Large businesses do not experience HMRC as a series of enquiries. They experience it as a relationship, managed by a customer compliance manager, punctuated by a periodic business risk review that assigns the group a rating. That rating determines how much scrutiny the group receives for the following years — and it is decided as much by how the business manages tax as by how much tax it pays.
What the review assesses
The review looks at three broad areas, and understanding them explains why two groups with identical tax profiles can receive different ratings.
Systems and delivery. Whether the business has tax accounting arrangements capable of producing accurate returns — governance over tax, the quality of the data, the controls over the processes that feed the numbers, and the resourcing of the tax function. This is where the senior accounting officer certification connects: a group certifying appropriate arrangements while the review finds manual workarounds and unreconciled feeds has a credibility problem that extends well beyond the rating.
Internal governance. Whether the board owns the tax strategy, whether there is a documented approach to tax risk, and whether decisions with tax consequences reach someone qualified before rather than after they are made. Qualifying groups must publish a tax strategy, and HMRC reads it against what it observes.
Tax compliance approach. Whether the group's positions are within a reasonable interpretation of the law, whether it discloses uncertain positions in real time, and whether it engages openly. Legitimate commercial structuring is not penalised; a pattern of aggressive positions taken quietly is.
What the ratings mean in practice
There are four ratings — low, moderate, moderate-high and high — and the group receives both an overall rating and a view on each tax regime, so a business can be low risk for corporation tax and carry a worse marking for VAT or employment taxes. The cycle follows from it: a review at least annually for anything other than low risk, and generally a three-year cycle for low risk businesses. This is HMRC's approach to large business customers with a customer compliance manager, not a process every company goes through.
A low risk rating is the objective, and it is worth real money. It means a longer interval before the next review, less routine enquiry activity, and a working relationship in which a question can be raised and answered rather than escalated. Higher ratings mean more frequent review, more resource-intensive interaction and a greater likelihood that any given transaction attracts a formal enquiry.
Ratings are given by tax regime rather than as a single verdict, so a group can be low risk for corporation tax and higher risk for employment taxes or VAT — which is common, because indirect and employment taxes are frequently owned outside the tax function and governed less tightly.
What moves a rating
- Unprompted disclosure of uncertainties. Telling HMRC about a difficult position before filing, with the reasoning, is the single most effective behaviour. It is also the one businesses resist most;
- Errors found internally and corrected — evidence that the controls work — versus the same errors found by HMRC;
- Consistency between the published tax strategy and observed behaviour;
- Response quality: complete answers delivered on time, versus partial answers requiring three follow-ups;
- Stability of the tax function. High turnover, vacant senior roles and heavy reliance on one individual are treated as delivery risks in their own right;
- Systems change. A major ERP implementation is a risk event, and a group that briefs HMRC on it in advance is treated very differently from one whose returns simply become unreliable for two quarters.
Preparing for one
The preparation that works is not a document exercise in the month before. It is evidence assembled over the cycle: a tax risk register that has been updated and discussed; board or audit committee minutes showing tax was considered; process documentation that matches what people actually do; a log of errors found, corrected and prevented; and a record of engagement with HMRC on uncertain positions.
Where a group knows a weakness exists — an under-resourced indirect tax function, a legacy system feeding the VAT return by hand — the better strategy is to raise it with a remediation plan attached rather than hope it is not found. A known weakness with a funded plan and a date is a much smaller rating problem than the same weakness discovered.
For businesses below the threshold
Most companies never experience a business risk review, but the framework is a useful template regardless, because it describes what HMRC considers good tax governance. A mid-sized group that can show documented processes, errors found internally, and positions disclosed rather than buried will have a materially easier time in any enquiry it does face — and the same evidence answers the questions a buyer's tax due diligence asks.
Acumon supports groups on tax governance, senior accounting officer arrangements and the evidence a risk review examines through tax compliance and internal audit work, and handles the interaction where a rating has already moved the wrong way through tax dispute resolution. If your next review is within a year, the log of what you found and fixed is the document to start building now.