May 16, 2018 | Industry Insights

Tax Controls – Taking a Fresh Look

Overview

With the recent passage of the Tax Cuts and Jobs Act of 2017, now is as good of a time as any for companies to take a fresh look at their tax processes and controls.

Over the years, we have assisted a number of companies in remediating tax-related material weaknesses. We have found that typically some (or all) of the following factors are present in these companies:

  • Tax risk assessments are not performed.
  • Tax departments are insufficiently staffed (understaffed or staffed with individuals who lack the necessary expertise).
  • Tax controls are poorly designed (e.g., lack precision, do not address all relevant risks, etc.)
  • Tax controls are not executed adequately (e.g., controls are insufficiently documented and evidenced).

Within this CFGInsights, we will provide you with some common tax process and control pitfalls and ways to avoid them.

Pitfall #1: A comprehensive tax risk assessment is not performed or is performed infrequently, leading to significant unmitigated tax risks
When it comes to tax, there are a number of risks that should be considered (not an all-inclusive list):

  • Tax rates utilized in the tax provision are inaccurate.
  • Tax methodologies and positions are inconsistently applied period-over-period.
  • The tax impact of significant, non-routine transactions is not contemplated or assessed.
  • Information utilized to calculate the tax provision is inaccurate or incomplete.
  • Nexus is not assessed.
  • Access to the tax provision file is not appropriately restricted.
  • Changes to tax regulation are not monitored and assessed.
  • Mathematical/formulaic errors exist in the tax provision file.
  • Foreign exchange rates utilized to translate local tax balances are inaccurate.
  • All temporary and permanent differences are not identified.
  • Tax journal entries and account reconciliations are not reviewed and approved.

Without performing a proper risk assessment, there is no way to ensure that all significant risks are considered and addressed.

Tax risk assessments should be performed at least annually and should be updated any time there are significant changes to the company or the company’s operating environment (e.g., expansion overseas, an acquisition of a business, the passage of major tax regulation, the issuance of new accounting standards, etc.)

Pitfall #2: Tax departments are insufficiently staffed
A tax provision is only as good as the people preparing and reviewing it. Tax can be complicated and it is imperative that companies staff their tax department with the right number and mix of people. Management must continuously assess the competency and skill set of the individuals preparing and reviewing the company’s tax provision.

In cases where headcount or skill set gaps exist, Management must make a decision:

  • Employ additional resources
  • Provide additional training to its personnel
  • Supplement its existing workforce with external resources

As companies grow and evolve, their human capital needs should evolve with it. The human capital needs of a small start-up company domiciled in the United States will be vastly different than the human capital needs of a multi-billion dollar company with operations all over the world.

Tip 1: It is not uncommon for companies with international subsidiaries to utilize local resources (e.g., the subsidiary Controller or a local third-party accounting firm) to prepare their local tax provisions. These local tax provisions are typically reviewed by Corporate Tax personnel prior to incorporation into the consolidated tax provision. It is important for Management to have complete visibility into (1) who is preparing and reviewing the tax provision and (2) his/her qualifications and experience. We recommend creating a matrix which:

  • Risk ranks each of the local tax provisions (e.g., the higher the complexity of the provision, the higher the risk)
  • Highlights who prepares the tax provision and who reviews it (at the local level)
  • Summarizes the background, experience and skill set of the preparer and reviewer (resumes and biographies of third party service providers should be retained)

You may find that skill set or experience deficiencies exist at the local levels which will, in turn, dictate the extent and type of review that needs to be performed by Corporate Tax personnel.

Pitfall #3: Tax controls are inadequately designed
It is not uncommon to see the following control within a tax control matrix: The Tax Provision is reviewed by the Tax Director and CFO. The problem with this control is that it provides no detail on what specifically is being reviewed by the control owner. Without specificity, there is no way to ensure that all control procedures needed to mitigate significant risks are performed. When designing or assessing your tax controls, ask yourself the following questions:

  • Are the controls’ descriptions vague or overly generalized? Do they incorporate appropriate thresholds for investigation and review?
  • Do the controls’ descriptions incorporate procedures that ensure the completeness and accuracy of any key reports and spreadsheets utilized within the tax provision?
  • In cases where forecasts are utilized in the tax provision, are there sufficient controls over these forecasts?
  • Is segregation of duties appropriately considered and addressed?
  • In cases where the tax provision is calculated and maintained within an excel file, are sufficient spreadsheet controls established (e.g., access, backup, version, input, etc.)?
  • Is the right person assigned to perform the control? Does he/she have the necessary expertise, competence and time to perform a thorough, comprehensive review?
  • Do the company’s controls contemplate and cover all relevant, significant risks?
  • Are controls established at the right reporting level? For example, are controls established at the local level in cases where the tax provision is prepared by local (as opposed to Corporate) personnel?
  • Has the Company inventoried all of its temporary and permanent differences, applied a risk ranking to each one (the more material and complex the calculation, the higher the risk ranking) and established separate controls for temporary and permanent differences which fall into the “high risk” bucket?
Tip 2: For tax provision calculations performed within excel, we recommend going through each relevant tab of the tax provision calculation and documenting, in sufficient detail, within a narrative or process flowchart:

  • The source of inputs
    • What is the interdependence between the tabs? (e.g., does a balance which is calculated in tab A flow into any other tabs?)
    • Is the data pulled from a spreadsheet or report? If so,
      • How is the spreadsheet or report generated? By whom?
      • Is the report generated from a validated system (that is, a system that is covered by the company’s Information Technology General Controls (ITGCs))?
      • What procedures are performed over the spreadsheet or report to ensure it is complete and accurate?
  • The What Could Go Wrong (WCGW)
    • What is the most likely way an error would arise? For example,
      • Formulas are incorrect or are inadvertently changed after validation
      • Source data which is manually input is “fat fingered”
      • Pivots and filters utilized to consolidate data are wrong
      • Source data is stale (for example, does not reflect the latest and greatest trial balance)
      • Cells intended to contain formulas (to automate processes) are inadvertently hardcoded
  • Checks and reviews built into the file to address the WCGW. For example,
    • Password protecting cells to prevent manual input
    • “Checks” which flag when numbers do not align with expectations
    • Conditional formatting which highlights when formula-driven cells are hardcoded
    • Checks which compare totals and sub-totals back to unaltered source data (to ensure completeness of data)

With complicated tax provisions maintained within excel, you will need to get into the weeds!

Pitfall #4: Tax controls are not executed adequately
When the internal and external auditors perform control testing, they look for evidence to assess the process the control owner went through to calculate a balance and to derive a conclusion. They try to step into the control reviewer’s shoes and to gain an understanding over:

  • What specifically was reviewed
  • What questions were asked (and how they were resolved)
  • What errors were caught

Auditors cannot rely solely on inquiry to validate that a control is operating effectively (neither can they rely solely on a signature to evidence review)! Therefore, when executing controls, control owners should be cognizant of the increased level of evidence and documentation that is needed to satisfy audit requirements.

What can control owners do to facilitate a smoother audit?

  • Remember the exercise you (hopefully) went through to identify the “What Could Go Wrong” associated with the tax provision file and its associated checks and controls? Consider taking what you learned from that exercise and creating a standardized checklist that can be utilized by the control owner to ensure that all necessary review procedures are performed. You will likely need to create two separate checklists – one for your quarterly provision and one for your annual provision – given differences in processes and reporting requirements between these two reporting periods.
  • Consider creating a tab within the tax provision which tracks reviewer comments and preparer responses. Maintaining a listing of review comments with their associated responses in one location is helpful as it enables the auditor to assess the types and quality of questions being asked by the reviewer, and to validate that the questions were sufficiently resolved. (This listing will also benefit the control reviewer who can take comfort in knowing that none of his/her review comments ‘slipped through the cracks’.)
  • Take and retain meeting minutes, agendas and presentations for all critical meetings. Meeting minutes do not necessarily need to be “pretty” and formalized. Scribbled notes on a notepad are fine!
  • Maintain memos in tracked changes – that way auditors can see the evolution of a memo over time (pre – and post control owner review).
  • Do not forget that controls over the information (e.g., reports) utilized within the tax provision are just as important as the tax control itself. Auditors will expect to see evidence that the control owner assessed the completeness and accuracy of information utilized in the tax provision. What are examples of things you can do?
    • Include tickmarks demonstrating that you reviewed the parameters of the report (e.g., date range, company codes, etc.)
    • Notate if you tied a report’s balance out directly to the general ledger (trial balance).
    • Highlight any analytics or reasonableness checks you performed (e.g., did the balances on the report look reasonable based upon an expectation you derived based on your institutional knowledge?)
    • Be proactive. Understanding what the audit requirements are upfront will enable you to better plan and prepare for the audit. While you are reviewing the tax provision, proactively retain and save down support – this will save you time down the line hunting for evidence of your review.

Conclusion
Given the manual nature of many tax provisions and the significant amount of judgments and assumptions that go into them, they are ripe for error. Effective upfront design of tax internal processes and controls will minimize the risk of material misstatement of tax-related balances. Further, proactively identifying the “artifacts” needed to evidence operating effectiveness will facilitate a smoother audit. Love it or hate it, the passage of the Tax Cuts and Jobs Act of 2017 may be the excuse you need to take a fresh look at your company’s tax processes and controls.