HMRC's consultation on risk profiling - what can it add?

18 April 2017

In the Spring Budget 2017 it was announced that HMRC will consult over the summer on its process for risk profiling large businesses. HMRC’s policy is to match its resource to perceived tax risk, so risk profiling is a key element of its strategy.


HMRC’s current Business Risk Review process involves assessing the risk posed by a business against seven factors. The first three factors measure the intrinsic (known as inherent) risk in the business.

  • Complexity - the potential risk in the size, scope and depth of business or tax interests.
  • Boundary - the level of complexity of international structures, financing and connected party issues.
  • Change - the degree and pace of change with tax implications affecting the business.

The next three factors represent the behaviours the business exhibits which either contribute to how well the inherent risk is managed or in some instances create additional risk by the approach adopted.

  • Governance - openness and co-operation with HMRC and the management of tax risk.
  • Delivery - ability to deliver the right tax through systems, processes and skills.
  • Tax Strategy - involvement in tax planning which does not support genuine commercial activity.

The last factor, contribution, is a sense check as to whether the amount of tax declared, or relief claimed, looks reasonable in the light of what HMRC knows about the taxpayer and/or its business sector.

HMRC currently profiles a business from a variety of data sources including:

  • the internet;
  • data mining, including using its ‘Connect’ system;
  • sector information on particular risks;
  • the company website;
  • its business tax compliance review process;
  • the business’s tax returns and accounts; and
  • the business’s tax compliance history.

Over the last few years, HMRC’s targeting of resource to risk has been particularly focused on companies entering tax avoidance arrangements. However, as the majority of large companies have now either resolved or are in the process of resolving historic tax planning arrangements, this source of risk has now reduced significantly.

Going forward transfer pricing and diverted profits tax appear to be HMRC’s next big targets for large businesses, with country by country reporting providing valuable tax risk profiling information. How this information is used may be part of the consultation.

What can risk profiling add?

Beyond a desire to promote better compliance, it is not yet clear what HMRC is looking to achieve from the risk profiling consultation. Given that HMRC has been dealing with the same large businesses for many years, what further information does it consider it needs to make an informed view on the risk they pose? Perhaps the difficulty for HMRC lies in the fact that tax compliance risk is not as visible as the risk posed by significant planning transactions.

If HMRC deploys resources to businesses based on an inherent risk profile alone, without regard to how well that risk is being managed, that ignores a crucial factor in how it should decide where to put its resources. HMRC’s internal guidance makes it clear that complexity, per se, does not preclude a low risk status; however, it is a common complaint by groups of companies that officers will not give them a low risk status because of their complexity.

Where HMRC considers it does not have sufficient information to form a meaningful view on the effectiveness of the business’s governance, systems and processes, it frequently defaults to a non-low risk status. Risk profiling will not address this problem.

Perhaps HMRC will take the self-assessment principle to extremes with large businesses being asked to provide their own risk profile, as well as details of how well that risk is being managed. Often HMRC’s operational approach requires companies to demonstrate how well they are managing the risks they identify - so this is not as far-fetched as it sounds.

An opportunity?

As the use of tax avoidance arrangements has fallen away dramatically, this particular risk factor (applied by considering the historical use of such arrangements) is no longer a bar to achieving low risk status with HMRC. Businesses may therefore wish to revisit their risk profile and, if low risk is appropriate, they may wish to consider actively engaging with HMRC to secure this status. Being able to demonstrate effective governance and processes will be necessary before that engagement can take place.

If the business’s profile is higher than it would like, particularly in the current environment of enhanced scrutiny and sanctions, it may wish to consider what measures it might wish to take to lower its profile?

For more information please get in touch with Andrew Hinsley, or your usual RSM contact.

Related services