What you can expect from this article

Time and again, during consultancy meetings, I find that prospective clients proudly show me the risk control matrices they have already drawn up. And then comes the question of how they might „fit“ these into Opti.Tax. The problem is that these ‘make-a-wish’ TCMS are completely worthless, as they do not stem from the processes themselves. Don’t get me wrong: I wholeheartedly welcome the fact that someone is tackling the subject of a Tax CMS and wants to safeguard themselves from a tax law perspective. However, there are good reasons why we at hsp take a different approach. Below, I’d like to explain why a Tax CMS doesn’t begin with risk assessment, but with process mapping. And why this order determines whether the system is fit for purpose or ends up gathering dust on a shelf.

TCMS in reverse: It’s never a good idea to start with the result

We have been offering our TCMS solution for many years. Over that time, I have often reiterated our philosophy: everything starts with the processes. Ideally, at the very end of the journey, there will be a Tax Compliance Management System that is fully embraced by the company and its staff. Yet clearly, I do not repeat myself often enough. How else can one explain the fact that, in online meetings, interested parties regularly list to me everything they’ve already done on the subject of TCMS? For example, a risk-control matrix that’s already been drawn up, the identification of risks, and so on. This is then followed by the follow-up question: ‘How do we now incorporate this into Opti.Tax?’

If I were only interested in closing the deal and were being petty, I could say: Technically, no problem – just import or enter the data from Matrix and the like, and that’s it. Tick the box, TCMS in place, everyone’s happy. Until the first risk comes crashing down on the new client. Or the next tax audit exposes the TCMS as a sham. And that’s pretty much the last thing I’d wish for our clients. So, once again: an effective risk assessment isn’t created at a desk, but emerges from the actual process itself. After all, the aim is to minimise the company’s actual risks through genuine measures.

With TCMS, the process must come first

What risks do we face? This is not a question that should be asked at the start of a TCMS development project. Instead, I would argue that we should always start with the process. That is why my first question is: What does the process actually look like? What do the staff in the company actually do? No imaginary scenarios, no wishful thinking. It’s best to visualise this using BPMN and check with the team and the relevant departments to ensure the representation matches reality. Only once this ‘as-is’ state is established do we examine which risks, for which tax types, are associated with each process step. And with Opti.Tax, it’s child’s play: you can either create a risk manually, retrieve it from the database, or use the AI assistant to check the process step and have it suggest potential risks for each tax type. We can then adapt these suggestions as required.

Based on the identified risks, control measures are drawn up in the next step. This, too, can be done either manually or with the aid of AI. These measures are then delegated to the individuals actually responsible, in accordance with the dual-control principle. This is where a TCMS really comes to life: those involved in the processes can view their processes, and the feedback from the control measures leads to process improvements and an assessment of whether or not the risks have materialised.

From perception to a comprehensible calculation

Only once all this has been done do we return to the starting point of this article. We now have everything we need to systematically calculate the probability of occurrence and the maximum possible loss associated with each risk – and to do so in a realistic manner. This is the only way I can produce a robust Risk Control Matrix (RCM), entirely free from gut feelings and wishful thinking. Once I’ve recorded and compiled all this using Opti.Tax, it’s no problem at all for me to present my RCM – including all processes and calculations – to a tax inspector. In the short term, this may seem like extra work, but in my view, it’s not even worth mentioning. However, in the long run, I’m much better off and more relaxed, as my digital, dynamic Tax CMS can be conveniently updated and maintained on an ongoing basis.