HMRC increases Business Risk Review Plus activity

Many businesses have been approached by HMRC to book in a business risk review under the new Business Risk Review Plus (BRR+) format. As part of these reviews, HMRC allocates a risk ‘score’ to the business, which may be Low, Medium, Medium-High, or High. 

Although the BRR+ (like its predecessor the Business Risk Review) is purportedly revisited annually, either in the form of a full review or an Annual Conversation, many large businesses had all reviews paused completely during the coronavirus pandemic or underwent only a very light touch review. We are seeing a renewed focus on the BRR+ process as normal service is resumed, and specifically increased activity within the last few months.

What is a BRR+?

The BRR+ is organised by the relevant business’s HMRC Customer Compliance Manager (CCM). HMRC’s guidance indicates that businesses with a UK turnover of £200m or more should be allocated a CCM, but in fact many are not allocated one for months or years. Businesses without a CCM are therefore unlikely to have a BRR+ in the near future, but they can still work towards implementing the tax governance environment HMRC expects to see. 

The BRR+ usually takes the form of a two- or three-hour meeting, with HMRC often offering the business the option of this being done virtually or in-person. Before the meeting, HMRC will share specific questionnaires to be completed and returned; for example, amongst others, questionnaires on software used for tax, IR35, and industry-specific VAT issues. 

HMRC will then score the business using a specialist team member for each area of tax (corporate tax, VAT, customs duty, employment tax), even if no questionnaires have been returned. Those specialists may or may not be at the actual BRR+ meeting. Many businesses find this confusing as they are preparing for the meeting with a view to providing information for HMRC to consider in determining their risk score, whereas in fact HMRC will establish a draft score prior to the meeting. Businesses may then discuss and present a different perspective to HMRC, but in practice HMRC is often reluctant to deviate significantly from its original draft score. 

What this means in practice is that the time to provide information to influence HMRC’s score is before the meeting, and businesses can be proactive in providing HMRC with details in advance. A typical timeline for the overall process might be:

• 2-3 months in advance: BRR+ diarised;
• 0-2 months in advance: tax-specific questionnaires circulated;
• 0-1 months in advance: HMRC shares risk assessment of business; and
• 0-1 months after: HMRC shares finalised risk assessment and minutes.

What’s new about the BRR+?

The new BRR+ is quite different from the previous system in that it emphasises the tax risk and control framework and governance within the business’s tax function.

It used to be that businesses that paid the right amounts of tax at the right time could expect to be Low risk, but now other factors are taken into account, such as engagement with HMRC, tax team staffing, and the business’s internal documentation of its tax processes.

Specifically, it is expected that every large business maintains a tax risk register and shares it with HMRC. HMRC also expects documented tax processes and regular, documented, assurance checks on such processes. 

HMRC will also ask about related matters such as:

• the corporate criminal offence risk assessment processes and controls; 
• the process undertaken by the Senior Accounting Officer to ensure that the company establishes and maintains appropriate tax accounting arrangements; and, 
• the requirement to publish a UK tax strategy. 

Why is HMRC focusing on governance?

HMRC recognises that large businesses have complex tax affairs and contribute significantly to the UK tax base. As such, for many years it has allocated resources to these larger businesses, in the form of CCMs, to encourage an open dialogue. 

HMRC says that large businesses represent 25% of its ‘compliance yield’; the metric it uses for tax that would not have been collected without its intervention. HMRC has adopted a risk-based approach to enable it to identify instances where tax may have been underpaid without sending a specialist from each area to every business.

What does the scoring mean?

HMRC says that the BRR+ risk rating is an internal measure of how much resource it should dedicate to the business. The BRR+ review is supposed to be annual, except for Low-risk businesses which can expect a full BRR+ every three years with an ’annual conversation’ each year in between. A High-risk business, on the other hand, should expect more HMRC attention in the form of compliance checks and enquiries.

HMRC says that no business is precluded from being Low risk due to operating in a higher risk industry; however, the nature of the industry is taken into account when HMRC assesses the overall risks and, correspondingly, the business’s tax governance. 

How to prepare

HMRC publishes its scoring guidance online, which allows businesses to prepare, even if a BRR+ review is not imminent. However, it is common knowledge that HMRC has limited resources, and consequently it may not always follow its own processes perfectly, which can make preparation difficult. For example, many businesses only have a BRR+ review every four to five years, even in the absence of a Low-risk rating.

Nevertheless, we would advise any large business to review HMRC’s Low risk criteria and make an internal assessment of its expected risk status. Those responsible for the business’s tax affairs should also seek to gain an understanding of the appetite from the wider business for being scored with a particular risk rating. Management would generally like tax to be regarded as Low-risk by HMRC, but is often reluctant to put in place the required processes. 

RSM’s Tax Risk and Governance team regularly attends BRR+ meetings with our clients, and we’d be delighted to discuss how HMRC’s approach may impact your business. For more information, please contact Flora Barnes or your usual RSM contact.