Development of Effective Controls for Indirect Tax

It is one thing to understand the core components, benefits, and purposes of the Indirect Tax Control Framework (ITCF), and another to know how to identify, classify, and prioritize tax risks. However, these are only the preparatory steps for the most critical part of the process, which is the development of the effective ITCF. Let's be clear about one thing: the stakes are high, especially for businesses operating in multiple jurisdictions.

In addition to errors, omissions, or weak controls that can lead to assessments, penalties, interest, and reputational exposure, Tax Authorities are now insisting that businesses have effective management and governance in place. Thus, developing effective controls for indirect tax requires more than rulebooks and checklists.

Foundational Principles of Effective Tax Control Design

The simplest way for businesses to approach the development of an effective ITCF is to adopt a tax compliance by design mindset that fits their own business needs. However, saying this is much easier than actually completing this task successfully. Therefore, businesses may use several foundational design principles to guide them throughout the process. 

The first one, based on the previous article on the tax risks, is to design ITCF to be risk-based and proportional. Not every transaction needs the same level of scrutiny and oversight. Consequently, attention must be given to those areas of highest tax exposure. Secondly, transparency and traceability are essential. The ITCF must provide and leave clear audit trails, decision logs, and documentation of exceptions.

The third foundational principle is that ITCF must be embedded in business processes, rather than being checked or enforced only after actions are completed. If tax controls are not perceived as part of everyday business operations, they may not be effectively implemented, as people may bypass or ignore them.

Furthermore, tax controls should be scalable and agile, meaning they should be designed to evolve and adjust as businesses grow and expand, and the regulatory environment changes. Finally, controls should be perceived as reasonable assurance, not absolute certainty. The ITCH is a tool to reduce risk and address mistakes when they occur, not a guarantee of perfection.

Designing the Indirect Tax Control Architecture

The Australian Taxation Office (ATO) underlined three crucial elements of effective tax governance: the existence of a tax control framework, design effectiveness, and operational effectiveness. Regarding design effectiveness, the ATO emphasized that a system is effectively designed if it ensures the correct amount of tax is paid, identifies and mitigates tax risks, and is documented. Although this sounds relatively simple, developing an effective tax control architecture involves integrating people, processes, technology, and governance structures.

People: The First and Strongest Line of Defense

These days, technology and digital tools often get the spotlight. However, people remain the first and strongest line of defense in indirect tax controls. Controls are executed by employees in the operations, finance, or IT departments, not by the software alone. Consequently, clarity on roles and responsibilities is essential. At the oversight level, senior management and boards must be aware of tax strategy and so-called risk appetite. 

It is not uncommon for businesses to route tax policy oversight through audit committees or tax governance committees. One such example is Mastercard, which stated in its Global Tax Principles that tax policies must be approved at the CFO level and that the Audit Committee receives regular updates on tax policies, strategies, and exposures. At the same time, the Audit Committee oversees the implementation of tax policies and strategies.

Regardless of how the tax control is structured, front-line teams must know when to flag new transactions, apply tax logic, or escalate uncertainties. While the financial department or tax department is typically responsible for defining tax policies, setting control rules, and monitoring results, cross-functional collaboration is critical. 

Tax Policy as the Basis of ITCF

While people are responsible for defining and executing tax policy, the policy itself must be a well-written and practical document that provides clarity and guidelines on the goals. The tax policy defines approaches to tax risk, including risk profiles and tolerance levels, establishes a framework for communication with Tax Authorities, and lists key taxes under the policy's scope, such as VAT, GST, or sales and use tax. 

Additionally, it identifies all available internal and external resources and dictates when prior consultation with the tax or financial department is required before engaging in decision-making. Furthermore, the tax policy standardizes the process and incorporates best practices and compliance requirements. Moreover, the tax policy defines how to document all relevant processes, such as further development of control matrices, risk assessments, and regular reviews to identify and address potential weaknesses.

Generally, as the top-level document in the tax hierarchy, approved by senior management, the tax policy establishes internal rules and expected behaviors, guiding employees on what is acceptable and what is not in relation to tax matters.

Technology and Tools: The Backbone of Modern Control Systems

Technology is an inevitable element of any modern ITCF. Since the integration of technology into the ITCF will be explored in more detail in Article 4 of this series, we will only outline some key features of useful tax tools here, such as real-time tax determination, validation of tax numbers, and automation of compliance processes. Notably, the purposes of the technology and digital tools are to reduce human error, increase efficiency, and ensure compliance with evolving tax regulations.

Integrating Third-Party Support into the Tax Control Framework

While regular internal audits are highly recommended and are part of the Three Lines of Defense (3LoD) model, there is a limit to their value and effectiveness. Therefore, businesses should consider utilizing external resources or third-party support, such as tax auditors, consultants, or advisors, to uncover blind spots, benchmark maturity, or provide deep domain expertise for complex transactions.

Even in the early stages of developing ITCF, these tax experts can validate control design, test control effectiveness, and propose improvements. As part of regular ITCF monitoring and upgrading, businesses may use quarterly or annual tax “health checks” to ensure their indirect tax controls remain fit for purpose.

Furthermore, in the rapidly changing indirect tax environment, external resources are vital for keeping key stakeholders informed about emerging risks, such as geopolitical tax changes, new e-invoicing mandates, refined audit strategies by Tax Authorities, AI-based tax audits, and more.

Ensuring Effectiveness in Practice

Creating a tax compliance awareness culture through well-written and validated tax policy based on determined tax risks, responsibilities, transparency, and ownership is what every business should strive for. Additionally, continuous training of not just key stakeholders but all employees who may contribute to tax compliance or non-compliance is essential. Regarding the validation, this is typically achieved through testing, monitoring, and improvement and feedback loops.

Effective monitoring is typically conducted by defining key performance indicators (KPIs) for control processes. Some KPIs, such as error rates, audit findings, and compliance timelines, can help assess whether the controls are achieving their objectives and where improvements are needed. Regular control testing, such as reconciliations and compliance checks, helps detect issues before they escalate and ensures that controls are functioning as intended.

Importantly, when a control failure occurs, which will happen on some occasions, even if the ITCF is designed in the best possible way, it must be remediated and its root cause addressed. The failure also serves as feedback that helps redesign the ITCF. In mature ITCFs, this ultimately becomes a formal control optimization cycle. Therefore, businesses should not fear mistakes and failure, as long as the processes and procedures for recovery and progress are in place, and all key stakeholders are familiar with the required steps.

Periodic review, conducted by both internal and external audits or tax experts, of the complete tax control architecture ensures it remains aligned with evolving business models, new jurisdictions, and regulatory changes. 

Conclusion

Developing and implementing an effective ITCF is not a one-time project, but rather a continuous process that requires steady governance, flexible design, engaged people, integrated technology, and periodic validation. 

Importantly, the architecture businesses build must rest on sound principles: risk-based, proportionality, embedding controls into business processes, transparency, and scalability. Properly designing and sustaining ITCF means transforming the indirect tax form compliance burdens into a managed risk function and a strategic level of confidence. 

FAQ

Source: Australian Taxation Office, Netherlands Tax and Customs Administration, PwC, OECD Tax Compliance by Design, Mastercard