Managing tax risks and ensuring robust governance is an essential part of running a successful business that is fully compliant with tax laws.
The Australian Taxation Office (ATO) reviews and assesses whether organisations have a tax control framework in place, how it is designed, and whether it effectively manages task risks in practice.
The ATO outlines its rating system for reviewing and assessing tax governance.
The ATO’s tax risk management and governance rating system
The ATO has monitored and categorised the Top 1,000 taxpayers in Australia into the following rating categories:
In a recent review, the ATO identified that of the Top 1,000 taxpayers:
- 63 percent were rated at stage 1.
- 30 percent were rated at stage 2.
- 7 percent raised concerns or did not sufficiently evidence the existence of a tax control framework, also known as a “red flag” rating.
No businesses achieved a stage 3 rating.
The ATO details observations for taxpayers that have their tax governance rated at the different stages.
Stage 1 rating
Stage 1 is the most common rating, reflecting that many large businesses are still in the process of documenting and formalising their tax control frameworks and / or lack objective evidence that their tax control framework is designed effectively.
Some taxpayers have enterprise-wide policies and governance frameworks that may encompass the tax function rather than having a specific tax risk management and governance framework in accordance with the ATO’s Tax risk management and governance review guide.
Stage 2 rating
With a stage 2 rating, the ATO is generally confident that a company’s tax control framework has been designed effectively. For many taxpayers this will be a satisfactory assurance rating.
To obtain a stage 2 rating, taxpayers must have periodic control testing as part of their tax governance framework. Many taxpayers in stage 1 failed to achieve a stage 2 rating due to not meeting this requirement.
If a gap analysis has been conducted and changes have been recommended, a taxpayer must also demonstrate that these changes have been implemented to reach stage 2.
Stage 3 rating
While having periodic control testing as part of the tax governance framework is needed to get to stage 2, actually undertaking testing of the controls, the results of which confirm that the controls are operating effectively in practice, is required to reach stage 3.
This testing must be conducted by an independent party who provides a report of findings concluding that the documented tax control framework is operating effectively. Where improvements are recommended, the ATO will assess whether these have been or will be implemented.
Red flag rating
A red flag rating is applied if there is insufficient documentation evidencing a tax control framework, or if the ATO has significant concerns with the taxpayer’s tax control framework as evidenced by:
- A high level of errors identified, and/or
- Fundamental concerns about the robustness of existing tax processes.
Key takeaways
Most of Australia’s Top 1,000 taxpayers are meeting the bare minimum requirements in demonstrating to the ATO that they have a tax control framework in place. More businesses need to include periodic control testing as part of their tax governance framework to achieve a “satisfactory” stage 2 rating.
