; and copies of tax-related risk-management reports to governance boards

1.7 The customer undertakes assurance checks and testing of its policies and procedures on a regular/timetabled basis.

What this might mean in practice:

• the customer shares on request examples of how management assurance checks have been carried out and how relevant policies are reviewed and updated

1.8 Where key fiscal areas are outsourced, reasonable steps are taken to ensure the provider is suitably competent, qualified or controlled in order that transactions which impact on tax are properly accounted for.

What this might mean in practice:

• the customer is able to demonstrate how outsourced services are monitored and evaluated.

2. Internal Governance

All indicators must be met to be regarded as low risk.

2.1 The customer has clear accountabilities up to and including the Board for the management of tax compliance risk and tax planning.

What this might mean in practice:

The customer can:

• clearly explain how tax issues are escalated appropriately up the organisation and how the Board has a line of sight on tax compliance risk and tax planning;
• demonstrate how this has successfully worked in practice in the context of significant business events which potentially impact on tax.

2.2 The customer has appropriate tax accounting arrangements so as to enable accurate tax reporting.

What this might mean in practice:

• tax accounting arrangements are defined as the processes the customer has in place to enable the tax liabilities to be correctly calculated in all material respects. They include the framework of responsibilities, policies, people and procedures in place for managing tax compliance risk and the systems and processes which put this framework into practice. They cover the end-to-end process from initial data input to the accounting systems to arriving at the numbers which form the basis for completion of the tax return. HMRC’s guidance on the Senior Accounting Officer measure provides further information on what appropriate tax accounting arrangements might include.

2.3 The customer keeps HMRC informed of how the business is structured and where different parts of the business are located.

What this might mean in practice:

• the customer provides a complete worldwide group structure to HMRC when requested, demonstrating the different territories within which the group operates and the different entities and structures in place
• if the UK is a sub-group of the wider multinational group and is therefore potentially not in possession of a worldwide group structure, the UK customer should provide alternative information to help HMRC understand how it has self-assessed the applicability of various international tax issues
• the customer approaches HMRC at an early stage to discuss any potential restructurings or mergers and acquisitions

2.4 The customer has fulfilled its filing, notification (or exemption), due diligence, reporting and/or publication obligations regarding Senior Accounting Officer legislation, Uncertain Tax Treatment legislation, Country by Country Reporting, Tax Strategy publication and Automatic Exchange of Information under the Common Reporting Standard or FATCA (if appropriate).

What this might mean in practice:

• evidence that the filing, notification (or exemption), due diligence, reporting and/or publication obligations have been fulfilled
• Automatic Exchange of Information – due diligence and reporting obligations under the Common Reporting Standard or FATCA have been fulfilled. Returns of Reportable Accounts information have been submitted on time and are complete in all material respects

2.5 The customer appreciates its potential liability under the Corporate Criminal Offence legislation and steps have been taken to profile and manage the risk of failing to prevent the facilitation of tax evasion.

What this might mean in practice:

• the customer has confirmed that they have carried out a proportionate risk assessment for the facilitation of Tax Evasion which is regularly updated in line with the risks identified. This should include appropriate due diligence
• the customer has confirmed that there is clear policies and procedures in place to train staff, ensuring the training is kept up to date and communicated effectively
• the customer has confirmed that they have, and can demonstrate, top level commitment to prevent potential liability under the CCO legislation, including ongoing monitoring and review

2.6 Any significant uncertainties or irregularities identified by the customer are communicated to HMRC promptly.

What this might mean in practice:

• the customer will be expected to periodically review processes and procedures and, if and when errors come to light, take steps to correct these and notify HMRC of any tax which needs to be adjusted
• in general, ‘promptly’ in this context can be regarded as at the time that a significant uncertainty or irregularity is identified rather than in relation to when the return is submitted. CCMs will need to make a common-sense judgment about whether or not their customer has involved them in discussions at the appropriate time to provide a view on the uncertainty or irregularity

2.7 Transactions or issues with significant tax implications are discussed in real time and communications with HMRC are managed collaboratively.

What this might mean in practice:

• in general, ‘real time’ in this context can be regarded as at the time that a tax uncertainty or irregularity arises or a complex commercial transaction is being considered rather than at the time of submitting the return or after submission. CCMs will need to make a common-sense judgment about whether or not their customer has involved them in discussions at the appropriate time to provide a view on the transaction and/or issue, taking account of the fact that commercial pressures may require customers to move quickly on a particular transaction. HMRC’s commitment to early engagement is strengthened by the Uncertain Tax Treatment regime, which provides an exemption (the General exemption) from the notification requirements where all, or substantially all, information is provided to HMRC at an earlier stage.

2.8 Prompt, accurate and helpful answers are provided in response to HMRC’s queries and requests for information.

What this might mean in practice:

• the CCM has not had to send repeated reminders or ask supplementary questions to obtain a full response (assuming the original request was well-articulated)
• the customer provides ready access to relevant business personnel to discuss issues
• the customer uses different ways of helping the CCM understand an issue rather than just answering questions in writing

3. Approach to Tax Compliance

All indicators must be met to be regarded as low risk.

3.1 The customer maintains an open and transparent relationship with HMRC.

What this might mean in practice:

• the customer volunteers relevant information readily and fully at appropriate times, rather than needing to be pressed

3.2 The customer has a documented tax strategy that is used to steer all tax considerations.

What this might mean in practice:

• it is evident that, for example, any significant tax planning decisions are in accordance with the tax strategy
• the customer can point to examples where possible courses of action which would not have been consistent with the tax strategy were not taken

3.3 The tax strategy is regularly reviewed and updated when appropriate.

What this might mean in practice:

• the customer can point to evidence to show that the strategy has been reviewed at an appropriate level at appropriate intervals

3.4 The customer is open with HMRC in real time about how tax compliance risk is managed across all relevant taxes and duties.

What this might mean in practice:

The customer:

• readily discusses with HMRC how they identify and manage tax compliance risk
• they respond co-operatively to reasonable requests from HMRC to demonstrate how this risk management works in practice
• the customer volunteers information in real time about significant commercial transactions or complex issues which might have tax compliance implications

3.5 The customer is not involved in tax planning other than that which supports genuine commercial activity and they fully disclose the facts and any legal uncertainty of relevant transactions.

What this might mean in practice:

• there is no evidence that a customer has contrived a situation primarily to create a tax benefit.

3.6 The customer does not structure transactions in a way which gives a tax result contrary to the intentions of Parliament.

What this might mean in practice:

• normally it will be clear whether a transaction gives a tax result ‘contrary to the intentions of Parliament’ but ultimately this will involve a degree of judgment by the CCM, informed by advice from specialist colleagues. In cases of doubt, if the transaction is subject to the disclosure regime then this should be treated as an indication that its tax result is likely to be contrary to the intentions of Parliament

3.7 The customer is not directly involved with illicit trades and is active in mitigating illicit trades within their supply chain.

What this might mean in practice:

• direct involvement in illicit trades and/or practices which do not comply with other UK legislation such as national minimum wage and labour provider legislation will preclude the customer from meeting this criterion. Other, less direct forms of involvement may also preclude a customer from being Low Risk. For example, where a form of illicit trade is well-known and has been subject of discussion between the customer and HMRC, the customer will be expected to have considered how they can actively help minimise the risk to the tax system and to implement reasonable measures where appropriate
• a customer involved in illicit trades is likely to be regarded by HMRC as High Risk, whereas a Low Risk customer should be able to demonstrate that it is actively engaged in discouraging illicit trade possibilities

3.8 The customer has not incurred an inaccuracy penalty, including any penalties that may have been suspended.

What this might mean in practice:

• no inaccuracy penalties have been incurred, including any suspended inaccuracy penalties.

Low Risk Criteria for banks

In addition to the above, a bank which falls under the Banking Code of Practice must adopt and implement the Code properly to be regarded as Low Risk. A Business Risk Review (BRR+) template which covers compliance with the Code is available for use with banking customers.

Low Risk Criteria for customers that are Financial Institutions

In addition to the above, the approach taken by a customer which is a Financial Institution to managing its due diligence and reporting obligations for Automatic Exchange of Information under the Common Reporting Standard and FATCA will be a consideration as part of any BRR+ carried out.

Low Risk Criteria for agents

In addition to the above an agent will receive a risk rating as to the extent they meet the standard for agents. This rating will look at whether the agent is maintaining high standards to promote tax compliance and whether the agent is following the principles when advising on tax planning. A Business Risk Review (BRR+) template which covers the standard for agents is available for use with agent customers and additional guidance within TCRM3346