## tnmea2022005 — Section 1 and Section 2

## Source details

**Canonical URL:** [tnmea2022005 — Section 1 and Section 2](https://www.imf.org/-/media/files/publications/tnm/2022/english/tnmea2022005.pdf)

## Other formats

- [Markdown version](/-/media/files/publications/tnm/2022/english/tnmea2022005.pdf.md)
- [Structured JSON version](/-/media/files/publications/tnm/2022/english/tnmea2022005.pdf.json)

---

### I. Introduction to CRM and Its Role in Revenue Mobilization
- CRM (Compliance Risk Management) is a methodology used to identify compliance risks within the taxpayer population and to optimize revenue collection by focusing resources on the highest risks to the tax base.
- Primary objective of tax administration: collect revenues on behalf of government to fund the country’s social and economic goals.
- Compliance defined: the degree to which taxpayers meet their obligations—registration, on-time filing, correct reporting, and on-time payment (the four pillars of compliance).
- CRM ensures all four obligations are incorporated into risk assessment and categorizes risks by likelihood (high, medium, low) across each pillar.
- CRM is an end-to-end approach that tailors treatments to the degree and nature of noncompliance; it is much more than audit case selection.
- Treatments fall into three categories:
  - Preventative (e.g., education, reminders of filing deadlines)
  - Facilitative (e.g., pre-filling of returns, industry-specific guidance and opportunity to self-correct)
  - Enforced compliance (e.g., audits, investigations, penalties)
- Segmentation is the starting point for effective CRM (e.g., large, medium, small; industry sectors; other lenses).
  - Footnote: segmenting taxpayers by gender, size, or industry sector is an example.
- Key benefits of CRM:
  - Increased fairness and trust in the tax system by using differentiated approaches and addressing egregious noncompliance.
  - Development of a single institutional view of a taxpayer’s level of compliance (noncompliance often extends across most or all pillars).
  - More effective use of limited resources through better understanding of causes of noncompliance.
  - Optimizing revenue collection by targeting the most serious noncompliance rather than lower-producing activities.
  - Better ability for tax administration leaders to identify issues, report to government, and link identified compliance risks to allocated resources, improving both efficiency and effectiveness.

### II. The CRM Process
- The OECD CRM process (Source: OECD Guidance Note. 2004) consists of eight steps and is structured and repeatable; it should be repeated at least annually or more often if the operating context changes.
- The CRM process can be applied in both advanced economies and developing countries; complexity depends on IT modernization and staff capability.
- The eight steps of the OECD CRM Process:
  - 1. Operating context
  - 2. Identify risks
  - 3. Assess and prioritize risks
  - 4. Analyze compliance behavior (causes, options for treatment)
  - 5. Determine treatment strategies
  - 6. Plan and implement strategies
  - 7. Monitor performance against plan
  - 8. Evaluate compliance outcomes
- Brief descriptions of key steps:
  - Operating context: evaluate internal and external environment (staff numbers and capability, level of digitalization, organizational arrangements, state of the economy, legal framework, public attitudes).
  - Identify risks: use available data to identify patterns and trends of noncompliance across the four pillars; segmentation is the first step.
  - Assess and prioritize risks: common methodology is a matrix comparing likelihood with consequence/impact on the tax base to inform treatment decisions.
  - Analyze compliance behavior: distinguish intentional noncompliance (evaders) from unintentional noncompliance (misunderstanding, ignorance); prefer cost-effective measures (education, assisted compliance) where appropriate.
  - Determine treatment strategies: develop a Compliance Improvement Plan (CIP) for each priority risk, typically combining preventative, facilitative, and enforced components; CIPs often designed by segment or industry.
  - Plan and implement strategies: operationalize CIPs by specifying activity volumes nationally and regionally/district-level.
  - Monitor performance against plan: regularly monitor regional and district results to report performance to management and assess success.
  - Evaluate compliance outcomes: evaluate impact of CIPs on measures such as additional tax collected and longer-term outcomes like improved on-time filing or payment rates.

### III. The CRM Framework: How CRM Fits in the Broader Tax Administration Process
- The CRM Framework shows how CRM affects virtually every part of tax administration and how CRM outputs drive operational workloads.
- Two dimensions of the CRM Framework:
  - Horizontal: inputs to and outputs from the CRM process.
  - Vertical: how CRM links to other critical tax administration functions.
- The CRM framework is driven by the administration’s strategic goals and objectives; strengthening compliance is often a key strategic objective.
- Central responsibility reiterated: ensure all taxpayers pay the correct amount of tax under the law to maintain trust in the tax system and meet government social and economic goals.

### CRM Organization Structure and Governance
- Organization and core responsibilities
  - A dedicated unit or team to manage the CRM process is key for most administrations; adaptations may be appropriate for very small or very large organizations.
  - Dedicated staff with required skillsets will position the tax administration to produce better results from CRM activities; the number of staff depends on the administration’s data availability and staff capability.
  - Key activities the CRM unit will lead:
    - (1) analyzing the internal and external environment;
    - (2) analyzing the current tax administration data for indications of noncompliance;
    - (3) collaborating closely with risk owners, who are the business line leaders for the various tax functions;
    - (4) working collaboratively with risk owners to develop treatment strategies for the identified risks; and
    - (5) developing CRM methodologies and practices and documenting them for future reference.
  - Placement: should be a central Headquarters (HQ) function located within a program planning and design function responsible for strategy and guidance to operational units.

- CRM governance and committee
  - Good governance is required because CRM affects all functions (taxpayer service, registration, filing, correct reporting, payment) and all taxpayer segments (large, medium, small taxpayers); coordination is necessary.
  - A CRM Committee should be established to aggregate CRM intelligence and facilitate management decision-making on priority risks.
  - Typical committee composition and cadence:
    - Chaired by the most senior leader (term used in the note: Director).
    - Representatives: senior executives in charge of the CRM unit and the risk owners (Department heads).
    - Meeting frequency: typically quarterly, or at least twice per year, to:
      - evaluate progress in addressing existing risks;
      - confirm whether existing risks are still the highest priority risks for treatment;
      - identify any emerging risks in the tax system;
      - approve—on an annual basis—the compliance improvement plans (CIPs) for the upcoming year, including resource allocations aligned to the treatments identified;
      - provide guidance to the CRM unit as required;
      - review the performance results of the various treatment strategies and adjust as required.
  - The CRM unit is responsible for maintaining and providing updates to the Compliance Risk Register (CRR) to the CRM Committee regularly.

### Annual Operational Plans, Performance Measures, and Funding
- The Compliance Improvement Plan (CIP) is a key CRM output and includes details on the type and number of treatments to be conducted.
- Accumulated CIP information enables allocation of work among HQ and operational units in regions and districts.
- Workload and resource allocation should be done annually with sufficient lead time for regional and district planning.
- Monitoring performance results for all treatments throughout the financial year is critical to evaluate success and compare CRM-based results to prior results.
- Evaluation feeds back into the CRM cycle: expand treatments that produced good results; consider different treatments where results were not achieved.
- Performance results can support requests to government for additional funding; example metric cited: when the administration demonstrates that for every $1 invested it collects, for example, $4 or $6 in additional revenue, a stronger argument can be made for additional resources.

### Inputs to the CRM Process
- Five highlighted inputs: Data and Data Management; Information Technology to support CRM; Business experts and CRM specialists; OECD CRM Process; Risk Practices and Tools.
- Implementing CRM is a journey; start with available inputs and build capabilities over time.

- Data and Data Management
  - Tax returns and other declarations are important data sources; external sources include banking data, company registry information, and customs import/export information.
  - Caution: more data are not always better—having the right data and sufficient IT/capability to use data is more important.
  - Data matching is a practical starting technique; a common identifier (e.g., Taxpayer Identification Number) enables matching across sources (example: comparing customs data to tax declarations).

- Information Technology support for CRM
  - Degree of automation varies by country; simple tools (e.g., Excel) can support initial analysis and matching.
  - As CRM matures, automate matching processes and deploy tools such as statistical analysis, outlier detection, pattern recognition, data mining, and machine learning; tools can be externally sourced or developed in-house.
  - IT functionality should be increased as resources and capabilities permit.

- Business experts and CRM specialists
  - New staff skillsets are required: data analysis, pattern recognition, identifying outliers; develop training paths for CRM unit staff.
  - Business knowledge from audit and taxpayer service staff (recurring noncompliance patterns, common taxpayer questions) is critical intelligence to capture and share with the CRM unit.
  - Collaboration between CRM unit and risk owners yields synergy not possible individually.

- Risk practices and tools
  - Methodologies for assessing and prioritizing compliance risks include likelihood and consequence matrices; determine risk tolerances and document evaluation criteria for objectivity and consistency.
  - Tax-GAP analysis is a measurement tool to identify policy and compliance gaps, often conducted for the Value-Added Tax; it can identify industry sectors with higher shares of the compliance gap and track downward trends after treatments.
  - Other analyses: studies using administrative data and randomized controlled experiments (example: random audit programs) to estimate revenue leakage and measure impacts of risk-based approaches.

### Outputs from the CRM Process
- Key outputs: Intelligence/Profiles/Scans/Studies; Compliance Risk Register (CRR); Compliance Improvement Plans (CIPs).
- Intelligence, profiles, scans, and studies:
  - Industry profiles document key areas of risk and mitigation approaches (example: construction sector revenue recognition methodologies).
  - Studies evaluate risk hypotheses and pilot project results, feeding back into CRM.
  - Understanding underlying causes of noncompliant behavior enables treating causes (e.g., education if noncompliance stems from misunderstanding of law).
- Compliance Risk Register (CRR):
  - Records important compliance risks and assigned risk ratings; updated regularly as risks or ratings change.
  - CRM unit maintains the CRR and provides updates to the CRM Committee.
- Compliance Improvement Plans (CIPs):
  - A separate CIP is required for each risk approved by the CRM Committee for mitigation.
  - CIPs target taxpayer segments or industries and rate risks across registration, filing, correct reporting, and payment as high, medium, or low.
  - Treatments should range from preventative to facilitative to enforced compliance.
  - Purpose: overcome siloed approaches by considering interdependent impacts across taxpayer obligations.

### Implementation Considerations and Practical Guidance
- CRM supports revenue mobilization by targeting voluntary compliance promotion and addressing highest noncompliance risks methodically.
- Clarity on organizational roles and responsibilities and collaboration across units strengthen results.
- Avoid under-resourcing CRM: administrations are advised to start with a small team of two or three staff and build as workloads grow.
- The model presented represents a mature end-state; for early-stage adopters:
  - Use available data to understand taxpayer population and begin matching.
  - Use pilot projects to test anomalies and matching discrepancies.
  - Incorporate lessons learned into subsequent analyses to improve results.
  - Engage development partners to strengthen capacity where appropriate.
- Concurrently strengthen people, systems, tools, data, and legal frameworks as CRM capability grows.

*Prepared by Susan Betts, IMF Fiscal Affairs Department; IMF Technical Notes and Manuals 2022/005.*

### Section 1

### tnmea2022005 - Section 1

### I. Introduction to CRM and Its Role in Revenue Mobilization
- CRM (Compliance Risk Management) is a methodology used to identify compliance risks within the taxpayer population and to optimize revenue collection by focusing resources on the highest risks to the tax base.
- Primary objective of tax administration: collect revenues on behalf of government to fund the country’s social and economic goals.
- Compliance defined: the degree to which taxpayers meet their obligations—registration, on-time filing, correct reporting, and on-time payment (the four pillars of compliance).
- CRM ensures all four obligations are incorporated into risk assessment and categorizes risks by likelihood (high, medium, low) across each pillar.
- CRM is an end-to-end approach that tailors treatments to the degree and nature of noncompliance; it is much more than audit case selection.
- Treatments fall into three categories:
  - Preventative (e.g., education, reminders of filing deadlines)
  - Facilitative (e.g., pre-filling of returns, industry-specific guidance and opportunity to self-correct)
  - Enforced compliance (e.g., audits, investigations, penalties)
- Segmentation is the starting point for effective CRM (e.g., large, medium, small; industry sectors; other lenses). Footnote: segmenting taxpayers by gender, size, or industry sector is an example.
- Key benefits of CRM:
  - Increased fairness and trust in the tax system by using differentiated approaches and addressing egregious noncompliance.
  - Development of a single institutional view of a taxpayer’s level of compliance (noncompliance often extends across most or all pillars).
  - More effective use of limited resources through better understanding of causes of noncompliance.
  - Optimizing revenue collection by targeting the most serious noncompliance rather than lower-producing activities.
  - Better ability for tax administration leaders to identify issues, report to government, and link identified compliance risks to allocated resources, improving both efficiency and effectiveness.

### II. The CRM Process
- The OECD CRM process (Source: OECD Guidance Note. 2004) consists of eight steps and is structured and repeatable; it should be repeated at least annually or more often if the operating context changes.
- The CRM process can be applied in both advanced economies and developing countries; complexity depends on IT modernization and staff capability.
- The eight steps of the OECD CRM Process:
  1. Operating context
  2. Identify risks
  3. Assess and prioritize risks
  4. Analyze compliance behavior (causes, options for treatment)
  5. Determine treatment strategies
  6. Plan and implement strategies
  7. Monitor performance against plan
  8. Evaluate compliance outcomes
- Brief description of key steps:
  - Operating context: evaluate internal and external environment (staff numbers and capability, level of digitalization, organizational arrangements, state of the economy, legal framework, public attitudes).
  - Identify risks: use available data to identify patterns and trends of noncompliance across the four pillars; segmentation is the first step.
  - Assess and prioritize risks: common methodology is a matrix comparing likelihood with consequence/impact on the tax base to inform treatment decisions.
  - Analyze compliance behavior: distinguish intentional noncompliance (evaders) from unintentional noncompliance (misunderstanding, ignorance); prefer cost-effective measures (education, assisted compliance) where appropriate.
  - Determine treatment strategies: develop a Compliance Improvement Plan (CIP) for each priority risk, typically combining preventative, facilitative, and enforced components; CIPs often designed by segment or industry.
  - Plan and implement strategies: operationalize CIPs by specifying activity volumes nationally and regionally/district-level.
  - Monitor performance against plan: regularly monitor regional and district results to report performance to management and assess success.
  - Evaluate compliance outcomes: evaluate impact of CIPs on measures such as additional tax collected and longer-term outcomes like improved on-time filing or payment rates.

### III. The CRM Framework: How CRM Fits in the Broader Tax Administration Process
- The CRM Framework shows how CRM affects virtually every part of tax administration and how CRM outputs drive operational workloads.
- Two dimensions of the CRM Framework:
  - Horizontal: inputs to and outputs from the CRM process (see Sections IV and V in the source).
  - Vertical: how CRM links to other critical tax administration functions.
- The CRM framework is driven by the administration’s strategic goals and objectives; strengthening compliance is often a key strategic objective.
- Central responsibility reiterated: ensure all taxpayers pay the correct amount of tax under the law to maintain trust in the tax system and meet government social and economic goals.

*Prepared by Susan Betts, IMF Fiscal Affairs Department; IMF Technical Notes and Manuals 2022/005.*

### Section 2

### CRM Organization Structure and Governance

### Organization and core responsibilities
- A dedicated unit or team to manage the CRM process is key for most administrations; adaptations may be appropriate for very small or very large organizations.
- Dedicated staff with required skillsets will position the tax administration to produce better results from CRM activities; the number of staff depends on the administration’s data availability and staff capability.
- Key activities the CRM unit will lead:
  - (1) analyzing the internal and external environment;
  - (2) analyzing the current tax administration data for indications of noncompliance;
  - (3) collaborating closely with risk owners, who are the business line leaders for the various tax functions;
  - (4) working collaboratively with risk owners to develop treatment strategies for the identified risks; and
  - (5) developing CRM methodologies and practices and documenting them for future reference.
- Placement: should be a central Headquarters (HQ) function located within a program planning and design function responsible for strategy and guidance to operational units.

### CRM governance and committee
- Good governance is required because CRM affects all functions (taxpayer service, registration, filing, correct reporting, payment) and all taxpayer segments (large, medium, small taxpayers); coordination is necessary.
- A CRM Committee should be established to aggregate CRM intelligence and facilitate management decision-making on priority risks.
- Typical committee composition and cadence:
  - Chaired by the most senior leader (term used in the note: Director).
  - Representatives: senior executives in charge of the CRM unit and the risk owners (Department heads).
  - Meeting frequency: typically quarterly, or at least twice per year, to:
    - evaluate progress in addressing existing risks;
    - confirm whether existing risks are still the highest priority risks for treatment;
    - identify any emerging risks in the tax system;
    - approve—on an annual basis—the compliance improvement plans (CIPs) for the upcoming year, including resource allocations aligned to the treatments identified;
    - provide guidance to the CRM unit as required;
    - review the performance results of the various treatment strategies and adjust as required.
- The CRM unit is responsible for maintaining and providing updates to the Compliance Risk Register (CRR) to the CRM Committee regularly.

### Annual Operational Plans
- The Compliance Improvement Plan (CIP) is a key CRM output and includes details on the type and number of treatments to be conducted.
- Accumulated CIP information enables allocation of work among HQ and operational units in regions and districts.
- Workload and resource allocation should be done annually with sufficient lead time for regional and district planning.

### Operational performance measures and funding
- Monitoring performance results for all treatments throughout the financial year is critical to evaluate success and compare CRM-based results to prior results.
- Evaluation feeds back into the CRM cycle: expand treatments that produced good results; consider different treatments where results were not achieved.
- Performance results can support requests to government for additional funding; example metric cited: when the administration demonstrates that for every $1 invested it collects, for example, $4 or $6 in additional revenue, a stronger argument can be made for additional resources.

### Inputs to the CRM process
- Five highlighted inputs: Data and Data Management; Information Technology to support CRM; Business experts and CRM specialists; OECD CRM Process; Risk Practices and Tools.
- Implementing CRM is a journey; start with available inputs and build capabilities over time.

Data and Data Management
- Tax returns and other declarations are important data sources; external sources include banking data, company registry information, and customs import/export information.
- Caution: more data are not always better—having the right data and sufficient IT/capability to use data is more important.
- Data matching is a practical starting technique; a common identifier (e.g., Taxpayer Identification Number) enables matching across sources (example: comparing customs data to tax declarations).

Information Technology support for CRM
- Degree of automation varies by country; simple tools (e.g., Excel) can support initial analysis and matching.
- As CRM matures, automate matching processes and deploy tools such as statistical analysis, outlier detection, pattern recognition, data mining, and machine learning; tools can be externally sourced or developed in-house.
- IT functionality should be increased as resources and capabilities permit.

Business experts and CRM specialists
- New staff skillsets are required: data analysis, pattern recognition, identifying outliers; develop training paths for CRM unit staff.
- Business knowledge from audit and taxpayer service staff (recurring noncompliance patterns, common taxpayer questions) is critical intelligence to capture and share with the CRM unit.
- Collaboration between CRM unit and risk owners yields synergy not possible individually.

Risk practices and tools
- Methodologies for assessing and prioritizing compliance risks include likelihood and consequence matrices; determine risk tolerances and document evaluation criteria for objectivity and consistency.
- Tax-GAP analysis is a measurement tool to identify policy and compliance gaps, often conducted for the Value-Added Tax; it can identify industry sectors with higher shares of the compliance gap and track downward trends after treatments.
- Other analyses: studies using administrative data and randomized controlled experiments (example: random audit programs) to estimate revenue leakage and measure impacts of risk-based approaches.

### Outputs from the CRM process
- Key outputs: Intelligence/Profiles/Scans/Studies; Compliance Risk Register (CRR); Compliance Improvement Plans (CIPs).
- Intelligence, profiles, scans, and studies:
  - Industry profiles document key areas of risk and mitigation approaches (example: construction sector revenue recognition methodologies).
  - Studies evaluate risk hypotheses and pilot project results, feeding back into CRM.
  - Understanding underlying causes of noncompliant behavior enables treating causes (e.g., education if noncompliance stems from misunderstanding of law).
- Compliance Risk Register (CRR):
  - Records important compliance risks and assigned risk ratings; updated regularly as risks or ratings change.
  - CRM unit maintains the CRR and provides updates to the CRM Committee.
- Compliance Improvement Plans (CIPs):
  - A separate CIP is required for each risk approved by the CRM Committee for mitigation.
  - CIPs target taxpayer segments or industries and rate risks across registration, filing, correct reporting, and payment as high, medium, or low.
  - Treatments should range from preventative to facilitative to enforced compliance.
  - Purpose: overcome siloed approaches by considering interdependent impacts across taxpayer obligations.

### Implementation considerations and practical guidance
- CRM supports revenue mobilization by targeting voluntary compliance promotion and addressing highest noncompliance risks methodically.
- Clarity on organizational roles and responsibilities and collaboration across units strengthen results.
- Avoid under-resourcing CRM: administrations are advised to start with a small team of two or three staff and build as workloads grow.
- The model presented represents a mature end-state; for early-stage adopters:
  - Use available data to understand taxpayer population and begin matching.
  - Use pilot projects to test anomalies and matching discrepancies.
  - Incorporate lessons learned into subsequent analyses to improve results.
  - Engage development partners to strengthen capacity where appropriate.
- Concurrently strengthen people, systems, tools, data, and legal frameworks as CRM capability grows.

*tnmea2022005 - Section 2*

---


_Source: https://www.imf.org/-/media/files/publications/tnm/2022/english/tnmea2022005.pdf_