What is Tax Control Framework (TCF)?

A TCF is not a separate system. It is part of the wider internal control system and builds on the same principles. One example is the COSO framework, a widely used model for internal control from the Committee of Sponsoring Organizations of the Treadway Commission [1].

Why does a Tax Control Framework matter?

A TCF plays a central part in cooperative compliance [1]. Cooperative compliance is a voluntary relationship between large businesses and tax authorities, based on cooperation and trust [1]. The deal is often summed up as “transparency in exchange for certainty” [4].

According to the OECD, tax authorities can significantly reduce ⚑ reviews and audits of a group’s tax returns when two conditions are met [1]:

• the group’s TCF is effective
• the group discloses its tax risks completely and openly
• In the Netherlands and Italy, a TCF is the entry ticket to a cooperative compliance program.
• In Germany, a working tax control system can protect a company if a tax return turns out to be wrong.
• In the UK, keeping proper tax accounting arrangements is a legal duty for a named officer, the Senior Accounting Officer.

A TCF does not settle the final tax bill. It shows that the process behind the tax return is under control [1]. If an error still occurs, a good TCF is evidence that the error is not the result of systemic negligence [1].

Who needs a Tax Control Framework?

The OECD guidance on TCFs is aimed at large businesses in a cooperative compliance program. It is not prescriptive and does not create new rights or obligations [1]. Every company designs its own TCF to fit its business and industry, so there is no one-size-fits-all model [1].

In practice, each country decides how much weight a TCF carries:

See the country table below.

What are the six building blocks of a TCF?

The OECD identifies six essential building blocks for a TCF, consistent with enterprise-wide internal control models such as COSO [1]. New Zealand’s Inland Revenue uses the same six in its guidance [2].

1. Tax strategy established. The tax strategy is clearly documented and owned at board level. It sets out the group’s risk appetite and the tone at the top [1].
2. Applied comprehensively. Every transaction can affect the tax position, so the TCF covers all of the group’s activities and is part of day-to-day operations. It documents the processes, controls and process owners for all relevant taxes [1].
3. Responsibility assigned. The board is accountable for the design, implementation and effectiveness of the TCF. The tax department’s role is clearly recognized and properly resourced. Tax tasks can also sit outside the tax department [1].
4. Governance documented. A system of rules and reporting compares transactions with expected norms and flags risks of non-compliance [1]. Governance covers responsibilities, key performance indicators (KPIs), a definition of materiality for tax purposes, and testing [1]. It includes a board-level sign-off, for example by the CFO or senior accounting officer, at the end of each cycle or every year [1].
5. Testing performed. The TCF is regularly monitored, tested and maintained [1]. It is also reviewed after fundamental changes, such as new tax legislation, a restructuring, or a major acquisition or disposal [1].
6. Assurance provided. The TCF gives stakeholders, including tax authorities, confidence that tax risks are under control and that tax returns can be relied on [1].

How do tax authorities assess a Tax Control Framework?

Tax authorities start by asking management how the TCF works [1]. Then they:

• review the controls and documentation
• ask for exception reports
• check who signed off on transactions
• look at how the framework handled changes, such as new legislation or a restructuring [1]
• strategy
• tax function
• risk analysis
• control
• monitoring
• reporting
• Penalties. Administrative penalties do not apply to tax risks disclosed to the Revenue Agency in time and in full. For non-significant risks already included in the risk map, penalties are halved, but never below the statutory minimum [9][14].
• Assessment period. With a certified TCF, the period in which the tax authority can issue assessments is two years shorter [9]. It can be up to three years shorter when combined with a separate tax compliance certification, but not in cases of fraud [9].
• charged on the SAO personally for breaching the main duty, or for a late or inaccurate certificate
• charged on the company for failing to notify HMRC of the SAO’s name

Testing can be substantive or limited to selected areas. It builds on controls that already exist, such as those tested by the external auditor [1]. Even taxpayers that appear low risk are still audited to some extent, so that authorities can check their own testing methods are reliable [1].

New Zealand’s Inland Revenue gives boards a checklist of ten questions about their TCF. One of them asks: “Has the operation of the tax control framework been tested independently in the last 3 years?” [2]

How do countries use a Tax Control Framework?

Netherlands

Horizontal monitoring (horizontaal toezicht) is the Dutch Tax and Customs Administration’s preferred approach for large companies [5]. It works through individual covenants based on transparency, understanding and mutual trust [5]. The starting point is that the company pays enough attention to its tax control [5].

The Administration’s good practices describe six basic principles of a TCF [6]:

Two further principles apply across all six: IT, and the role of the external tax adviser [6]. To take part in horizontal monitoring, a company must monitor its key tax risks [6]. A demonstrably well-functioning TCF counts positively in how the Administration supervises a company [6].

Italy

Under Italy’s cooperative compliance regime (adempimento collaborativo), a company needs a TCF that is part of its governance and internal control system and includes a tax risk map [8].

Certification. The TCF must be certified by an independent lawyer or chartered accountant (dottore commercialista) who is registered on the official list of qualified certifiers [9].

Revenue threshold. The threshold to enter the regime was €1 billion in 2023, €750 million in 2024 and €500 million from 2026. It will drop to €100 million in 2028 [8][9].

Benefits:

• Penalties. Administrative penalties do not apply to tax risks disclosed to the Revenue Agency in time and in full. For non-significant risks already included in the risk map, penalties are halved, but never below the statutory minimum [9][14].
• Assessment period. With a certified TCF, the period in which the tax authority can issue assessments is two years shorter [9]. It can be up to three years shorter when combined with a separate tax compliance certification, but not in cases of fraud [9].

Germany

Germany has no general legal obligation to have a TCF. In a letter of 23 May 2016, the Federal Ministry of Finance (BMF) stated that an internal tax control system can be an indication against intent or recklessness when a tax return turns out to be wrong [15]. Each case is still assessed on its own facts [15].

IDW PS 980 is the German audit standard for compliance management systems. Its revised version has been mandatory for newly commissioned audits since 1 January 2023 [10].

Since 1 January 2023, Art. 97 § 38 of the Introductory Act to the Fiscal Code (EGAO) has allowed a pilot scheme. If a tax audit has tested a company’s tax control system and found no or only minor tax risk, the tax office can, on application, give binding assurances that limit the next audit [11][15]. The pilot is due to be evaluated by 2029 [15].

United Kingdom

A UK-incorporated company must appoint a Senior Accounting Officer (SAO) if, in the previous financial year, it had more than £200 million in turnover or more than £2 billion on its balance sheet. The test applies to the company on its own or together with its UK group companies [12].

The SAO must take reasonable steps to make sure the company has appropriate tax accounting arrangements, and must confirm this to HMRC in an annual certificate [12].

Each failure carries a £5,000 penalty per financial year [12];

• charged on the SAO personally for breaching the main duty, or for a late or inaccurate certificate
• charged on the company for failing to notify HMRC of the SAO’s name.

What does a Tax Control Framework look like in practice?

Valentino Group has a cooperative compliance agreement with the Italian tax authority, backed by a TCF and a risk control matrix (RCM) [13]. Aaron Meneghin, Tax Director at Valentino, says the TCF was “not big, but at the same time really important” [13].

Written procedures already existed. What changed was accountability:

“Creating the TCF, officializing all the tax risk points within the TCF and the RCM [risk control matrix], basically gave responsibility to all the control owners. Before, they were our contact point, but if something was wrong it was always a little bit difficult to say: this is on your desk. Now it’s black on white.” [13]

The next step, he says, is moving the TCF from manual to digital management [13].

Recent developments

How Keeyns supports a Tax Control Framework

Keeyns is a tax management platform for multinational, multi-entity companies. Tax teams use it to document the processes, owners and controls in their TCF, and to keep the evidence ready for when a tax authority asks for it.

A TCF only works when every process, owner and control is visible, and the evidence is ready when the tax authority asks for it. That is where control starts.

Sources