Applying three lines of defense to tax - tax risk management for the 21st century

(First of two parts)

Risk management is the process of identifying, avoiding or managing professional risks through appropriate processes and procedures. This concept has swept through most areas of business in the recent years, but more so in these times when companies are struggling to protect their beleaguered enterprise from further damage. Some companies categorize their risks by functionality because they wish to obtain greater accountability, while others may choose to group them across functions focusing on potentially high risk categories such as reputation or regulatory risks.

Recently, I came across this article written by Stephen Callahan and Gary Harley from the UK member firm of KPMG. It suggests how one of the key tools of risk management- the Three Lines of Defense concept- can be applied to tax and the auditing of tax. The recommendations are not difficult to implement, if the company is strongly moved to establish a strong control environment for tax.

Please take a look at this piece. It should give auditors, risk management and tax professionals alike something to think about. Whereas risk management is the responsibility of each person within the firm, the article suggests that tax –trained auditors may well be the appropriate response to these challenging times.

* * *

Three lines of defense is a concept that seems quietly to be taking over the whole field of risk management. It now seems ubiquitous in financial services and is finding its way, often through public sector procurement requirements, into a vast range of new areas.

But while it may be in use elsewhere in an organization, so far it hasn’t been widely applied to the management of risk in tax. This is not, we suspect, because there is any marked resistance to the idea, but more because tax risk management is itself an emerging discipline, and is still looking for methodologies that meet its needs.

In fact, the two seem made for each other. Tax risk management is about having clearly defined and understood roles and responsibilities covering data management, transaction processing, information gathering, verification, and escalation. The three lines of defence is an ideal framework for just this kind of endeavour.

Applied to tax, the three lines concept could broadly look like this:

First line

Any function in a business needs to know how it fits into the company’s strategic plan, and to be sure that its own purpose and activities are properly aligned with the company’s aims. Tax departments are no different.

The first line of defense essentially means having this strategic understanding in place and the right people responsible for the basic business processes as they affect tax – the complete and accurate recording of transactions, for example the purchase to pay, record to report and fixed asset processes, and the gathering and processing of the related tax information.

Some tax professionals may say that this is not their role, but tax authorities are beginning to challenge tax processes “end-to-end”, including all the information gathering stages, right from the point of initiation. This means that it is ever more important to ensure that responsibility for all taxes is formally documented, and that the processes necessary to produce accurate information are embedded in the financial fabric of the organisation. These measures help to establish a strong control environment for tax.

Second line

This is the regular monitoring process. It requires frameworks and guidelines, developed by the tax and finance functions together, which are designed to facilitate effective monitoring of tax risks, pick up problems early and identify weaknesses in the process. People are human and they do make mistakes.

Third line

This is independent assurance that the tax function is running properly, through both internal and external auditing. It requires both that internal auditors bring themselves up to speed on tax risk matters, and that tax functions welcome the additional assurance that a successful audit can bring. After all, it’s better to have your internal auditor spot a mistake than to have to explain it to a tax authority.

In a traditional, well defined tax department, which takes information from finance, calculates the tax liability and files the tax returns, the three lines of defence might be a relatively straightforward set of ideas to apply. Unfortunately, modern tax departments rarely conform to this model. In many businesses, large and small, responsibility for tax is spread far and wide throughout an organisation. For mid-market groups and those in the emerging economies the challenge can be even greater as they may well not have a tax director let alone a tax department.

Many organisations measure profit in individual profit centres, product lines or business units in different locations. So the process of gathering the information necessary to draw up an accurate and detailed view of a business’s overall tax liability relies on many different people, many of whom may not have specific tax skills.

Even more important is the cumulative effect of taxes not directly related to profits, like value added taxes on sales, customs duties, social security contributions and in some instances personal taxes. Taken as a whole, these can often involve sums much larger than those involved in taxes on profits, but these taxes are rarely handled by a designated tax person. They are often seen simply as costs of doing business, and are managed by finance people working with the sales operations on the ground.

We use the phrase “shadow tax team” to refer to this wide group of people, and the effective management of the shadow tax team, we believe is a major element in the responsibilities of a modern senior tax professional.

Applying the first line of defense, many tax directors are trying to bring new controls to their shadow tax teams. They are being driven by increasing pressure from regulators all over the world for more and better information to support a company’s tax position. They are also under pressure from Boards, who have realised both the cash savings that can be made by managing tax more efficiently, and the dire consequences of getting their tax calculations wrong.         (To be continued)

(Emmanuel P. Bonoan is the Chief Operating Officer and Vice-Chairman for Tax & Corporate Services of Manabat Sanagustin & Co., CPAs, a member firm of KPMG network of independent member firms affiliated with KPMG International, a Swiss cooperative. This article is for general information only and is not intended to be, nor is it a substitute for, informed professional advice. While due care was exercised to ensure the quality of the information contained in this article, readers should carefully evaluate its accuracy, completeness and relevance for their purposes, and should obtain any appropriate professional advice relevant to their particular circumstances. The views and opinions expressed herein are those of the author and do not necessarily represent the views and opinions of KPMG in the Philippines. For comments or inquiries, please email [email protected] or [email protected]).