## vitara007ea

## Source details

**Canonical URL:** [vitara007ea](https://www.imf.org/-/media/files/publications/manuals-and-guides/2025/english/vitara007ea.pdf)

## Other formats

- [Markdown version](/-/media/files/publications/manuals-and-guides/2025/english/vitara007ea.pdf.md)
- [Structured JSON version](/-/media/files/publications/manuals-and-guides/2025/english/vitara007ea.pdf.json)

---

### Compliance and the Role of Audit
- Definition and pillars:
  - Compliance: registration; on–time filing; correct reporting; on–time payment.
  - Noncompliance: can be unintentional or intentional; influenced by taxpayer behavior, understanding, and perception of fairness.
- Compliance Risk Management (CRM):
  - Identifies where noncompliance may be occurring and the monetary impact (materiality) on the tax base.
  - Informs case selection and treatment options; goal is to bring risk to an acceptable level, not eradicate it.
- Treatment continuum and examples:
  - Voluntary compliance → Prevention (little/no intervention).
  - Assisted compliance → Facilitation (education, reminders, prefilled returns, voluntary disclosure).
  - Enforced compliance → Enforcement (verifications, audits, investigations, penalties).
- Verification vs. Audit:
  - Verification: less comprehensive; typically focuses on one item; can take minutes or hours.
  - Audit: more comprehensive; reviews all tax obligations and related parties; can range from several hours to hundreds of hours.
  - Verification is included as part of audit activities in this guide.
- Operational principle:
  - Audit is the most expensive treatment and should focus on highest-risk taxpayers who intentionally underreport.

*Source: CHAPTER 1. Compliance and the Role of Audit — THE AUDIT PROGRAM: VIRTUAL TRAINING TO ADVANCE REVENUE ADMINISTRATION: Reference Guide*

### Legal Framework — Powers, Time Limits, Penalties, and Voluntary Disclosure
- Key legislative powers to support audits:
  - Power to obtain search warrants; obtain information from third parties through court orders; prescribed information; right to inspect; requirement to maintain financial books and records; requirement to file a tax return.
- Time periods to reassess:
  - Statute-barred date typically between three and ten years.
  - Offshore extensions typically in the range of three to five years.
  - Example: three-year base plus three-year extension → total of six years for offshore review.
- Penalty types and use cases:
  - Penalties can be fixed, percentage-based, or combined; may apply to taxpayer, agent, or both.
  - Examples: failing to provide documents; gross negligence; late or non-filer; obstruction; assisting in making an incorrect return (agents); failing to withhold and remit tax; destruction of records.
  - Many regimes include graduated penalties for repeat offenders.
- Third-party reporting and bulk data:
  - Data from financial institutions, customs, registries, subnational governments used to strengthen CRM and audits.
  - Authority should be established via legislation or MOU; where absent, third-party data can be compelled on a taxpayer-specific basis.
  - Requirements to make full use of third-party data: prescribed data format protocols; sufficient storage and backups; a repository preserving originals; data analysis software; staff capacity in data analysis.
- Dispute resolution:
  - Independent review post-audit is essential to fairness and voluntary compliance.
- Voluntary Disclosure Program (VDP):
  - Allows taxpayers to correct past incorrect returns to avoid penalties/criminal prosecution in many cases.
  - Eligibility commonly requires complete and accurate disclosure, no prior administration compliance action on those years, cooperation with validation, and payment of outstanding tax or acceptable payment proposal.
  - Number of years for disclosure can be up to ten years.
  - VDP authority can be administrative (ministerial discretion codified in policy) or legislative; some jurisdictions permit “prompted” disclosures after initial contact.

*Source: CHAPTER 2. The Legal Framework*

### Organization and Governance — HQ, Segmentation, Segregation, Structure
- Role of Headquarters (HQ):
  - Set compliance strategy; prepare national work plans; allocate resources; manage compliance risks; evaluate audit results; develop national policies and procedures; ensure segregation of duties; manage AQR; analyze tax revenues; manage stakeholder relationships.
  - HQ activities should be organizationally separate from operational audit activities.
- Taxpayer segmentation:
  - Supports CRM and targeted audit selection; enables specialization by industry or taxpayer segment.
  - Large taxpayers often contribute more than 60 percent of total tax collection.
  - Average LTO staff devoted to managing large taxpayers is about 4 percent.
  - Common segments: high-net wealth individuals; SMEs; micro businesses; nonbusiness individuals.
- Segregation of duties:
  - Different persons should select the audit, conduct the audit, approve outcomes, conduct dispute resolution, and conduct criminal investigation.
  - Supervisory approvals: immediate supervisor should approve proposed adjustments; second-level review depending on materiality; delegations of authority to positions, not persons.
- Organization structure:
  - Audit function should be separate from CRM, case selection, dispute resolution, and criminal investigation.
  - Indicative mature model: HQ program design/CRM; LTO and other segments in regional/district offices reporting to deputy head, operations; criminal investigations in legal and international directorate; regional offices deliver audits.
  - Centers of expertise can be established where volume allows (e.g., HNWIs, underground economy).

*Source: CHAPTER 3.*

### People — Resourcing, Skills, Training, Timekeeping, and Performance
- Resourcing benchmarks and span of control:
  - Most advanced administrations allocate approximately 30 percent of overall staff to audit programs.
  - Recommended span of control: a range of four to eight auditors per team leader.
- Staff expertise and specialization:
  - Verifications: can be staffed by less experienced staff with supervision.
  - Complex audits and LTO/HNWI audits: require most experienced auditors with accounting and tax law knowledge; specialization in sectors and issues (profit-shifting, transfer pricing, anti-avoidance).
  - Criminal investigators: need specialist training; function must be separate from audit.
- Training and mentoring:
  - Formal training and mentoring are essential, covering audit techniques, IT, CAATs, and supported by plain-language manuals and guidance.
- Auditor timekeeping and cost-benefit:
  - Applied time (hours spent on an audit) and elapsed time (days from assignment to completion) should be recorded.
  - Time records enable cost–benefit analysis (comparing auditor costs to additional tax assessed) and ROI calculations.
  - Operational guidance: audit to the risk; conclude audits where additional effort cost equals or exceeds potential additional tax; auditors must record time (preferably via CMS).
- Performance evaluation and KPIs:
  - Individual goals should align with unit and program plans.
  - Use a range of indicators; do not base remuneration solely on additional tax assessed.
  - Suggested KPIs:
    - Number of completed audits by audit type.
    - Expected strike rate (percentage of completed audits identifying additional liability).
    - Timely completion metrics (e.g., audits open more than three months, six months).
    - Number of completed audits resulting in internal review or appeals.
    - Number of mentoring meetings held.
  - Numerical targets should be set by audit manager based on case complexity and auditor skill, with at least one interim progress review during the year.

*Source: CHAPTER 4. People, VIRTUAL TRAINING TO ADVANCE REVENUE ADMINISTRATION: Reference Guide*

### Systems — CMS, CAATs, SAF-T, and IT Considerations
- Case Management Systems (CMS):
  - CMS should integrate registration, processing, collection, work automation, workflow regulation, audit case management, and risk analysis.
  - CMS should provide a comprehensive view of all taxes per taxpayer and management reports.
  - Timelines and costs: unlikely to be built and commissioned in less than three years; costs likely large even for small countries; staff training required.
  - Change management strategy required early.
  - Appendix 5 provides a CMS checklist of core capabilities and desirable features.
- Electronic audit tools (CAATs) and SAF-T:
  - CAATs improve efficiency for large taxpayers and for audits with many transactions; tools include ACL, IDEA, Excel, Access, SQL Server.
  - SAF-T: obliges larger businesses to maintain records in a standard format to facilitate e-audits.
  - Pre-implementation: weigh benefits against procurement and maintenance costs; ensure each auditor has a powerful laptop and software skills.
  - Appendix 6 summarizes CAAT functions and indicators of noncompliance across payroll, expenses, general ledger, sales, purchasing, stock, fixed assets, and data quality.
- Recommendation:
  - Evaluate IT systems holistically and prioritize integration on an agreed road map.

*Source: CHAPTER 6. Systems*

### Performance Measurement — Frameworks, KPIs, ROI, and Tax Gap
- Performance levels:
  - Strategic, operational, and individual levels; goals set top-down and measured bottom-up.
- Inputs → Activities → Outputs → Outcomes → Impact:
  - Example outputs and KPIs for audit activities:
    - Education: website clicks; requests for adjustments.
    - Letters: number issued; number who self-corrected; follow-ups with additional tax assessed.
    - Audits: number completed; strike rate; amount of additional tax assessed; return on investment (ROI).
- Quantitative and qualitative measures:
  - Quantitative: percentage of audits completed against target; percentage with material change; percentage of additional tax assessed against target; reduction in compliance gap.
  - Qualitative: perceptions of tax advisers; taxpayer surveys.
- Materiality examples:
  - Reassessment of additional revenue of $1,000,000 in a company with turnover of $10,000,000 → considered significant/material.
  - Reassessment of $20,000 in a company with turnover of $10,000,000 → not considered material.
  - Consider processing cost: if cost > additional tax proposed, not material.
- Annual operational performance and ROI:
  - ROI can use auditor time (hours × average salary) to compare cost to additional tax assessed.
  - If timekeeping unavailable, ROI can be total reassessments divided by total cost of audit staff.
  - Track ultimate outcomes after dispute resolution; do not count reassessments overturned on appeal as incremental revenue.
- Dashboard and indicators:
  - Track number of audits completed; total reassessments; ROI (annual); percentage of audits with material change; reassessments from matching programs.
  - Additional KPIs: reassessment confirmation rate; average reassessment per taxpayer; total reassessments divided by revenue collected.
  - Analyze trends over three years to assess program performance.
- Tax gap analysis:
  - Segregate policy gap (policy choices) and compliance gap (administration control).
  - Use tax gap to identify sectors contributing most to the compliance gap and to track long-term targets such as “reduce the compliance gap by x percent by 20xx” (multi-year horizon, typically exceeding five years).

*Source: CHAPTER 7. Performance Measurement*

### The Audit Process — Steps, Planning, Interviews, Working Papers, and Approval
- Sequential audit steps:
  - Preaudit planning → Notify taxpayer → Initial interview/tour → Examine records and perform tests → Clarification interviews → Record interactions → Final interview/presentation of findings → Seek agreement/advise right to appeal → Seek payment or reassess → Seek approval → Provide feedback to CRM/case selection.
- Preaudit planning should review returns, prior audits, international transactions, related-party transactions, sector risks, need for specialists, and whether CAATs/electronic records are required.
- Taxpayer notification:
  - Recommended written notice two to three weeks in advance listing legal basis, periods, scope, tax types, auditor names, required records, audit location, and reduced-penalty disclosure processes if applicable.
- Managing audit time and delays:
  - Apply ongoing cost–benefit analysis; use team leader approval to extend or escalate; keep taxpayers informed; use interim interviews as needed.
- Interviews and information gathering:
  - Initial interview goals: understand business, records, income generation, maintenance of records, explain audit process and rights, and ensure records availability.
- Working papers and reports:
  - Maintain comprehensive working papers; reports must set out reasoning, documentary evidence, taxpayers’ views, techniques used, and references to legislation.
  - Retain until audit, appeals, collection matters finalized, or until statute-barred retention period lapses.
  - Provide feedback to CRM on risk-criteria effectiveness.
- Approval process:
  - Supervisory review tiered by materiality, penalties, sensitive audits, and multi-taxpayer issues.
  - Written policies should define approval criteria and management levels for reassessments.

*Source: CHAPTER 8. The Audit Process*

### Audit Methods, Integrity, Delegations, and AQR
- Audit method selection:
  - Direct methods: compare tax returns to reliable books and records.
  - Indirect methods: used where records unreliable; six categories — benchmarking; cross-checking (net worth); bank deposit and cash expenditure; source and application of funds; percentage markup; unit and volume.
  - Indications for indirect methods include lack of records, unexplained wealth, cash operations, repeated losses, and poor internal controls.
- Audit integrity and corruption mitigation:
  - Case selection must be exclusively risk-based, evidenced, and documented.
  - Two approaches to finalizing disagreeing cases: auditor-based assessment (higher dispute risk) or documented compromise with oversight (risk of corruption if not transparent).
  - Delegations should be to positions, documented, and preserve segregation of duties.
  - Mitigations: secure websites for taxpayer verification of assigned auditors; random senior-level reviews of cases.
- Audit Quality Review (AQR):
  - Purpose: independent assurance that audits meet standards and consistency nationwide; support continuous improvement and staff development.
  - Seven AQR standards: Selection; Planning; Probing; Recording; Legislation and Policy; Timeliness; Customer Service.
  - Structure: centralized independent HQ unit selecting statistically robust random samples of completed audits annually; results used to identify training needs and inform CRM and case selection.
  - Principle: AQR should not be used to penalize genuine errors.

*Source: CHAPTER 5.*

### Audit Types, Random Audits, and Indirect Methods (Appendices)
- Types of checks and audits:
  - Verification checks (phone/email/letter), desk audits, single-issue audits, VAT refund audits, comprehensive audits, audit projects, reaudits, random audits, and criminal investigations.
  - Random audits: statistically robust samples to measure compliance, act as deterrent, and identify CRM gaps; downsides include burden on compliant taxpayers and opportunity cost.
  - Reaudits typically occur two to three years after a first audit to measure program impact.
- Appendix summaries:
  - Appendix 4 — Six indirect audit methods listed above.
  - Appendix 5 — CMS checklist of core capabilities and analytical requirements.
  - Appendix 6 — CAAT tools/functions and indicators of noncompliance across payroll, expenses, GL/journals, fraud, sales/AR, purchasing/AP, stock, fixed assets, and data quality.
- CAAT examples and functions:
  - Tools: ACL, IDEA, Excel, Access, SQL Server.
  - Common functions: data queries, stratification, sample extraction, missing sequence identification, statistical analysis, duplicate identification, pivot tables, cross tabs.
  - CAAT-identified indicators include ghost employees, duplicate payments, unusual journals, excessive expense claims, negative stock quantities, blank data fields, and nonuniform entries.

*Source: Appendix 3; Appendix 4; Appendix 5; Appendix 6. ISBN 9798400290145.*

*Italic: Source — vitara007ea (CHAPTERS 1–8, Appendices 3–6).*

### CHAPTER 1.

### CHAPTER 1. Compliance and the Role of Audit

### Definition of Terms
- Compliance: the degree to which taxpayers meet their tax obligations by registering when required, filing on time, correctly reporting their tax obligations, and paying on time. These are called the “pillars” of compliance or core compliance obligations.
- The Four Core Compliance Obligations:
  - Registration
  - On–Time Filing
  - Correct Reporting
  - On–Time Payment
- Noncompliance: where a taxpayer has not fully met the four obligations. Noncompliance can be unintentional (taxpayer does not understand obligations) or intentional (taxpayer knows the law and chooses not to comply or is indifferent).
- Compliance is impacted by taxpayer behavior, taxpayer understanding of obligations, and taxpayers’ perception of the fairness of the tax system.
- Compliance Risk Management (CRM): the function that identifies where noncompliance may be occurring and the impact on the tax base; CRM informs selection of treatment options.
- Materiality (in this context): the magnitude of the risk in terms of the monetary impact on the country’s tax base (if the risk proves to be valid).
- Treatment options: possible actions to address identified risks. The tax administration’s goal is to bring the risk to an acceptable level, not to eradicate the risk altogether.
- Compliance Continuum and Treatment Strategies:
  - Voluntary compliance: Little or no intervention; Treatment strategy: Prevention.
  - Assisted compliance: Some intervention to assist taxpayers; Treatment strategy: Facilitation.
  - Enforced compliance: Use the full force of law for serious noncompliance; Treatment strategy: Enforcement.
- Treatment Option Categories and Examples (from Table 1.1):
  - Preventative: Education, reminders for on-time filing and payment, legislative changes to address loopholes, rulings that outline the administration’s position on a certain issue.
  - Facilitative: Prefilled tax returns; letters to point out common errors, with the opportunity to self-correct returns; voluntary disclosure programs.
  - Enforced compliance: Verifications and audits, investigations, penalties.
- Audit and Verification:
  - Verification: typically used where third-party information is available to compare with the taxpayer’s return to confirm compliance; can validate deductions or check inconsistencies; characteristics summarized below.
  - Audit: conducted to determine whether the taxpayer reported their tax liability correctly; a civil process (as compared to a criminal investigation).
  - In this guide, “verification” is included as part of “audit” activities.
- Distinction between Verification and Audit (from Table 1.2):
  - Verification:
    - Is less comprehensive
    - Typically focuses on one item on the tax return
    - Can be completed in a matter of minutes or hours
  - Audit:
    - Is more comprehensive
    - Reviews the compliance of the taxpayer for all their tax obligations and may also examine the compliance of any related parties, such as partners or subsidiary companies
    - Can range from several hours to hundreds of hours
- Audit settings:
  - Desk audit: conducted from the auditor’s office.
  - Field audit: conducted at the taxpayer’s premises.
- Reassessment: a supplementary assessment indicating that the tax liability has changed compared to the initial assessment; can be initiated by the taxpayer or the tax administration; legally binding and represents the new tax liability owed.
- Criminal investigations: used when there is strong evidence of serious tax evasion or fraud; may lead to criminal prosecution; responsibility for investigations varies by country.

### Components of an Effective Audit Program
- Key areas tax administrations should develop capacity in:
  - Legal framework
  - Organization structure and governance
  - People
  - Tools
  - Systems
  - Performance measurement
- Figure 1.3 (Key Categories of an Effective Audit Program) summarizes process elements and supporting components:
  - Audit Process Phases (illustrated): Preaudit Planning → Interview → Conducting the Audit → Finalizing the Audit → Working Papers/Reports
  - Systems:
    - Case management systems
    - E–audit tools
  - Tools:
    - Case selection
    - Types of audits and verifications
    - Audit methods
    - Audit integrity
    - Audit quality review (AQR)
    - Random audit program
  - People:
    - Resources
    - Staff expertise
    - Auditor training
    - Auditor timekeeping
    - Auditor performance evaluation
    - Role of the audit manager
  - Organization and Governance:
    - Role of HQ
    - Taxpayer segmentation
    - Organization structure
    - Segregation of duties
  - Legal Framework:
    - Information gathering
    - Time to reassess a return
    - Other powers
    - Penalties
    - Third–party reporting
    - Dispute resolution
    - Voluntary disclosure
- Operational principle:
  - Use a differentiated approach that matches the response to the risk to be cost efficient and minimize compliance burden on compliant taxpayers.
  - Audit, being the most expensive treatment option, should be focused on the highest-risk taxpayers who do not intend to comply (for example, materially underreport tax obligations) and therefore present the largest risk to the tax base.
- Case selection:
  - An extension of CRM: CRM identifies compliance risks at a systemic level; case selection identifies individual taxpayers exhibiting that risk.
  - Cases identified by CRM are typically further reviewed by CRM staff to determine whether an audit is warranted.

*Source: CHAPTER 1. Compliance and the Role of Audit — THE AUDIT PROGRAM: VIRTUAL TRAINING TO ADVANCE REVENUE ADMINISTRATION: Reference Guide*

### CHAPTER 2.

### CHAPTER 2. The Legal Framework

### Information Gathering and Other Tax Administration Powers
- The chapter identifies a full range of legislative authorities needed to support the audit program and notes wide variations across countries; senior management should evaluate specific legislative authorities against provisions identified to identify gaps.
- If missing legislative provisions are considered important, the administration should develop a business case for submission to the Ministry of Finance to justify the provision and explain the impact.
- Figure 2.1 lists common legislative provisions for an effective audit program:
  - Power to obtain search warrants
  - Power to obtain information from third parties through court orders
  - Prescribed information
  - Right to inspect
  - Requirement to maintain financial books and records
  - Requirement to file a tax return
- Explanatory points on key provisions:
  - Requirement to file a tax return: under a self-assessment system, taxpayers are required to file if there is a tax liability owing, or they can choose to file a return if a refund is owed.
  - Requirement to maintain financial books and records: laws stipulate how and in what form financial books and records should be maintained (prescribed in regulations), how long the records should be kept, where they are to be kept, and in what language and currency.
  - Right to inspect: right to access taxpayer information and their premises to determine whether the correct tax payable has been declared.
  - Prescribed information: provisions on what information must be provided by the taxpayer with their return, along with the format that the information should be presented in.
  - Power to obtain information from third parties through court orders: used when provided information from banks and other financial institutions, suppliers, and clients needed to verify the reported income of a taxpayer is not shared by the taxpayer or available automatically from third parties.
  - Power to obtain search warrants: allows the tax administration conducting a criminal investigation to search the taxpayer’s business and personal properties to gain access to business and financial records to gather evidence of possible criminal offenses.

### Time Period to Reassess a Return
- Legislation generally documents the time frame the administration has to correct any errors or omissions in a taxpayer’s return (called a statute-barred date), which protects the taxpayer by limiting adjustments beyond a specific time frame.
- Beyond the statute-barred date, no adjustments can be made unless the law provides exceptions (e.g., fraud).
- The statute-barred date for most countries is between three and ten years.
- Some countries provide an extended statute-barred date for offshore transactions; the extension can be in the range of three to five years.
- Example given: A country with a three-year statute-barred period and a possible three-year extension, where offshore transactions are being reviewed, would have a total of six years to evaluate the taxpayer’s compliance with the country’s tax laws.

### Penalties
- Penalties support enforcement when taxpayers do not abide by legislative powers; penalties can be:
  - Either fixed or a percentage of the underdeclared tax or a combination of the two based on the country’s penalty policy; and
  - Levied on the taxpayer, on his/her agent, or on both.
- Table 2.1 — Types of Penalties and When They Are Used:
  - Penalty for failing to provide documents and information
    - Relates to the right to inspect provision. If information is requested by the auditor relating to the determination of correct tax payable and the taxpayer refuses to provide this information, s/he can be subject to a penalty for failing to provide the information.
  - Gross negligence penalty
    - Where the taxpayer was found to be grossly negligent (knew or ought to have known that the tax return was not correct or the definition in the tax administration’s legislation), then this penalty is applied to the additional tax assessed based on the audit results. Countries can vary in their definition of what constitutes gross negligence.
  - Late or non-filer penalty
    - Where a taxpayer is required to file a return on time but does it late or does not file at all, a penalty is generally imposed for the offense, which acts as a deterrent to future noncompliance.
  - Penalty for obstruction of tax officials
    - If an individual, whether a taxpayer or other person, seeks to circumvent the work of the tax official, then an obstruction penalty could be levied.
  - Penalty for assisting in making an incorrect tax return (agents)
    - Relates to the role of tax agents in filing improper returns. If it can be proven that an agent knew or ought to have known that a return was incorrect, the agent can be penalized in addition to the taxpayer. The taxpayer has the ultimate responsibility for the accuracy of a return, however, so the tax agent cannot be solely accountable.
  - Penalty for failing to withhold and remit tax
    - Related to legal obligations placed on third parties (e.g., employers and financial institutions) to withhold taxes at source and remit the withheld amounts to the government. Applies where a taxpayer employed staff and did not deduct and remit payroll deductions required by law, or to the collection of value-added tax (VAT), as both examples represent trust funds (government revenues), which do not belong to the taxpayer.
  - Penalty for destruction of records
    - Applies if the administration can establish that the taxpayer destroyed their business records in an attempt to avoid the determination of correct tax payable.
- Note: VAT = value-added tax.
- Many penalty regimes include graduated penalties for repeat offenders; the number of levels is determined by the country’s penalty policy, typically set by the Ministry of Finance or similar agency.

### Third-Party Reporting Obligations
- Tax administrations often collect data from third parties (e.g., financial institutions, customs, land registry, vehicle registry, regulatory body, and subnational governments) to manage compliance.
- Authority for collecting these data should be in legislation or in a memorandum of understanding (MOU), which also specifies the frequency and methodology of data transfer.
- These data are often referred to as bulk data, as they include all transactions undertaken with the data provider.
- Where no legal requirement or MOU exists for bulk data, administrations can still compel third parties to provide information on a specific taxpayer basis; this is most often used to obtain bank information regarding a specific taxpayer under audit.
- Purpose of obtaining third-party data: strengthen CRM processes and provide information for audit; CRM processes are only as good as the data being analyzed.
- To make full use of third-party data, tax administrations should have:
  - Protocols around the format of the data being received to ensure it can be read by the information technology (IT) system;
  - Sufficient storage to hold the data, including backups;
  - A repository where the data can be manipulated without changing the original data;
  - Data analysis software; and
  - Staff capacity in data analysis.

### Dispute Resolution
- Dispute resolution processes are a common legal provision; while separate from the audit function, they are important because of downstream impact from audits.
- Taxpayers need the right to an independent review of their case post audit because tax law is open to interpretation and facts can be misunderstood.
- Having dispute resolution processes makes the tax system fairer and improves voluntary compliance by allowing a second official to review the audit outcome and consider taxpayer concerns.

### Voluntary Disclosure Program
- Some tax administrations use a voluntary disclosure program (VDP) to enable taxpayers to correct their returns to avoid possible compliance actions by the tax administration in the future.
- A VDP allows a taxpayer who has made an incorrect return in the past to come forward and report and pay the correct amount of tax; main benefit is to avoid penalties and possible criminal prosecution if the incorrect tax amount is subsequently detected by the administration.
- The number of years that a taxpayer can apply for voluntary disclosure varies but can be up to ten years.
- The taxpayer must apply to the VDP, and the jurisdiction can accept or reject the voluntary disclosure. Country practice varies as to whether penalties and interest are waived with a complete voluntary disclosure, in the event the disclosure is accepted.
- Common criteria for an acceptable disclosure:
  - The information given under the disclosure must be complete and accurate;
  - The tax administration has not begun any compliance efforts related to the years in question;
  - The taxpayer must comply with the administration’s efforts to validate the information provided; and
  - The taxpayer must pay the outstanding tax liability in full at the time of the disclosure or submit a proposal to pay that is acceptable to the tax administration.
- Basis for the VDP can be administrative or legislative:
  - Administrative VDP: authority stems from ministerial discretion to waive penalties and interest, which is codified in the law; circumstances around when penalty and interest can be waived are contained in an administrative policy.
  - Legislative VDP: specific legislation provides the authority for the VDP.
- Some jurisdictions offer a “prompted” voluntary disclosure, where taxpayers can still apply for voluntary disclosure after initial contact by the administration to begin compliance actions.
- Summary statement: A VDP allows taxpayers to rectify past incorrect tax returns, potentially avoiding penalties and criminal prosecution, making it a valuable tool for promoting compliance.

*Source: CHAPTER 2. The Legal Framework*

### CHAPTER 3.

### CHAPTER 3. Organization and Governance

### Role of Headquarters
- Headquarters (HQ) is considered the brain of the administration; it sets strategic direction, develops strategies to achieve priorities, and monitors progress.
- Table 3.1 outlines typical HQ roles with descriptions:
  - Planning — Set the compliance strategy, prepare national work plans, and allocate resources to the regions and districts for the audit programs.
  - Manage compliance risks — Identify, assess, and prioritize compliance risks, and develop compliance improvement plans (CIPs) for the key risks.
  - Manage performance — Evaluate audit results, and compare against the plan established at the beginning of the year. Make in-year adjustments if required.
  - Develop national programs, policies, and procedures — Create audit-specific policies and procedures to ensure consistency across the country.
  - Ensure good governance — Ensure segregation of duties is in place, along with appropriate management approval processes for applying penalties. HQ should also manage the audit quality review (AQR) program, which evaluates audit quality based on comparing a sample of completed audits to identified audit standards.
  - Manage reforms — Reforms could be audit specific, or an audit may be impacted by the reforms of other functions within the tax administration. Managing this at the HQ level is necessary to ensure the reforms will continue to meet the program’s objectives.
  - Central control over field operations — Provide direction to audit teams across the country on expectations related to the type and number of audit activities expected during the year, as well as on audit policies and procedures.
  - Provide support services — Provide technical support to auditors on the interpretation of the law.
  - Analyze tax revenues — Evaluate revenue collection trends year over year. Analyze additional reassessments as a result of audit activities by tax type and taxpayer segment. Trace incremental revenue through the dispute resolution process to evaluate ultimate outcomes.
  - Manage relationships with stakeholders — Meet with industry associations and tax return preparers to discuss audit-related issues and to inform of administration policies. Address their concerns regarding audit processes or procedures.
- HQ activities should be organizationally separate and distinct from operational audit activities; HQ staff should not be engaged in audit operations.
- HQ activities require dedicated resources to ensure forward planning and monitoring are not crowded out by operational demands.

### Taxpayer Segmentation
- Taxpayer segmentation divides the taxpayer population into groups with similar characteristics to assess compliance risks as part of the CRM process.
- Segmentation supports comparisons within industries or similar businesses to identify potential noncompliance.
- Large taxpayers:
  - Large taxpayers often contribute more than 60 percent of the tax administration’s total tax collection.
  - Average LTO staff devoted to managing the compliance of large taxpayers is about 4 percent.
  - The large taxpayer segment often warrants a separate organizational unit(s) (Large Taxpayer Office, LTO) and assignment of the most experienced auditors.
- Common taxpayer segments include:
  - High-net wealth individuals;
  - Small and medium enterprises (SMEs);
  - Micro businesses; and
  - Nonbusiness individuals.
- Segmentation enables staff specialization by industry or taxpayer segment (for example, large taxpayers, high-wealth individuals, construction industry, banking), improving risk identification and audit efficiency.

### Segregation of Duties
- Segregation of duties is an internal control to minimize the risk of error or fraud and to ensure transparency and fairness.
- Good segregation of duties in the audit program requires separate persons responsible for:
  - Selecting the audit
  - Conducting the audit
  - Approving the audit outcome
  - Conducting the dispute resolution phase
  - Conducting the criminal investigation, if applicable
- Even in small administrations, efforts should be made to ensure each activity is conducted by a different person; physical separation is recommended if possible.
- Audit case approvals:
  - The immediate supervisor should approve proposed adjustments for every completed case.
  - Depending on the materiality of the additional tax assessment, a second level of review could be required at the managerial level (i.e., the supervisor’s supervisor) as determined by local policy.
  - Other situations requiring management approval may include application of a gross negligence penalty, obtaining taxpayer-specific data from third parties, and referral of the case for criminal investigations.
- Delegations of authority:
  - Delegations of authority are to a position, not a person.
  - Delegation does not follow the person if they change jobs.
  - Delegations should be carefully considered and documented internally via a formal letter outlining the nature of the delegated powers and when they are to be used.
  - Example: application of gross negligence penalties is often delegated to a senior manager, meaning the auditor cannot decide on their own that a penalty should apply.

### Organization Structure
- The audit function should be organizationally separate from CRM, audit case selection, dispute resolution, and criminal investigation functions to meet segregation of duties; ideally these functions should not operate within the same reporting structure.
- In very small administrations, separate teams should conduct these activities if separate reporting lines are not possible.
- Indicative function-based organization structure (mature model) elements:
  - HQ program design and CRM activities (including audit case selection) are primarily conducted within the program design and reform directorate.
  - LTO and other segments (included in regional and district offices) report to the deputy head, operations.
  - Criminal investigations divisions typically fall within the legal and international directorate.
  - In some countries the dispute resolution function reports directly to the tax administration head.
  - Regional offices deliver the audit program by conducting audits identified by CRM and according to HQ strategy.
- Centers of expertise:
  - Where volume permits, administrations can segregate workloads using centers of expertise specializing in certain industries or issues (examples: HNWIs, underground economy, aggressive tax planning).
  - Figure example: within each region there can be two centers of expertise—one for SME audits and the other for the underground economy—adapted to country risk priorities.
  - Justification for a center of expertise requires that material risks affect a significant number of taxpayers.
- Organizational design should be adapted to country circumstances and to the size of the administration.

*Source: CHAPTER 3.*

### CHAPTER 4.

### CHAPTER 4. People

### Resources — Number of Auditors
- Factors to consider when determining number of auditors:
  - Taxpayer attitudes toward compliance;
  - Experience gained from previous enforcement efforts, which should provide a sense of the extent of noncompliance; and
  - The degree of risk identified through the CRM process.
- Most advanced tax administrations allocate approximately 30 percent of their overall staff resources to their audit programs, with the balance allocated to registration, collection of tax, providing customer service to facilitate voluntary compliance, and administrative duties.
- Investing in CRM reduces the burden on audit teams for audit case selection and supports segregation of duties.
- Figure 4.1 shows the size of the audit function as a percentage of total staff across tax administrations (note: FTE = full-time equivalents).

### Span of Control
- Definition: number of staff each supervisor has reporting to them.
- Factors affecting span of control:
  - More complex work => lower recommended span of control.
  - More experienced auditors => higher possible span of control.
- Where auditors are inexperienced, a lower span of control allows supervisors to provide more hands-on support and shorten auditors’ learning curves.
- Recommended span of control: a range of four to eight auditors per team leader.
- Figure 4.2 provides a typical regional audit team organization chart.

### Staff Expertise
- General principle: resource different audit types with appropriate staff expertise.
  - Verifications: can be staffed by less experienced staff.
  - Complex audits: require more experienced staff.
- Verification work:
  - Staff often sourced from registration or customer service teams.
  - Required skills:
    - A good knowledge of the taxation issues to be verified;
    - Attention to detail and good communication skills; and
    - The ability to recognize when a case needs escalation to an audit or criminal investigation.
  - Some verifications (e.g., VAT refund claims) can involve significant tax amounts; inexperienced staff need supervision by experienced managers.
- Audit work:
  - Auditors must be equipped with a wide range of expertise and skills.
  - Auditors must balance respecting taxpayers’ rights with testing veracity of tax returns, sometimes using invasive powers.
  - Auditors must handle conflict and remain calm under pressure.
  - Required in addition to formal qualifications: accounting and, preferably, tax law knowledge.
  - Appendix 1 summarizes professional and operational competencies required of auditors.
- Large Taxpayer Audit (including HNWIs):
  - Specialization by large industry sectors yields efficiency gains and better revenue yields.
  - LTO and HNWIs teams should be staffed with the most experienced auditors and audit managers.
  - Required skills for LTO/HNWI teams:
    - Expertise to challenge advisers when necessary;
    - Deeper specialized knowledge about specific regulations for assigned segments (financial sector, government, natural resources, energy sector, etc.);
    - Specialist knowledge to recognize and tackle profit-shifting, transfer pricing, capital accumulation, anti-avoidance, and similar issues;
    - Ability to understand links between large taxpayers and controlling shareholders (often HNWIs).
  - LTO requires e-auditing skills (covered further in Chapter 5).
- Criminal Investigations:
  - Clear separation from the audit function is required.
  - Criminal investigators need:
    - Specialist training in criminal investigation techniques and high-level investigative skills;
    - Typically, experience as auditors plus skills to gather evidence proving criminal tax offenses beyond a reasonable doubt;
    - Witness training to serve as expert witnesses in judicial proceedings.

### Auditor Training and Mentoring
- A formal training program supported by mentoring is essential even when recruitment criteria include degrees in accountancy or similar professions.
- Auditors require training in:
  - Specific tax audit techniques;
  - IT, software applications, and computer-assisted audit tools and techniques (CAATs).
- Relying solely on on-the-job experience or auditors’ self-funded professional development is inadequate.
- Training should be supported by clear instructions: audit manuals, guidance on new legislative developments, updates on emerging identified risks, policy changes, and other knowledge management products.
- Instructions should be written in plain language with references to relevant legislation where appropriate.

### Auditor Timekeeping
- Auditors are expensive resources; prudent use of their time is critical.
- Key timekeeping concepts:
  - Applied time: cumulative number of hours an auditor spends undertaking all phases of the audit of a particular taxpayer.
  - Elapsed time: number of days from file assignment to date of completion.
- Auditors should record applied time by audit/verification to enable cost-benefit analysis comparing input costs (auditor salaries) to audit outputs (additional tax assessments) on a program-by-program basis.
- Electronic case management systems (CMS) facilitate applied time calculation; in paper systems, time recording remains important.
- Auditor timekeeping is important to:
  - Evaluate trends in applied and elapsed time across audit complexity levels;
  - Identify effective auditors for performance evaluation;
  - Help management evaluate program deliverables and assess return on investment (ROI).
- Operational guidance and behaviors:
  - Auditors should “audit to the risk” — focus only on identified areas of risk, not transactions with little or no risk of incorrect reporting.
  - Key actions for auditors and administrations (Box 4.1):
    - Auditors should continually undertake cost-benefit analysis comparing remaining compliance risks against time needed.
    - Conclude audits if cost to address risk equals or exceeds potential additional tax.
    - Be conscious of costs incurred by taxpayers under audit.
    - Extend or escalate audits only with team leader or audit manager approval.
    - Tax administrations should:
      - Oblige auditors to record time spent on audit work (planning, conducting, finalizing, report writing), preferably using a CMS;
      - Encourage closing nonproductive audits once tests indicate no significant risk;
      - Instruct auditors to switch to other audit work when time gaps appear and manage multiple audits simultaneously;
      - Ensure audit managers and team leaders oversee auditors’ timekeeping to keep most time spent on active audit work.
- Auditors with strong time-management and risk-analysis skills typically have higher numbers of completed audits and identify more additional tax.

### Auditor Performance Evaluation
- Operational managers and team leaders should collaborate with HR to define optimal competencies and performance indicators for audit staff; HR supports operational managers in managing auditor performance.
- Individual performance assessment should align with organizational performance so individual measures link to audit program performance and strategic objectives.
- Alignment structure (Figure 4.3): Individual Plans → Unit Plans → Divisional Plans → Segment Plans (LTO, etc.) → Audit Program Plan.
- Choose KPIs for auditors that reflect and contribute to overall audit program performance goals and measures.
- Key considerations in setting KPIs:
  - Only include KPIs that can be measured.
  - “What gets measured, gets done” — measurement shapes auditor behavior.
  - Avoid sole focus on additional tax assessed; include quality and fairness to taxpayers.
  - Performance measures often affect remuneration and career outcomes; credibility depends on perceived fairness.
  - Do not base individual auditor remuneration on additional revenue collected from completed audits to avoid promoting undesired behavior.
  - Treat errors by inexperienced auditors as learning experiences; do not penalize genuine errors.
  - Individual performance measurement should combine multiple measures, including team leader narrative assessment.
  - Individual targets should be agreed at the start of each year and detail numbers of each audit type to be completed (full scope, limited scope, single issue, team audit, verification).
  - Numerical targets for audits per auditor are best set by the audit manager based on:
    1. The complexity of the cases to be audited.
    2. The skills and experience of the particular auditor.
  - Progress reviews: year-end measurement with at least one interim progress review to reset targets if needed.
- Suggested KPIs for individual auditors:
  - Number of completed audits by audit type.
  - Expected strike rate: percentage of completed audits that identify additional liability (caution: low strike rate may indicate poor selection, need for training, or corruption).
  - Timely completion of audits: measured by age of oldest open audit and number of audits open for more than three months, six months, etc. (exercise caution; delays may be due to taxpayers).
  - Number of completed audits resulting in requests for internal administrative review or appeals (use judiciously; LTO/HNWI cases may generate more appeals).
  - Number of mentoring meetings held for auditors with mentoring roles.
- Key principle: use a range of indicators rather than a single measure to obtain an accurate picture of performance and promote desired behaviors.

*Source: CHAPTER 4. People, VIRTUAL TRAINING TO ADVANCE REVENUE ADMINISTRATION: Reference Guide*

### CHAPTER 5.

### CHAPTER 5.

### The Role of the Audit Program within CRM
- Compliance risk management (CRM) means taking a high-level view of all risks that might threaten a tax administration’s primary mandate of collecting the tax and duties for which it is responsible in accordance with the law and then deciding on treatment strategies that best address those risks.
- Findings from the CRM process are translated into a compliance improvement plan (CIP), which should identify the practical actions (treatment strategies) to address the identified risks.
- Audit (including verification) is one significant treatment strategy, primarily aimed at those who choose not to comply.
- CRM teams, audit case selection teams, and functional audit managers must work closely when developing the CIP.
- Recommended operational practice: host an annual compliance conference three months before the commencement of the fiscal year to harness HQ and frontline knowledge and allow time to draft and approve the next year’s CIP and regional audit plans.

### Case Selection
- Audit case selection should target the riskiest cases; avoid allowing external pressures to divert the process.
- Useful external inputs: bankruptcies, liquidations, cases identified by external bodies, complaints from citizens — these should feed into risk-analysis but not take precedence over risk-based selection.
- Principle of segregation of duties and accountability in decision-making must be observed.
- Many administrations are moving to centralized national case selection after CIP development at HQ to ensure nationally consistent, highest-risk selection.
- Risk of regional selection: inconsistency due to varying perceptions of “risky.”
- Hybrid case selection models (Figure 5.1):
  - Regional offices forward locally selected cases to HQ; some remain, others replaced by centrally selected higher-scoring cases.
  - Selecting all cases at HQ level but allowing regional offices to replace 25% with locally selected cases they consider riskier.
  - Centralized selection for most cases (e.g., 75%) while allowing 25% to be selected by regional offices.
  - Note: HQ = headquarters.
- Strong feedback loop from regional offices to HQ on the value of risk indicators is critically important; design a formal feedback system obliging auditors to comment on risk indicators.
- Audit case selection can be enhanced by establishing a random audit program (see Appendix 3).
- Table 5.1: Key elements of CRM and Case Selection
  - CRM:
    - Identification of current and emerging compliance risks
    - Informs strategic planning process, including resource allocation by prioritizing compliance risks by:
      - Ta x t y p e
      - Core tax obligations
      - Key segment and major sectors
      - Topical and emerging issues
    - Specific treatments captured in a CIP
  - Case Selection:
    - Strong corporate commitment to risk-based case selection
    - Central systems-driven process
    - Access to data sources to strengthen selection
    - Good analytics capability and tools
    - Fixed and flexible risk criteria to guide selection
    - Information on the effectiveness of existing audit interventions
    - Independent from audit delivery but with strong feedback from auditors
    - Provides for escalation and referral
    - Random audit generation to enhance selection and criteria
  - Note: CIM = compliance improvement plan; CRM = compliance risk management.

### Types and Scope of Audits
- Modern administrations use an assortment of audit methods with varying intensity:
  - Verification Check: phone calls or emails to clarify minor items.
  - Audit: desk or field audit for more comprehensive review.
  - Investigation: to identify possible criminal wrongdoing.
- International good practices for selecting audit/verification type:
  - Match type of audit/verification to the nature of identified risk.
  - Legislation should empower the tax administration to conduct inquiries using a variety of methods.
  - Include detailed guidelines in manuals and training resources for choosing appropriate audit types.
  - Allocate resources in a balanced way.
  - Monitor the ratio of audit types to ensure efficient coverage of identified risks.
  - Minimize large numbers of minor verification checks that contribute little to overall compliance management.
  - CRM and audit case selection teams decide on the nature of the audit type and inform the auditor accordingly.
- Appendix 3 provides additional information, including the purpose and benefits of a random audit program.

### Audit Methods
- Auditors should focus on identified risks and be familiar with various audit methods; interview and business observation during the audit may reveal additional risks.
- Two broad audit method types:
  - Direct methods:
    - Suitable where books and records can be relied on.
    - Audit compares tax return with business books and records to identify differences of fact or legislative interpretation.
    - Traditional method of auditing.
  - Indirect methods:
    - Appropriate where books and records cannot be relied upon (weak internal controls, many cash transactions, possible manipulation).
    - Indirect methods address unreported income or missing records.
    - It is generally recognized that indirect audit methods fall into six categories: benchmarking, cross-checking, bank deposit and cash expenditure, source and application of funds, percentage markup, and unit and volume.
    - Combination of indirect methods may be appropriate depending on business nature and identified risks.
- Indications that auditors should adopt indirect methods:
  - The taxpayer fails to maintain records.
  - Unexplained wealth or declared income that does not reflect the taxpayer’s standard of living.
  - Income recorded does not appear consistent with observed business activity (scale or types of products/services).
  - Taxpayer consistently declares losses or insubstantial income for an extended period.
  - Most business operations are in cash.
  - Documents incomplete, recordkeeping poor, and internal controls weak.
- Recommendation: auditors need skills in both direct and indirect methods and the judgment to select methods appropriate to circumstances.
- For more details on categories of indirect methods, see Appendix 4.

### Audit Integrity
- Management should focus on three areas to maintain audit integrity; training and line management guidelines should include oversight and monitoring processes to mitigate integrity risks.

- Case selection integrity:
  - Cases should be selected exclusively based on identified risks.
  - Use all available information (including tip-offs and local information) but ensure reasons for selection are risk-based, evidenced, and documented.
  - To ensure integrity:
    - Be cautious with citizen-provided information; test it using the tax administration’s risk-analysis procedures.
    - Never target a taxpayer for audit or verification for any reason other than part of an independent risk-based process.

- Finalizing the Audit Where the Taxpayer Does Not Agree:
  - Audit reassessments should always be fact based and supported by working papers and technical research.
  - Auditor should use professional judgment when facts are in dispute.
  - Two approaches to resolve taxpayer disagreement:
    1. Approach 1: Auditor assesses based on facts as understood by the auditor, without accepting taxpayer’s view; likely to lead to dispute resolution processes and potential overturning.
    2. Approach 2: Some administrations allow auditors to make a compromise to reach a reasonable conclusion representing actual tax payable; risks include susceptibility to corruption if taxpayer offers money to reduce assessment. If used, must include full transparency, proper management oversight, and be based on documented internal guidelines or manuals.
  - Each administration must weigh benefits and risks of both approaches.
  - Explicit prohibition: agreeing on a tax payable amount without conducting a thorough audit must not be condoned; such practice could enable payments to auditors to avoid revealing significant unreported income.
  - Any auditor offered a bribe should immediately report it to their supervisor.

### Delegation of Authority and Corruption Mitigations
- Where law permits delegation of authority, consider what is delegated and to which position to prevent corruption opportunities.
- Considerations include whether decision impacts multiple taxpayers and whether segregation of duties can be maintained.
- Delegation guidelines/procedures should be clearly documented and prohibit individual managers or auditors from transferring audit cases without sound, transparent reasoning and senior management approval.
- Suggested processes and systems to mitigate corruption:
  - Secure websites: some administrations offer secure websites where the taxpayer can check the veracity of the audit and the name of assigned auditor(s) to avoid risk of “fake” audits for bribery.
  - Random review of cases: in addition to normal approvals, many administrations randomly refer cases to the most senior management level to provide additional protection against corruption and keep senior management updated on real-time audit activity.

### Audit Quality Review (AQR)
- Goal: ensure audit governance and standard of conduct are consistent nationwide regardless of auditor or audit team.
- AQR defined: an independent assurance process conducted after audit conclusion to evaluate the audit against various standards to ensure consistency, correct application of law, and fair treatment.
- Box 5.1: Reasons to implement an AQR program
  1. Assure stakeholders, including the public, staff, management, and government that the tax administration is conducting a robust audit program, targeted at the riskiest taxpayers, while making optimum use of resources.
  2. Assure all stakeholders of the consistency of treatment in carrying out audits across all areas of the tax administration.
  3. Assist in the continuous improvement of the audit program by identifying and disseminating best practices and by identifying and eliminating weaknesses, all of which should ultimately lead to increased voluntary tax compliance.
  4. Assist in staff development by identifying and addressing training needs.
  - Note: AQR = audit quality review.

- Responsibility for AQR:
  - Everyone involved in audit programs/processes shares responsibility for quality.
  - Quality assurance for compliance programs is a matter for local and regional managers; each region should ensure an AQR standard policy is in place and operated fully and consistently.
  - Control and operation of AQR should be centralized at HQ level.

- Seven AQR Standards (Table 5.2):
  - Selection Standard: Measures whether all relevant steps were taken to identify the most appropriate case or risk for an audit during the screening and selection process.
  - Planning Standard: Measures whether the audit was planned within the appropriate scope, having regard to the issues/risks being examined.
  - Probing Standard: Measures whether appropriate probes were applied and completed to establish that substantially all taxable/dutiable items were reported and all refund claims were valid.
  - Recording Standard: Measures the quality of documentation for the audit, techniques used, procedures applied, and overall case activity.
  - Legislation and Policy Standard: Measures whether the conclusions reached were based on a correct application of the tax and duty legislation, regulations, and policy.
  - Timeliness Standard: Measures time usage and timeliness of actions throughout the audit process.
  - Customer Service Standard: Measures whether the taxpayer’s needs were promptly addressed, professional communications were used, and the audit was conducted under the terms of the tax administration’s customer service policy.
  - Note: AQR = audit quality review.

- Structure and operation of an AQR program:
  - Establish a small centralized, independent unit at the HQ audit division/directorate staffed by experienced auditors.
  - Annually select a statistically robust random sample of completed audits and check them against the seven standards.
  - Management should ensure AQR results are shared with audit teams and used to:
    - Address any common issues identified;
    - Inform CRM and audit case selection; and
    - Identify additional training requirements.
  - Typically, results are shared at the global level, outlining common errors rather than at individual auditor level.
  - Important principle: AQR should not be used to penalize auditors for genuine errors; it should be a vehicle to identify common issues requiring corporate remedies.

*Source: CHAPTER 5, vitara007ea - CHAPTER 5.*

### CHAPTER 6.

### CHAPTER 6. Systems

### Case Management Systems (CMS)
- Many tax administrations use electronic case management systems, or CMSs, to provide improved workflow management for auditors and managers.
- A fully functional CMS can greatly improve the efficiency of the audit program.
- Building a CMS should not be considered in isolation; conduct a holistic assessment of the tax administration’s IT systems’ existing status and future requirements and prioritize integration following an agreed road map.
- Ideally, a CMS will cater for the following:
  - Registration
  - Processing
  - Collection
  - Work automation
  - Workflow regulation
  - Audit case management
  - Risk analysis and treatment
- The CMS should provide staff with a comprehensive view of all taxes for each taxpayer and be capable of providing management reports.
- Timelines and costs:
  - It is unlikely that a CMS will be built and commissioned for use in less than three years.
  - The costs, even for a small country, are likely to be large.
  - It will take time to train staff to use it.
- Change management:
  - It is important that a change management strategy is designed early in the process to ensure a smooth transition from the old to the new.
- Appendix note:
  - A sample checklist for good IT support (CMS and other components) is provided in Appendix 5.

### Electronic Audit Tools (CAATs and SAF-T)
- Modern tax administrations use CAATs to conduct audits more efficiently (often referred to as “e-audits”).
- CAATs help auditors analyze large amounts of data; benefits vary by taxpayer size:
  - For small- and medium enterprises, the benefit may not be significant.
  - For large taxpayers, the software can be very helpful for data sorting and electronic analytical procedures.
- Hybrid forms of e-audit and continuous controls are employed worldwide; data collection is becoming increasingly real time and can be triangulated with trading partners, banks, and logistics providers.
- Pre-implementation considerations:
  - Tax administrations should evaluate the need for CAAT software and weigh it against the cost of procuring and maintaining these software programs (regular updates and maintenance fees will likely apply).
  - Each auditor should have their own powerful laptop and be adept at using standard functionality provided in the laptop and software programs.
- SAF-T:
  - Increasingly, many tax administrations are introducing the use of standard audit file for tax (SAF-T) for larger businesses, obliging businesses to maintain records in a standard format.
  - SAF-T facilitates auditors’ access to data in a readable format for substantive testing of system controls and data, increasing effectiveness and productivity in computer-assisted audits.
- Utility of CAATs:
  - Even without SAF-T, CAATs can contribute to more effective and speedier audits.
  - CAATs are particularly useful when auditing businesses with large numbers of transactions (e.g., retail, manufacturing, hospitality).
- Appendix note:
  - Appendix 6 summarizes (1) the types of CAAT tools and common functions of those tools and (2) useful features that can be identified using CAATs to spot noncompliance.

*Italic: Source — CHAPTER 6. Systems (vitara007ea - CHAPTER 6.)*

### CHAPTER 7. Performance Measurement

### Performance Measurement: Overview and Levels
- Definition: Performance measurement is the process of collecting and analyzing data and reporting on the performance of individuals, groups, or organizations.
- The three levels of performance management are strategic, operational, and individual staff member level, representing the hierarchy of the various levels being evaluated (Table 7.1).
  - Strategic: Has the administration been effective in reaching its desired strategic goals and outcomes (such as improving voluntary compliance)?
  - Operational: Has the administration been efficient in using its resources (inputs) in conducting its activities (such as audits) to deliver outputs?
  - Individual: Have individual staff members contributed to the achievement of the administration’s goals through the quantity and quality of their work?
- Goal setting and measurement direction:
  - Setting goals: top down (strategic → operational → individual).
  - Measuring results: bottom up (individual → operational → strategic).

### Elements of Performance Management (Inputs → Impact)
- Figure 7.1 elements:
  - Inputs: Represents the resources necessary to carry out the program’s activities.
  - Activities: Represents the program's activity(ies): taxpayer services, returns and payment processing, arrears management, disputes processing.
  - Outputs: Represents the immediate, normally tangible and easily measurable, results of the activities of the program: number of returns received, number and value of assessments, number of registrations.
  - Outcomes: Represents the change brought about by the program: taxpayer awareness, taxpayer understanding, taxpayer satisfaction, taxpayer compliance.
  - Impact: Represents the program's purpose: the taxpayer base is protected, and taxpayers pay their share of taxes.

### Example: Output and Outcome Measures for an Audit Program
- Desired Outcome: To promote voluntary compliance through taxpayer service and differentiated approaches to noncompliance to ensure a level playing field for all taxpayers.
- Activities to Achieve Outcome:
  1. Provide education on common errors for small businesses.
  2. Letters to taxpayers in a particular industry, pointing out common errors and inviting taxpayers to self–correct.
  3. Conduct audits of highest–risk taxpayers.
- Outputs from the Activities and corresponding measures/KPIs:
  - Education:
    - Output measures: Number of website clicks, number of requests for adjustments related to the particular issue that education was provided on.
  - Letters:
    - Output measures: Number of letters issued, number of taxpayers who self–corrected, number of taxpayers where follow–up was required and additional tax was assessed.
  - Audits:
    - Output measures: Number of audits completed, strike rate, amount of additional tax assessed, return on investment.

### Quantitative and Qualitative Measures (Table 7.3)
- Quantitative Measures (examples):
  - Percentage of audits completed against annual target.
  - Percentage of audits completed with a material change.
  - Percentage of additional tax assessed against the annual target.
  - Reduction in compliance gap over a certain time frame.
- Qualitative Measures (examples):
  - The perception of tax advisers representing taxpayers during audits related to the quality of the audit and professionalism of audit staff.
  - Taxpayer surveys about attitudes toward compliance.
- Materiality guidance:
  - Example: A reassessment of additional revenue of $1,000,000 in a company with a turnover of $10,000,000 would be considered significant, and therefore, material.
  - Example: A reassessment of $20,000 in a company with a turnover of $10,000,000 would not be considered material.
  - Consider the cost of processing the reassessment: if the cost is more than the additional tax being proposed, it would not be considered material.
  - Every administration should decide what is material in their context.

### Annual Operational Performance
- Operational performance evaluation should be at:
  - The program level (all of audit).
  - The segment level (e.g., large taxpayers).
  - The individual auditor level.
- ROI considerations:
  - At the program level, calculate total additional tax assessed and ROI, which compares the time taken to generate the additional revenue.
  - For ease of calculation, most administrations use auditor time (hours dedicated to the case multiplied by average auditor salary) to calculate ROI.
  - If calculations for all audit programs use the same methodology, results will be comparable.
  - ROI allows comparison among tax administration programs for resource allocation.
  - ROI can be conducted at the segment level if auditors record their time for individual cases.
  - Where countries do not have auditor timekeeping, ROI can be calculated as total reassessments for the fiscal year divided by the total cost of audit staff.
- Dispute resolution and finality:
  - It is beneficial to know the ultimate result of the audit reassessments after all dispute resolution processes have been exhausted.
  - If reassessments do not hold up in court, those amounts should not be counted in incremental revenue collection.
  - A KPI to track this would be done at a global audit level rather than at an individual auditor level due to time lags.
  - If a significant portion of audit assessments are reversed at dispute resolution, this may indicate auditors are making assessments without sufficient facts and legislation to support the adjustment.
  - Audit teams should be educated on types of assessments being overturned to avoid unsupported assessments.
- Outcome measures:
  - Ideally, establish outcome measures that track voluntary compliance trends over time (e.g., percentage of taxpayers who have their return adjusted decreasing over time for an issue the administration has been educating on).
  - A positive trend in the tax gap analysis is also an outcome measure.
  - Example outcome target: “reduce the compliance gap by x percent by 20xx.” This is typically a longer-term measure—over a period exceeding five years.

### Audit Indicative Performance Measurement Framework (Dashboard)
- Dashboard elements and KPIs to track (examples):
  - Trend analysis in tax collected based on tax type to give senior management a snapshot view.
  - KPIs tracked quarterly, divided by taxpayer segments (illustrative: large taxpayers and small and medium enterprises (SMEs)).
  - KPIs being tracked include:
    - Number of audits completed;
    - Total amount of reassessments;
    - Return on investment (annual, not quarterly);
    - Percentage of audits with a material change; and
    - Additional reassessments from the matching program (for the verification program).
- Additional dashboard criteria that could be added:
  1. An indicator to track whether reassessments were upheld on appeal; KPI could be reassessment confirmation rate, calculated as the total reassessments confirmed divided by the total reassessments.
  2. Average reassessment per taxpayer.
  3. Total reassessments divided by revenue collected.
- Trend analysis:
  - Evaluating three years’ worth of data can provide a sense of program performance.
  - With the same resources, tax administrations expect to see increased reassessments year over year; decreases warrant investigation.
- Quality monitoring:
  - Track results of the AQR program in the trend analysis section.
  - Management should be concerned with both additional revenue and audit quality.
  - Weak or declining quality can indicate training needs that can be addressed proactively.
  - Quality audits contribute to the sense of fairness citizens have about the tax administration.

### Availability of Data
- Data availability to populate the dashboard may be an issue.
- If the administration’s IT system cannot produce the full range of data, start with available data and plan to strengthen reporting processes in the IT system.
- Performance data is critical to management decision-making.
- A manual calculation may be possible if completed audit data can be downloaded into a spreadsheet.

### Tax Gap Analysis
- Tax gap studies estimate the gap between the total tax paid and the total tax expected to be paid, reporting on the extent of inaccurate reporting.
- The gap is segregated into:
  - Policy gap: relates to tax not collected due to policy decisions or gaps in the law (administration has no control).
  - Compliance gap: calculates the amount of tax not collected due to noncompliance (administration has more control).
- Uses of tax gap analysis:
  - Identifies which industry sectors contribute most to the tax gap—important for risk assessment.
  - Over time, administrations should seek to reduce the compliance gap through more efficient audits, better trained staff, and better risk targeting, resulting in additional tax assessed.
  - Additional tax and indirect audit impacts should increase overall levels of compliance.
  - A possible outcome measure: “reduce the compliance gap by x percent by 20xx.” This is typically a longer-term measure—over a period exceeding five years.
- Note:
  - More effective audits may contribute to the reduction of the compliance gap, as can better taxpayer services and education.
  - Changes in the compliance gap can be caused by multiple factors that need careful analysis and corroboration before definitive conclusions are made.

*Italic: Source — CHAPTER 7. Performance Measurement (vitara007ea - CHAPTER 6. and CHAPTER 7. excerpts)*

### CHAPTER 8.

### CHAPTER 8. The Audit Process

### Overview of the Audit Process
- Note: CRM = compliance risk management.
- Summary of sequential steps in the audit process:
  - Preaudit planning
  - Notify taxpayer
  - Initial interview and tour of premises
  - Examine records and, conduct audit tests
  - Conduct clarification interviews if necessary
  - Take notes to record interactions with the taxpayer
  - Final interview and presentation of findings (with explanation and evidence)
  - Seek agreement and, advise taxpayer of right to appeal
  - Seek payment or, reassess
  - Seek approval for audit outcome
  - Provide feedback to the CRM/Case Selection Team
- Key process points:
  - All steps are important; none should be eliminated, or the risk of not identifying compliance risks will increase.
  - The auditor should conduct their own more in-depth analysis of available information in addition to information from CRM and audit case selection teams.
  - The taxpayer should be notified in writing two to three weeks in advance and be provided with all necessary information about the audit.

### Preaudit Planning and Taxpayer Notification
- Preaudit planning responsibilities:
  - Review the tax return for large, unusual, and questionable items beyond those selected during the risk assessment process.
  - Review data held by the tax administration (prior audit results, history of compliance, etc.).
  - Conduct an analysis of international transactions.
  - Review transactions between related taxpayers.
  - Check for tax avoidance issues.
  - Identify specific risks inherent in the sector that the taxpayer operates in.
- Additional planning considerations:
  - Include analysis of the tax affairs of proprietary directors or owners where appropriate.
  - Consider preaudit visits (surveillance or anonymous purchases) if required.
  - Determine whether specialist expertise is needed.
  - If CAATs will be used, determine if electronic records need to be downloaded in advance.
- Taxpayer notification details (recommended inclusion in written notice, two to three weeks in advance):
  - The legal basis for the audit
  - The period(s) being audited
  - Scope and type of audit
  - Tax type under audit
  - Names of auditors
  - What records are expected to be available to the auditor on the first day of audit (including business and personal banking information, and the agent’s working papers/linking papers)
  - Where the audit will take place (usually at the business premises) and that the business owner should be present
  - If a system of reduced penalties for early voluntary disclosure exists, explain that process

### Managing Audit Delays
- Taxpayer anxiety and preparation:
  - A well-worded written notification can relieve taxpayer fears and increase likelihood that necessary records will be available at the start of the audit.
  - Notifying the taxpayer and their agent in writing two to three weeks in advance minimizes the risk of requests for postponement.

### Conducting Audits — Interviewing and Information Gathering
- Purposes of the initial interview:
  - Hear directly from the taxpayer about important aspects of the business and transactions.
  - Explore how the taxpayer generates income and how records are maintained.
  - Explain the audit process, summarize rights and obligations, and explain the basis for selection.
  - Ensure all necessary records are available for examination early in the audit.
- Interview success factors:
  - Auditor focus, preparation, technique, and skill.
  - Use of the correct mix of interview questions to gather information and establish rapport.

### Managing the Audit (Time, Method, Communication)
- Time and cost-benefit:
  - Time needed varies with audit type, complexity, and number of identified risks.
  - Auditors should utilize time necessary to address material risks while applying an ongoing cost-benefit analysis: “If I spend another x hours, what will be the likely additional tax generated?”
  - Averages can be developed over time as guidelines but should not become hard targets.
  - Auditors should discuss progress with team leaders and use additional time when significant risk is present.
- Audit method selection and communication:
  - Audit managers should guide auditors to select the best audit method to address identified risks.
  - Auditors must keep taxpayers informed about audit progress and potential adjustments through regular communication.
  - Interim interviews may be used to clarify matters discovered during the audit.

### Working Papers and Report Writing
- Requirements for working papers and reports:
  - Maintain comprehensive working papers.
  - Write reports in a style understandable to a non–tax expert; reports may be read by senior managers, internal and external reviewers, and court judges.
- The report must:
  - Clearly set out reasoning for any proposed additional liabilities and support them with documentary evidence and working papers.
  - Fairly describe the taxpayer’s and the taxpayer’s agent’s views and counterarguments, if any.
  - Document the risks identified and the techniques and tests employed to assess them.
  - Reference audit findings to the relevant legislative provisions relied on to make the reassessment.
- Retention and feedback:
  - The report and working papers should be retained until the audit, any appeal or review, and all collection matters are finalized or until the country’s statute-barred period for retention of records has passed, whichever is later.
  - The auditor should provide feedback on the value or appropriateness of risks identified by CRM and case selection teams and highlight additional risks not identified earlier to assist CRM development.
  - If the taxpayer has outstanding debts, include information useful to the collection team (existence of assets, bank account locations).

### The Approval Process
- Supervisory review and approval:
  - The tax administration should have a supervisory review system at finalization to ensure compliance risks were addressed and conclusions are consistent with the law.
  - The review process should be tiered with levels of approval required based on criteria such as:
    - The materiality of the adjustment
    - If penalties are being applied
    - Sensitive taxpayer audits (high-profile taxpayers, controversial issues, media scrutiny)
    - If the issue affects multiple taxpayers
  - Some administrations randomly select audit cases for approval at the highest management level to guard against underreporting of assessments to avoid scrutiny.
- Policies and reassessment:
  - Written policies should document approval criteria and associated management approval levels.
  - Once approval is obtained, a reassessment is made to adjust tax payable to reflect audit results.

*Source: vitara007ea - CHAPTER 8.*

### Appendix 3. Type of Audit or Verification

### Appendix 3. Type of Audit or Verification

### Factors to consider when choosing audit or verification type
- How much tax is at risk?
- What taxes are involved?
- What period(s) are involved?
- Can the identified risks be checked from my office, without the need for examining records on the taxpayer’s business premises?
- Can the identified risks be checked without interviewing the taxpayer?
- Do the identified risks apply to a group of taxpayers or a particular business sector?
- Do the identified risks indicate possible serious tax evasion or fraud?
- Legislative provisions or constraints

### Types of audit checks
- Verification Checks
  - Simple assurance checks to verify or clarify an item or items on a tax return or a refund claim.
  - Usually conducted by phone call, email, or letter; sometimes by requesting supporting documentation.
  - Should be possible to determine validity quickly; otherwise escalate to desk or field audit.
  - Often used to check VAT refund claims.
  - Example traffic-light categorization for VAT refund claims:
    - Green: Repay immediately.
    - Orange: Conduct verification check. If a case fails the verification check, it may be escalated to an audit.
    - Red: Conduct desk or field audit.
  - Alternative traffic-light labels: low risk, medium risk, and high risk.

- Desk Audits
  - Conducted at the tax office when necessary information can be ascertained in-office.
  - Taxpayer may be asked to reply to queries and supply additional documentation or attend the tax office for interview.
  - Suitable only if no need to inspect business premises, check stock levels, or view prime business records in situ.

- Single (or Specific) Issue Audits
  - Focus on a single tax type, single issue, or single tax period.
  - Usually take less time than a full or comprehensive audit.

- VAT Refund Audits
  - Used to verify entitlement to a refund prior to processing.
  - Usually undertaken for the taxpayer’s first refund claim and where refund varies significantly from established patterns and trends.
  - Audit should focus on the specific reason for the refund and not widen inquiry unless serious additional risks identified.
  - Time pressure to process VAT refund promptly; audit needs prompt handling.

- Comprehensive (or Full) Audits
  - Cover all tax obligations; period usually the most recent financial year.
  - Period may be broadened if serious wrongdoing is identified.
  - Time consuming; should be applied only when indication of underreporting or other risks affecting multiple taxes.

- Audit Projects
  - Organized as a separate project for specific groups of taxpayers (e.g., industry, line of business, or specific declaration items) to address particular risks or establish degree of noncompliance.

- Reaudits
  - Second audit when first audit uncovered significant noncompliance.
  - The second audit usually takes place two to three years after the first one is completed and focuses on the most recent year or period.
  - Useful for measuring impact of audit program on compliance outcomes and deterring post-audit noncompliance.

- Random Audits
  - Statistically robust sample of taxpayers selected at random and included in comprehensive audit program.
  - Benefits:
    - Identify gaps in risk-management process.
    - Measure the tax gap using a bottom-up approach.
    - Act as a deterrent (anyone could be selected).
    - Gain understanding of compliance behavior and trends.
    - Assist with measuring overall compliance, including measurement of the audit gap.
  - Downsides:
    - Fully compliant taxpayers subjected to the expense of dealing with an audit.
    - Opportunity cost; auditors could be conducting risk-driven audits instead.

- Criminal Investigations
  - Required when there is evidence of serious tax evasion.
  - Conducted by specially trained criminal investigators; process should be separate from audit process.
  - Very time consuming, often taking years to complete.
  - Auditors should contact the tax administration’s criminal investigation team (or statutory body such as police) if serious evasion suspected.
  - Continuing an audit after belief that serious evasion occurred may damage possibility of criminal prosecution.

### Appendix 4 — Six Indirect Audit Methods (summary)
- Benchmarking (comparing with other similar businesses to determine whether there are any outliers).
- Cross-checking (difference between taxpayer’s assets at the beginning and end of a period, compared to his/her income). Also known as net worth or asset betterment method.
- Bank deposit and cash expenditure (if deposits plus expenditure exceeds declared income, an explanation is necessary).
- Source and application of funds (like no. 3 but focused on identifying expenditure that cannot be explained by looking at the tax return).
- Percentage markup (applying standard markups to purchases to identify undeclared sales or exaggerated purchases). Closely related to no. 6.
- Unit and volume (applying price and profit figures to the known business volume). Closely related to no. 5.
- Note: Depending on the business, a combination of methods may be required.

### Appendix 5 — CMS Checklist of Requirements
- Core CMS capabilities:
  - Conduct financial analysis of declaration/return forms and other data to automatically select cases for audit and manage all types of workflow for an individual case.
  - Prioritize cases to be created and allocated using predetermined risk assessment criteria.
  - Electronically assign cases by a supervisor to case officers and maintain an inventory of cases by team and division.
  - Record case details at the time of case selection.
  - Record reassessment details and update taxpayer account.
  - Display other cases involving the same taxpayer.
  - Record actions taken and date of actions.
  - Record time lapsed from commencement to completion and maintain status of case: pending, closed, and so on.
  - Generate standard letters and notices.
  - Provide easy access to technical notes and manuals.
  - Notify supervisors if cases are not being resolved in a timely manner.
  - Retain and retrieve case history, indexed by the taxpayer identification number.
  - Generate management information for cases created, cases closed, cases still outstanding, elapsed time for actions, results of audits, success rate of audit cases selected, changes to selection criteria.
  - Provide information for the preparation of the annual audit work plan.

- Other desirable features:
  - Provide tools to assist with audit activities (e.g., software to analyze taxpayer accounting records, links to third-party information and reference material, ability to work remotely from a taxpayer site).
  - Maintain an audit trail of access to system compartments/groups of taxpayers, controlled by role-based security permissions, if possible linked to the HR system.
  - Update risk data according to outcomes of audit.

- Analytical capability should:
  - Receive and assemble data from multiple sources (including customs data).
  - Cater to multiple views of data with multi-indexing capability.
  - Provide analysis tools for risk assessment, trend analysis, “what-if ” scenario analysis, and so on.
  - Generate predefined reports.
  - Respond to requests for ad hoc reports and analysis.

### Appendix 6 — CAAT Tool Features and CAAT-identified noncompliance indicators
- CAAT tools include Audit Command Language (ACL), International Data Encryption Algorithm (IDEA), Excel, Access, and Structured Query Language Server (SQL).
- Common functions:
  - Data queries
  - Data stratification
  - Sample extractions
  - Missing sequence identification
  - Statistical analysis
  - Calculations
  - Duplicate transaction identification
  - Pivot table creation
  - Cross tabulation

- CAATs can identify features that indicate possible noncompliance:

  - Payroll
    - Identification of ghost employees (i.e., not genuine)
    - Employees who are registered as suppliers
    - Employees with multiple pay slips in a month
    - Recalculate pay slip totals
    - Agree pay slips to general ledger
    - Employees paid after their leave date
    - Duplicate employees

  - Expenses
    - Excessive claims
    - Unauthorized merchants
    - Application of Benford’s law
    - Spend above approved limits

  - General ledger and journals
    - Unusually large postings just prior or after year-end
    - Journals posted during the night or on weekends
    - Profile of journals by type, user, time of day, day of week, and so on
    - Application of Benford’s law
    - Accounts used once or infrequently

  - Fraud
    - Searching for fictitious suppliers
    - Searching for unusual payments (e.g., round-sum amounts)

  - Sales and accounts receivable (AR)
    - Creation of aged debtors report
    - After date cash testing
    - Exceeding credit limit
    - Unusual AR transactions

  - Purchasing and accounts payable (AP)
    - Identification of duplicate payments to suppliers
    - Identification of suppliers sharing the same bank account details
    - Unusual AP transactions

  - Stock
    - Testing calculation of net realizable value (NRV)
    - Negative stock quantities

  - Fixed assets
    - Testing calculation of depreciation to ensure it is in line with policy
    - Cash value of register to confirm completeness and accuracy

  - Data quality
    - Identification of blank data fields
    - Identification of nonuniform entries (i.e., noncompliance with required format)

- Note: AP = accounts payable; AR = accounts receivable; NRV = net realizable value.

*Source: Appendix 3. Type of Audit or Verification (vitara007ea); ISBN 9798400290145.*

---


_Source: https://www.imf.org/-/media/files/publications/manuals-and-guides/2025/english/vitara007ea.pdf_