Internal Audit Fulfilling A Supportive Role

Source section: Auditing Your VAT Control Framework by Ferry Geertman (Internal Auditor)

Internal Audit Realize Indirect Tax Aims

Determine whether the current processes operate satisfactorily as is or need to be improved, factoring in any potential or existing differences and taking into account the complexity of the existing processes and the variations between these processes in each of the business units. In order to meet this objective from an indirect tax perspective what does Internal Audit need to realize these aims? Starting point would normally be the company’s Indirect Tax Control Framework.

In terms of accountability for VAT/GST , the picture is not clear – 12 percent of respondents do not know who is accountable and the balance are broadly split between saying VAT/GST is a tax function responsibility to being a finance function responsibility. Larger businesses trend towards accountability for VAT/GST residing within the tax function. "KPMG The Benchmark Survey on VAT/GST

For a first impression Internal Audit could raise the following questions

1. Is the indirect tax strategy defined and aligned with companies’ business objectives?
2. Are material indirect tax risk areas defined?
3. Are roles and responsibilities for managing these risks explicitly assigned?
4. Are assessed risks documented in a risk register, monitored and communicated to senior management?
5. Does the risk register risk register contain the following labels: number, name of the risk, risk definition, cause for the risk to occur, risk category and the risk owner?
6. How much re-work is required before numbers received from finance systems can be used?
7. Are the internal controls that mitigate these risks explicitly documented?
8. Are the responsibilities for executing and monitoring the internal controls assigned
9. Are there regular meetings to discuss status of risks and internal controls and define actions?
10. Has a strategy been defined for managing the relationship with tax authorities?
11. Have the responsibilities been assigned for the different geographic regions?

The answers give insight of the existence of the right building blocks of an Indirect Tax Control Framework and give an auditor the possibility to draft his first conclusion on process and risk management around indirect tax. In a TCF for each process in an organization, the roles and responsibilities as to the VAT aspects are set including the procedures and any tools that are implemented. Roles and responsibilities should be defined in such a way that reward and risks are made visible in time and that everything is also documented and reported.

When however the conclusion is that the right building blocks TCF are not present (question are answered negatively), Internal Audit probably could take the role as pro-active advisor with regard to the right set up of internal indirect tax processes.

To perform such a role Internal Audit need to have the following competencies:

1. sufficient knowledge available re indirect tax risks that exceed the company’s risk appetite;
2. clear understanding of a normative framework from indirect tax perspective how and what need to be managed re these risks.
3. These are the conditions under which Internal Audit could fulfill a proactive role relating indirect tax risk management. In practice, the best way to achieve this is often to limit the scope and request the top 3-5 indirect tax risks that exceed the company’s indirect tax appetite.

How do you see this?