Aidan Walsh is a tax director with Ernst & Young. The opinions expressed in this article are the author's own.

Aidan Walsh Director Corporate Tax Services

The first part of this article introduced the concept of tax risk management as a new discipline. New challenges are facing companies, finance functions, tax directors and tax advisers in the current tax-risk focused environment. In particular, there is the complex task of achieving a balance between three priorities — complying with the regulatory and legal obligations imposed on companies, meeting the company's tax liabilities under the tax code and looking after the interests of the company's shareholders.

The purpose of this article is to discuss the new skills that these tasks may demand from companies' financial officers, tax directors and their tax advisors.

The tax risks that face companies today can be broken down as follows:

• Compliance risk: This is the risk that the company does not meet its various compliance requirements, such as filing returns or making corporation tax payments on time. With the requirements of Section 45 of the Companies (Auditing and Accounting) Act 2003, this area is of particular concern in Ireland.
  
• Transactional risk: This is the risk that tax legislation is incorrectly applied to a certain transaction. This risk increases for non-routine and unusual transactions
  
• Operational risk: This is the risk that tax legislation is incorrectly applied to everyday operations of the business. This risk is increased if there is a low level of taxation expertise in the company and usually arises from lack of familiarity with legislation or, more commonly, not keeping up to date with current legislation.
  
• Financial reporting risk: This is the risk that tax-sensitive figures in the financial statement do not give a true and fair view of the company's tax affairs. This risk is of particular concern to companies affected by the US Sarbanes-Oxley Act.

• Reputational risk: This is the risk that the company's reputation suffers following publication or disclosure of a deficiency in one or many of its tax procedures.
  

In the past, companies — along with the finance professionals who advised them, both internally and externally — were more concerned about ensuring that they paid the right amount of tax. This was the correct attitude since once a company had paid its full tax liability, many of the risks identified above fell away and any remaining were not likely to be major.

However, as pointed out in Part I of this article, the attitude of regulators, governments, tax authorities, shareholders and the public has changed. Instead, companies are now expected not only to pay the right amount of tax, but also to have articulated, documented, demonstrable policies and processes in place. This change in attitude was caused by a degree of disquiet with the way that tax (which is the life-blood of governments and regulators) was seen by some companies as a matter for more junior levels of management. As Minister Michael Ahern, TD, said in the Seanad recently, when announcing that he may reconsider the terms of Section 45 of the 2003 Companies Act: 'There can be no going back to a situation where incorporation and limited liability can be used as a cover to allow boards of directors to disclaim all responsibility …'

This requires that tax professionals, within companies or as advisers, can no longer rely solely on their technical tax skills. Now, they must also have skills such as risk assessment, policy and process construction, process testing and evaluation. Traditionally, companies may have relied on their staff doing the 'right thing'; now, they must document what that right thing is and that it is done.

This can be a difficult task where, in a global economy, the division of labour becomes too fine for employees to have anything but the vaguest idea of what many of their colleagues do. Thus, many 'line' employees will have only a vague notion of the tax consequences of what they do, while finance or tax professionals in the firm may have only an imprecise idea of what the 'line' employees do. This ever-increasing complexity requires a greater degree of information and knowledge flow around the organisation. Tax risk management is largely based around such information flows.

Tax risk management can be broken down into three broad areas:

• assessing the material tax risks in an organisation;
  
• ensuring that the 'line' personnel involved in these high-risk areas are, generally, -aware of the tax consequences of their actions;
  
• ensuring that the finance or tax professionals in a company are, generally, aware of what the 'line' personnel are doing.
  

Tax risk management starts to collapse when these information flows start to break down. An approach based on risk management should ensure that policies and processes are in place so that the flow of appropriate information occurs in a timely, orderly and — probably most importantly in the current climate — documented manner.

For example, in Ireland the primary source of changes to the tax system is the annual Finance Act. How many companies have a documented process in place to ensure that the Finance Act is reviewed by appropriately qualified personnel, that the changes are risk-weighted to the company's activities and that those changes of a particular risk-weighting are documented, that such documentation is circulated to the appropriate 'line' personnel and that a report is returned noting the changes and documenting the consequences? All companies will currently do these things in some informal manner and many non-tax-qualified employees will be aware of tax changes through the media or through their representative bodies (like IBEC or the IBF). However, this informal process may no longer be enough.

No-one doubts that it is impossible for companies to be 100% tax compliant all of the time. Modern companies undertake too rich a range of complex activities for this to happen. A key first step is deciding what processes to document. Companies must make risk assessments; to winnow out the tax risks that are central to their activities and where failure could result in a material problem. All forms of risk assessment follow a similar basic pattern:

The tax risks are usually identified by asking 'what can go wrong?' questions. Generally, only matters where there is a medium or higher potential materiality level and a medium or higher level of risk of the event happening is a documented process put in place.

Reputational matters, not being quantifiable, can cause difficulties. This is usually solved by weighting reputational or non-quantifiable matters. For example, a company securing a conviction for tax evasion is given a scoring of 'high' on a 'high/medium/low' scale of reputational matters. This allows for a degree of consistency and for a well-documented decisions process.

Having documented the major tax risks that the company faces, the next step is to put in place policies and processes for those areas. This can be a very difficult task. Every company will have its own rules, routines, norms and culture when it comes to tax compliance. Some companies will rely on a well-staffed centralised tax function; others will have 'line' personnel with long experience of tax; others will already be largely process-based; and still others will allow for more intuitive behaviour. Companies should document their processes within their own cultural framework. In this context, awareness of these tacit features of a company's architecture will require new skills from many tax professionals.

Take a company with a decentralised divisional structure. 'Best practice' in its industry may be to have a centralised tax function, with all tax processes involving that function. However, for this company, that may not be a useful benchmark: a centralised tax function may be perceived as an erosion of the divisions' autonomy and be resisted. Instead, a tax risk management process that retains the autonomy (if that is what management wants) may be required with, perhaps, each division using the centralised tax function for particular purposes (such as payroll) and using outside tax advisers for other purposes (such as new transactions).

The new environment of tax risk management requires tax or finance professionals with technical skills and knowledge founded over a wide range of areas, including risk assessment, project management, process mapping, process testing and process documentation. It also requires tax professionals with some degree of awareness of tacit areas like organisational culture. For some finance and tax professionals, these are new skills and will not be quickly acquired. Many companies will need help. Companies will need to discover if they have these skills; if they do not, they will need to get them one way or another, either internally or externally. This process of skills discovery should be the first step in any tax risk management programme.