UK Tax Risk Register Template and SOP Compliance Guide

Standard Operating Procedure: UK Tax Risk Register Deployment and Maintenance

Document ID: SOP-TRM-UK-084
Effective Date: October 24, 2023
Version: 2.1.0
Review Cadence: Semi-Annual
Author: Julian Vance, Chief Architect, Template Registry

---

1. Executive Summary & Purpose

This Standard Operating Procedure (SOP) defines the institutional framework for creating, maintaining, and auditing the UK Tax Risk Register. The purpose of this protocol is to establish a rigorous, repeatable methodology for identifying, quantifying, mitigating, and reporting UK tax risks in alignment with HMRC guidelines, Senior Accounting Officer (SAO) statutory obligations, and the Corporate Criminal Offence (CCO) standards for the prevention of the facilitation of tax evasion.

Adherence to this SOP ensures corporate tax transparency, mitigates exposure to penalties under UK tax law (including Schedule 24 Finance Act 2007), and provides defensible documentation for external audit and regulatory scrutiny.

---

2. Scope & Prerequisites

2.1 Scope

This procedure applies to all UK-registered entities, permanent establishments, and operating units within the corporate group. It covers all material UK tax regimes, including:

• Corporation Tax (CT)
• Value Added Tax (VAT)
• Pay As You Earn (PAYE) and National Insurance Contributions (NIC)
• Apprenticeship Levy
• Diverted Profits Tax (DPT) and Transfer Pricing
• Digital Services Tax (DST)

2.2 Prerequisites & Tools

• Software Environment: Enterprise GRC (Governance, Risk, and Compliance) platform, or Template Registry Standard UK Tax Risk Register Workbook (Excel/PowerBI format).
• Access Control: Restricted access limited to Finance, Tax, and Internal Audit personnel.
• Reference Material: HMRC Guidance Manuals, Finance Acts (current and preceding 6 years), SAO Guidance, and HMRC's published guidelines on reasonable steps to prevent the facilitation of tax evasion.

---

3. Roles & Responsibilities (RACI Matrix)

• Responsible (R): The role that performs the activity.
• Accountable (A): The role with final approval and fiduciary accountability.
• Consulted (C): The role providing advisory input.
• Informed (I): The role updated on status and outputs.

---

4. Step-by-Step Procedure

Phase 1: Identification & Taxonomy Setup

• Initialize the UK Tax Risk Register template using the current standardized schema (TRM-UK-TEMPLATE-v2.1).
• Categorize each identified tax risk according to the standard UK taxonomy:
  • Strategic/Structural: M&A, group re-organizations, permanent establishment determinations.
  • Operational: VAT coding errors, payroll data integrity, invoice processing.
  • Compliance/Reporting: Filing deadlines, transfer pricing documentation timing, Diverted Profits Tax disclosures.
• Assign a unique alpha-numeric identifier to every risk (e.g., CT-2023-001, VAT-2023-004).

Phase 2: Quantitative & Qualitative Risk Assessment

• Evaluate the Likelihood of occurrence on a 1–5 scale (1 = Rare, 5 = Almost Certain).
• Evaluate the Impact of occurrence on a 1–5 scale, factoring in potential financial quantum, statutory interest, penalties (Schedule 24), and reputational damage:
  • Low (1): Financial impact < £50k; no reputational risk.
  • Medium (2): Financial impact £50k–£250k; minor administrative friction.
  • High (3): Financial impact £250k–£1M; potential HMRC enquiry.
  • Critical (4): Financial impact £1M–£5M; mandatory disclosure rules (DOTAS/HMRC) triggered.
  • Severe (5): Financial impact > £5M; potential criminal liability or systemic SAO failure.
• Calculate the Inherent Risk Score (Likelihood × Impact).
• Document the primary statutory reference for each risk (e.g., FA 2004 s.84, VATA 1994 s.73).

Phase 3: Mitigation & Control Mapping

• Identify and document existing internal controls designed to mitigate each risk (e.g., dual-authorization on VAT returns, automated transfer pricing benchmarking).
• Assess the Control Effectiveness (Strong, Adequate, Weak, or Ineffective).
• Calculate the Residual Risk Score post-control application.
• Assign a specific Risk Owner (must be an operational or functional manager, not the tax team) with a mandatory target resolution date.

Phase 4: Review, Sign-off & Reporting

• Conduct quarterly reconciliation of the register against the General Ledger, Balance Sheet reconciliations, and open HMRC enquiries.
• Present the finalized register to the Senior Accounting Officer (SAO) to support the annual certification under Schedule 46 Finance Act 2009.
• Archive the version-controlled register in the immutable document repository with cryptographically secure audit logs.

---

5. Quality Assurance & Pro-Tips

Best Practices

• Granular Documentation: Avoid vague risk descriptions like "VAT risk." Use explicit entries such as "Incorrect classification of zero-rated medical supplies in subsidiary X leading to historic under-declaration."
• Dynamic Triggers: Tie risk re-evaluations directly to corporate milestones (e.g., entering new international markets, implementation of new ERP modules like SAP/Oracle).

Common Pitfalls to Avoid

• "Set and Forget" Syndrome: Treating the risk register as a static annual compliance exercise rather than a living operational document.
• Confusing Tax Process with Tax Risk: Documenting daily transaction processing workflows without linking them to specific points of potential legislative failure.

Metric Thresholds

• Target Residual Risk: 100% of risks scored as "Critical" or "Severe" inherent risk must have a clearly documented mitigation plan reducing their residual impact to "Medium" or lower within 90 days.
• Audit Trail Completeness: Zero tolerance for unassigned risk owners or missing statutory references.

---

6. Frequently Asked Questions (FAQ)

Q1: How does the UK Tax Risk Register interact with the Senior Accounting Officer (SAO) certification?

A: The register serves as the primary evidentiary baseline for the SAO. To sign the annual Schedule 46 certification confirming that the company has "appropriate tax accounting arrangements," the SAO must review the register to ensure all material risks are identified, monitored, and mitigated.

Q2: How frequently should the Inherent and Residual risk scores be updated?

A: Scores must be formally reviewed bi-annually. However, an ad-hoc review is mandatory within 14 business days of any significant legislative change (e.g., Autumn Statement/Spring Budget updates) or structural corporate event (e.g., acquisition, divestment).

Q3: What constitutes a "material" tax risk for inclusion in the register?

A: Any risk with an expected financial impact exceeding £50,000, or any risk—regardless of quantum—that involves aggressive tax planning, unverified grey-area positions, or potential exposure under the Corporate Criminal Offence (CCO) legislation.