TaxIntellilytics Stories

Tax Lab · Compliance, risk & behaviour

Tax CRMP: your tax compliance risk management plan

Answer a short profile and thirty control questions. The tool builds your obligations from Uganda's tax statutes, rates each risk before and after controls, prices it in shillings, scores your tax control framework against international standards, and writes the calendar, owners, actions and board report.

Start from

Your answers and trackers stay in this browser; save the profile to keep a copy or move it to another computer. The three starting points are invented companies, for trying the tool.

How it works

  1. Your profile switches on the obligations that apply to you, and explains the ones it leaves out.
  2. Each obligation is scored on a 5 by 5 scale (ISO 31000): likelihood from how often it recurs and your history; impact from the cost of a typical failure as a share of turnover, raised where premises can be closed or an offence committed.
  3. The cost is computed from the penalty and interest rules in the Acts, with the tax at stake sized from what you pay, and the months late you set.
  4. Controls you have in place lower the likelihood (and, for detective controls, the impact), giving the residual rating; expected exposure is the chance of failure at that likelihood times the cost.
  5. The thirty controls also score your framework on the OECD's six building blocks and five maturity levels, with HMRC's and the ATO's lenses beside it.
  6. Trackers keep the plan alive: each deadline filed and paid (and flagged when overdue), an issues and actions log, a register of changes in the law, monthly risk indicators, and an IFRIC 23 log of uncertain tax positions. What-if testing shows what each control would save before you build it.
  7. Export the plan as an Excel workbook laid out like a compliance plan (one register sheet per Act, calendar, RACI, trackers) or as a Word board report you can edit.

Standards it follows

  • OECD, Co-operative Tax Compliance: Building Better Tax Control Frameworks (2016): the six building blocks.
  • OECD Forum on Tax Administration, Compliance Risk Management (2004) and the maturity model series (from 2019): the five levels.
  • ISO 31000:2018 Risk management: likelihood, consequence, inherent and residual risk, appetite and treatment.
  • ISO 37301:2021 Compliance management systems: the obligations register and compliance risk assessment.
  • COSO Internal Control, Integrated Framework (2013): preventive, detective and corrective controls.
  • Australian Taxation Office, Tax risk management and governance review guide (updated August 2022): board-level and managerial-level controls.
  • HMRC Business Risk Review+: systems and delivery, internal governance and approach to compliance.
  • IFRIC 23 Uncertainty over Income Tax Treatments: the uncertain tax positions log.
  • GRI 207: Tax (2019): disclosures 207-1 to 207-3, drafted from the plan.

The law: 44 obligations, 37 rates and thresholds from the Acts' schedules and 14 penalty rules, each quoted from the page cited and checked by the build script. A management tool; it does not replace advice on your facts.