Tax internal audit: strengthen tax governance and controls for financial services firms

Why tax internal audit matters 

Tax teams often manage risk across several jurisdictions while maintaining day-to-day compliance. Changes in legislation, greater HMRC scrutiny, new data requirements and pressure on resources can expose a gap between policy and practice.

A well-designed tax internal audit goes beyond listing control weaknesses. It shows tax, finance and internal audit leaders where risk is concentrated, whether responsibilities are clear and where processes need to be strengthened or simplified.

When to take a closer look at tax internal audit

There is no single trigger for a review. Warning signs can include rapid growth, expansion into new markets, system or personnel changes, inconsistent procedures, repeated errors, limited documentation and uncertainty about control ownership.

A review can also be timely when tax has not previously formed part of the internal audit plan. A formal tax risk assessment can then help the organisation decide whether its existing controls remain proportionate and fit for purpose.

Set a risk-based scope 

The scope should reflect the organisation, its operating model and the maturity of its tax governance. Reviews commonly consider corporation tax, value added tax (VAT), transfer pricing, employment taxes and sector-specific obligations.

For financial services organisations, the scope may also cover the Corporate Interest Restriction, the Common Reporting Standard and Insurance Premium Tax. The priority is to focus on the areas of greatest exposure and test whether the tax control framework works in practice.

What the review should cover 

Start with a clear view of the business, its tax profile and the concerns of key stakeholders. The review should assess governance, ownership, documentation, reporting and the design and operation of key controls.

A typical review includes initial risk discussions, agreement of the timetable and audit plan, stakeholder engagement, control and evidence testing, reporting of findings and, where appropriate, presentation to the audit committee.

Early collaboration matters. Heads of tax, finance leaders and internal audit teams bring different perspectives on how processes work and where pressure points arise. Their involvement helps produce practical findings and can strengthen the internal audit team’s understanding of tax risk.

Address international risk locally and centrally 

International tax risk cannot always be assessed from the centre. Legislation, filing practices and operating arrangements can vary between jurisdictions.

Combining group-wide oversight with local tax knowledge can reveal inconsistencies that a central review may miss. It also helps leaders separate local issues from broader weaknesses in governance or control design.

A particular consideration for financial services 

Financial services organisations face added complexity because tax governance interacts with extensive regulatory requirements and operational risk.

Banks, insurers, asset managers and real estate businesses may operate through complex legal structures and across several territories. Clear ownership, reliable data and consistent tax controls are therefore particularly important.

Tax internal audit in practice 

In one review for a large financial services group, early discussions with the heads of tax and internal audit identified VAT and transfer pricing as the priority areas. The audit plan combined central oversight with specialist input from Belgium, France and Luxembourg to reflect the group’s international operations.

The organisation had not previously conducted a tax internal audit. The review helped its internal audit team understand the relevant risks, identified process weaknesses and converted them into practical recommendations for management.

The organisation then made tax a recurring part of its internal audit cycle, with a different area reviewed each year.