Revenue Administration: Compliance Risk Management: Overarching Framework to Drive Revenue Performance
Author:
Ms. Susan E Betts
Search for other papers by Ms. Susan E Betts in
Current site
Google Scholar
PubMed
Close

This technical note describes CRM at a high level and how tax administrations can implement a CRM framework to significantly strengthen revenue outcomes. A tax administration’s primary role is to collect revenues on behalf of government to fund the country’s social and economic goals. Taxpayers are expected to comply with their tax obligations as stated in the law. Compliance is the degree to which taxpayers meet their obligations, whether voluntarily or through efforts by the tax administration to enforce compliance. Using CRM allows a country to optimize its revenue collection by identifying and focusing resources on the highest risks to the tax base. While the concepts of CRM are transferable to the customs context, this note focuses on tax administration compliance risks.

Abstract

This technical note describes CRM at a high level and how tax administrations can implement a CRM framework to significantly strengthen revenue outcomes. A tax administration’s primary role is to collect revenues on behalf of government to fund the country’s social and economic goals. Taxpayers are expected to comply with their tax obligations as stated in the law. Compliance is the degree to which taxpayers meet their obligations, whether voluntarily or through efforts by the tax administration to enforce compliance. Using CRM allows a country to optimize its revenue collection by identifying and focusing resources on the highest risks to the tax base. While the concepts of CRM are transferable to the customs context, this note focuses on tax administration compliance risks.

I. Introduction to CRM and its Role in Revenue Mobilization

This technical note describes CRM at a high level and how tax administrations can implement a CRM framework to significantly strengthen revenue outcomes. A tax administration’s primary role is to collect revenues on behalf of government to fund the country’s social and economic goals. Taxpayers are expected to comply with their tax obligations as stated in the law. Compliance is the degree to which taxpayers meet their obligations, whether voluntarily or through efforts by the tax administration to enforce compliance. Using CRM allows a country to optimize its revenue collection by identifying and focusing resources on the highest risks to the tax base. While the concepts of CRM are transferable to the customs context, this note focuses on tax administration compliance risks.

High levels of compliance are directly linked to levels of public confidence in the tax system and its administration. The levels of tax compliance tax administrations observe are the overall result of taxpayers’ behavior. Most taxpayers want to comply and will do so if they are provided with the information they need to fully comply. A minority of taxpayers will be determined not to comply, but deliberate evasion is not the only cause of noncompliance. Carelessness, ignorance and misunderstanding of tax obligations also contribute to misreporting. Weaknesses in the design of the tax system and poor administration also result in noncompliance. Applying the concepts of CRM will allow the administration to match the type and extent of noncompliance with activities to address the noncompliance, recognizing that tax administrations have limited resources and cannot address all compliance risks.

CRM is a methodology used to identify compliance risks within the taxpayer population. Identifying the largest relative risks to the tax base allows tax administration leaders to make informed decisions on how to address the noncompliance and promote higher rates of voluntary compliance over the long term.

The objective of CRM is to manage and improve compliance across all four key taxpayer obligations of registration, on-time filing, correct reporting, and on-time payment. Also known as the pillars of compliance, these four obligations are central to the tax administration’s role in collecting revenues. The tax administration’s processes are designed around ensuring that taxpayers register when required, file their declarations on time, correctly report their tax obligations, and pay on time. Any system of risk assessment must ensure all four obligations are incorporated in the analysis. A well-implemented CRM process will categorize risks according to their likelihood on a scale of high, medium, or low across each of the compliance pillars and develop mitigation strategies commensurate with the risk identified.

CRM is an end-to-end approach across the compliance pillars that tailors the treatment to the degree of the noncompliance. It is much more than audit case selection. Audits and investigations are the most expensive treatments, and their use should be restricted to the most serious cases of noncompliance. Other treatments that can positively impact levels of compliance and may be more cost effective include reminders of filing deadlines to avoid late filing, pre-filling of returns with information known by the tax administration to avoid reporting errors, and letters to specific industries educating taxpayers on common reporting errors in their industry, which allows taxpayers to self-correct and to promote higher accuracy in reporting compliance in subsequent years.

Effective CRM begins with segmentation. Dividing the taxpayer population into groups with similar characteristics will help an administration better understand the segment. Segmentation will also greatly assist with identifying potential areas of risk as a comparison of taxpayers within the segment will identify outliers that could represent noncompliance. Common taxpayer segments include large, medium, and small, but taxpayers can also be segmented on an industry or other sectoral basis.1 Viewing the taxpayer population through various lenses, such as industry and segment, can facilitate sharper targeting of risks associated with that segment.

CRM also leverages knowledge of taxpayer behavior to design strategies that promote and enforce compliance based on the behavior demonstrated. Treatments generally fall into three categories: (1) preventative, (2) facilitative, and (3) enforced compliance. Examples of preventative treatments include education on how to comply and reminders of upcoming filing deadlines. Facilitative treatments include pre-filled tax returns and providing taxpayers in a specific industry sector information on common reporting errors and an opportunity to correct their filing if an error was made. Enforced compliance treatments include audits, investigations, and penalties.

The benefits of using the CRM approach to manage compliance risks include:

  • Increased fairness and trust in the tax system. Adopting a differentiated approach to promoting voluntary compliance using a variety of approaches depending on the nature of the noncompliance and reflective of taxpayer behaviors helps maintain community confidence in the tax system. When taxpayers feel that the tax administration is supporting them in fulfilling their tax obligations, and, at the same time, addressing the most egregious types of noncompliance, trust in the tax system increases. Taxpayers who do not comply with their tax obligations have an unfair competitive advantage over those taxpayers who do comply. Ensuring all taxpayers pay the correct amount of tax levels the playing field.

  • The development of a single institutional view of a taxpayer’s level of compliance. International experience has shown that when a taxpayer is noncompliant, that noncompliance typically extends across most or all of the compliance pillars (registration, filing, correct reporting, and payment). Knowing this allows the tax administration to address the noncompliance holistically, using a more tailored approach, resulting in a more efficient use of resources.

  • Enabling the tax administration to use their limited resources effectively. Better understanding about the causes of noncompliance supports better management decision-making in how to address the noncompliance and in the allocation of resources.

  • Optimizing revenue collection. Rather than spending limited resources on non-revenueproducing activities or relatively lower-producing activities, CRM targets the most serious noncompliance, allowing resources to be dedicated to restoring revenue that would otherwise be lost.

  • CRM helps tax administration leaders answer key questions. Leaders will have a better understanding of what compliance issues exist and in what sectors, which allows them to report to government the measures being taken to address these issues. Also, tax administration leaders can have a clear line of sight between the identified compliance risks and the resources dedicated to addressing those risks. Both efficiency (doing things right) and effectiveness (doing the right things) are positively impacted through the use of CRM approaches as resources are aligned to the highest risks, and economies of scale are realized through staff specialization in addressing common risks.

II. The CRM Process

The Organisation for Economic Co-operation and Development (OECD) developed a CRM process that has become common practice in managing compliance risks. The process can be applied in both advanced economies and developing countries. Within each step in the process, there is a range of complexity that can be achieved, depending in part on a country’s level of maturity in information technology modernization and based on staff capability in the various disciplines necessary for CRM. This process will be briefly summarized below, but the purpose of this note is to highlight that effective CRM touches every part of the organization. This is illustrated through the introduction of the CRM Framework in Section III, which identifies key outputs from the CRM process that enable tax administrations to tailor their approach to support voluntary compliance, while enforcing compliance for taxpayers who demonstrate they do not intend to comply, using a balanced set of compliance treatments.

CRM is a structured, repeatable process with the primary purpose of identifying potential areas of noncompliance and developing strategies to address those compliance risks. The process should always follow the same order, and the process should be repeated at least annually, or more often if circumstances in the operating context change. As shown in Figure 1, the OECD’s CRM process consists of eight steps.

Figure 1.
Figure 1.

OECD CRM Process

Citation: Technical Notes and Manuals 2022, 005; 10.5089/9798400215216.005.A001

Source: OECD Guidance Note. 2004. “Compliance Risk Management, Managing and Improving Compliance.” Forum on Tax Administration Compliance Sub-group, Paris.

A brief introduction to the components of the process follows.

Operating context. This includes an evaluation of the environment in which the tax administration operates. This can include both internal and external factors. Internal considerations include the number and capability of staff that will impact the extent of effort that can currently be dedicated to the CRM work, although capacity can be strengthened over time. It could also include the level of digitalization of the tax administration, as well as organizational arrangements, which can impact decision-making powers. External considerations include the state of the economy, the legal framework, and existence of loopholes in the legislation that can be used to avoid paying tax, and the public’s attitudes and beliefs about paying tax.

Identify risks. This involves using the data available to the tax administration to identify patterns and trends that could represent noncompliance across the four pillars (registration, filing, reporting, payment). Segmentation of taxpayers into groups with similar characteristics is the first step in understanding the taxpayer population and in identifying potential compliance risks.

Assess and prioritize risks. Various methodologies are available to assess and prioritize risks. A common approach is a matrix model that compares the likelihood of a risk occurring, with the consequence or impact on the tax base if that risk does occur. This methodology allows tax administration leaders to make informed decisions on the appropriate treatments to address each risk.

Analyze compliance behavior. An important part of determining how best to address the identified compliance risks is understanding taxpayer behavior. A taxpayer’s attitudes toward compliance will impact their behavior. Compliant taxpayers generally know the legislation, file and pay on time. Noncompliant taxpayers can include those who actively seek to evade their tax obligations (intentional noncompliance) or those who misunderstand the law or its application (unintentional noncompliance). The administration should always look for the most cost-effective way of improving compliance. Education and assisted compliance are more cost effective than enforced compliance measures. As mentioned in Section I, the strategy will be different, based on the taxpayer’s attitude toward compliance, as well as the magnitude of the risk to the tax base.

Determine treatment strategies. After prioritizing the risks and evaluating taxpayer behavior, the next step is to develop a treatment strategy, which is typically comprised of a group of actions, which together form a compliance improvement plan for that risk. The treatment strategy may include components from across the three treatment categories: (1) preventative, (2) facilitative, and (3) enforced compliance. The strategy is called a Compliance Improvement Plan (CIP), and there is typically a separate strategy for each priority risk. CIPs can be designed for any priority risk but are often on a segment basis (large taxpayers, medium, small), or on an industry basis (construction, oil, gas).

Plan and implement strategies. With an agreed-on CIP, the number of activities to support each treatment in the strategy must be developed. This step operationalizes the strategy by identifying nationally, and for each region or district, how many of each type of activity it should perform to support the strategy.

Monitor performance against plan. As the regions and districts undertake the work, regular monitoring of results is necessary to enable reporting to management on the performance results. This allows management to assess the success of any particular treatment strategy.

Evaluate compliance outcomes. The last step in the process is to evaluate the impact of the CIP on compliance, both voluntary and enforced. The evaluation covers measures such as additional tax collected, as well as longer-term outcomes such as improved on-time filing or payment rates, measured over time.

III. The CRM Framework: How CRM Fits in the Broader Tax Administration Process

The CRM framework illustrates how CRM affects virtually every part of tax administration and how the results from the CRM process drive the operational workloads of the administration. As shown in Figure 2, the CRM framework has two dimensions: a horizontal dimension and a vertical one. The horizontal dimension shows the necessary inputs to, and the resulting outputs from, the CRM process as described in Sections IV and V, respectively. The vertical dimension shows how CRM is linked to other critical tax administration functions as described in this section.

Figure 2.
Figure 2.

CRM Framework

Citation: Technical Notes and Manuals 2022, 005; 10.5089/9798400215216.005.A001

Source: IMF staff.

The CRM framework is driven by an administration’s strategic goals and objectives. A tax administration’s strategy drives everything the tax administration does. At its core, a tax administration’s main responsibility is to collect tax revenues on behalf of government, to meet the social and economic goals of the country. To maintain trust in the tax system, the administration must be diligent in ensuring that all taxpayers pay the correct amount of tax under the law. Many administrations feature strengthening compliance as a key strategic objective.

CRM Organization Structure and Governance

To leverage the benefits of the CRM process, it is crucial to have a dedicated organizational focus. A dedicated unit or team to manage the CRM process is key for most administrations. In very small or very large organizations, adaptations to the recommended model may be appropriate. More information on these adaptations is contained in the CRM Framework series2 note on organization structure.

Dedicated staff, with the required skillsets, will position the tax administration to produce better results from its CRM activities. The number of staff dedicated to the work will depend on the individual tax administration and its data availability and staff capability. The key activities that the CRM unit will lead include (1) analyzing the internal and external environment; (2) analyzing the current tax administration data for indications of noncompliance; (3) collaborating closely with risk owners, who are the business line leaders for the various tax functions; (4) working collaboratively with risk owners to develop treatment strategies for the identified risks; and (5) developing CRM methodologies and practices and documenting them for future reference. The placement of the CRM unit in the organization can vary, but it should be a central Headquarters (HQ) function and be located within a program planning and design function, which is responsible for setting the strategy for that function and providing guidance to the operational units on how to conduct the work.

Ensuring strong management over the CRM activities is accomplished through good governance. Because CRM affects all functions, including taxpayer service, registration, filing, correct reporting, and payment, and all taxpayer segments (large, medium, small taxpayers), coordination of the work is necessary. The CRM unit will be responsible for leading the work, in consultation with the risk owners (business partners). This coordination is often done through the use of a cross-functional committee.

A CRM Committee should be established to bring all the CRM intelligence together in one place and to facilitate management decision-making on the most important risks to be treated. The CRM Committee would typically be chaired by the most senior leader in the tax administration. For purposes of this note, the term Director3 will be used to denote the most senior leader. Representatives on the committee would include the senior executives in charge of the CRM unit, as well as the risk owners, who are the Department heads. Typically, this committee would meet quarterly, or at least twice per year, to:

  • evaluate progress in addressing existing risks

  • confirm whether existing risks are still the highest priority risks for treatment

  • identify any emerging risks in the tax system

  • approve—on an annual basis—the compliance improvement plans (CIPs) for the upcoming year, including resource allocations aligned to the treatments identified

  • provide guidance to the CRM unit as required

  • review the performance results of the various treatment strategies and adjust as required.

Compliance risks are documented in a Compliance Risk Register (CRR), which serves as a historical record of the risks and approved strategies to address the risks. The CRR is described in more detail in Section V. With regular monitoring of key risks through the CRM Committee, the tax administration can be more agile in reacting to new risks as they emerge.

Annual Operational Plans

Having identified the key risks through the CRM process, the treatment strategies developed must be operationalized. A key output from the CRM process is the CIP, which will include details on the type of treatments to be conducted, as well as the number of each type of treatment. Accumulating this information for all CIPs, will then allow the administration to divide the work among HQ and the operational units in the regions and districts. This allocation of workloads and resources should be done annually with sufficient lead time for the regions and districts to plan for the upcoming work.

Operational Performance Measures

Monitoring performance results for all treatments throughout the financial year is critical. Not only is this important to evaluate the success of each treatment, but the tax administration can also compare the results of the treatment strategies collectively against the results obtained before using CRM principles. As the CRM approach is refined and staff become more adept at identifying risk, the performance results should continue to improve.

Evaluating results and incorporating this information back into the CRM process completes the cyclical nature of the process. For treatments that provided good results (improved voluntary compliance, reduced errors by taxpayers, additional revenue generated from enforced compliance), the administration can consider expanding the use of that treatment option. Where results were not achieved, consideration of a different treatment would be needed.

Performance results can support requests to government for additional funding. Insufficient funding is a common concern among tax administration officials. When the government needs to cut expenditures, tax administrations are often required to reduce their resources, making the risk-based approach of CRM even more useful for an administration to optimize their revenue results. Having statistics available to support the tax administration’s return on investment could help support requests for additional funding when resources are insufficient to address existing and emerging risks. When a tax administration can demonstrate through its performance results that for every $1 invested the tax administration collects, for example, $4 or $6 in additional revenue, a stronger argument can be made for additional resources.

IV. Inputs to the CRM Process

Several key inputs are required to build a mature CRM process (Figure 3). The CRM Framework shown in Figure 2 highlights five inputs to the CRM process. Tax administrations will have varying degrees of access and capability to use these inputs. Implementing CRM is a journey that can take some time, but, importantly, administrations should start with what they have, and build their processes and capabilities as time progresses. Even with limited availability to the inputs noted, an administration can start and achieve some success.

Figure 3.
Figure 3.

Inputs to the CRM Process

Citation: Technical Notes and Manuals 2022, 005; 10.5089/9798400215216.005.A001

Data and Data Management

To conduct analysis about compliance risks, data are needed. The information collected through tax returns and other declarations will be an important source of data for risk analysis. The authority to collect data is set out in legislation, but typically there is some latitude for administrations to prescribe what information they require to administer the tax laws. Administrations should think carefully about what data they request to ensure they have the information needed to assess compliance risks. External sources of data that are also useful for CRM include banking data, company registry information, as well as various customs import/export information.

More data are not always better. A common misconception is that the more data an administration has, the better. If an administration lacks the information technology (IT) infrastructure and the capabilities to utilize the data for CRM, there is little value in collecting the data. It is more important to have the right data. Administrations are urged to review what data are needed and make the best use of that data before seeking additional sources of data.

Data matching is an easy way to start data analysis. A common identifier such as a Taxpayer Identification Number that is used universally is an important enabler to data matching so that data from different sources can be easily compared. Comparing customs data to tax declarations is one example of data matching that often finds discrepancies that may represent noncompliance.

Information Technology Support for CRM

The degree of automation of CRM processes varies by country. For some countries that do not have CRM functionality in their IT systems, downloading data into software programs, such as Excel, will allow the administration to undertake some data analysis and matching. As an administration grows in CRM maturity, the matching processes can be automated for a higher degree of efficiency. The CRM function can then be further strengthened using a range of tools, techniques, algorithms, and analytic risk models that are designed to identify potential noncompliance. Examples include statistical analysis, outlier detection, pattern recognition, data mining, and machine learning. These can be externally sourced or developed in-house. The IT system is an important enabler of CRM, and functionality should be increased as resources and capabilities permit.

Business Experts and CRM Specialists

As CRM is implemented, new staff skillsets are required. For those working in the CRM unit, skillsets related to data analysis, pattern recognition, and identifying outliers are crucial. Data science as a discipline is progressing continuously. Tax administrations should develop a training path for staff working in the CRM unit to build their skills over time. Another important element of CRM is the business knowledge about existing compliance risks. Staff working in audit, for example, often see recurring patterns in the types of noncompliance found. Others working in taxpayer service may receive the same questions, which could point to a need for educational material, so taxpayers have the knowledge to report their tax obligations correctly. This intelligence is a critical part of the CRM process and should be captured. Collaboration between the CRM unit and the risk owners in reviewing the data and sharing knowledge about risks will provide a synergy of results that would not be possible individually.

Risk Practices and Tools

Various methodologies exist for assessing and prioritizing compliance risks. As mentioned, the likelihood and consequence matrix is one such model that is used in many administrations. Determining risk tolerances and documenting the criteria to determine how risks will be evaluated is an important part of an administration’s risk practices, to ensure objectivity and consistency of results.

Tax-GAP

A Tax-GAP4 analysis is a measurement tool that identifies both policy and compliance gaps in a country’s tax system. The GAP analysis provides a sense of where the revenue leakage is occurring. The analysis, which is conducted most often for the Value-Added Tax, can point to specific industry sectors as representing a higher share of the compliance gap. This allows administrations to target their compliance efforts more effectively. A subsequent Tax-GAP analysis can provide feedback on the success of treatment strategies taken in the interim, as the goal would be to see a downward trend in the compliance gap.

Other types of analysis can also contribute to a better understanding of noncompliance. These studies and analyses can complement a Tax-GAP or in the absence of a gap analysis, enhance the tax administration’s understanding of potential areas of noncompliance. Examples of these analyses include studies using administrative data and randomized controlled experiments, such as a random audit program.5

V. Outputs from the CRM Process

The result of the CRM process is a series of outputs that allow the tax administration to monitor and manage compliance risks (Figure 4). Each output discussed below, plays a role in managing compliance risks effectively.

Figure 4.
Figure 4.

Outputs from the CRM Process

Citation: Technical Notes and Manuals 2022, 005; 10.5089/9798400215216.005.A001

Intelligence, Profiles, Scans, and Studies

A key output of the CRM process is the intelligence about what factors are impacting compliance in the country. This knowledge can be leveraged into other products that will support staff in undertaking their duties more efficiently. Many countries develop industry profiles based on experience in managing the industry’s compliance, which outline key areas of risk and how to address or mitigate that risk. An industry profile for the construction sector, for example, would outline possible revenue recognition methodologies6 that are unique to the construction industry and document what is allowable for tax purposes based on the existing legislation. Another output of the CRM process is a study, which evaluates a risk hypothesis, potentially through the use of a pilot project, the results of which can be fed back into the CRM process.

Understanding the underlying causes of noncompliant behavior is also a key output. CRM is about treating the cause, not the symptom, and doing so in the most cost-effective way. If noncompliance is determined to be the result of a misunderstanding of the law, then doing more audits is not the best approach to ensure future compliance. Providing education on how the administration interprets the law will allow taxpayers to report correctly in the first place.

Compliance Risk Register

A CRR is a key management tool that records all important compliance risks, along with details on the risk rating assigned to that particular risk. The CRR is updated regularly to reflect changes in the risks or their ratings as new information becomes available or as a result of the treatment strategies employed to address the risk. The CRM unit is responsible for maintaining the CRR and for providing updates to the CRM Committee regularly.

Compliance Improvement Plans

The CIP is the tool used to document the risk analysis and the treatment strategy for a particular risk. A separate CIP7 is required for each risk approved by the CRM Committee as requiring mitigation through a treatment strategy.8 These comprise the highest risks to the country’s tax base or risks that require treatment due to their systemic nature, such as the informal economy.

CIPs are typically targeted to a taxpayer segment or an industry. Risks across the pillars of compliance (registration, filing, correct reporting, payment) are rated as high, medium, or low, and tailored treatment strategies are developed for each pillar based on the degree of risk. It is important to note that the treatments should range from preventative, to facilitative, to enforced compliance. The benefit of a CIP is that it helps overcome a possible silo approach where each of the key taxpayer obligations are managed in the tax administration separately without consideration of possible interdependent impacts on the other taxpayer obligations.

VI. Implementation Considerations

CRM is a driving force for revenue mobilization. Implementing CRM will support revenue mobilization efforts as the administration is targeting its efforts to promoting voluntary compliance and addressing the highest risks of noncompliance in a methodical, analysis-based manner. A CRM Committee will drive CRM across the organization. Clarity on organizational roles and responsibilities, along with collaboration across the organizational units, will bring the strongest results.

Avoid under-resourcing the CRM effort. A key risk to successful implementation is not sufficiently resourcing the CRM activities. Many administrations have a singular focus on revenue collection and are hesitant to divert resources on a full-time basis to the CRM activities. CRM can provide both short-term and longer-term revenue results, so the investment will produce results. There is no standard number of staff to dedicate to the CRM unit. Based on an administration’s available data, administrations are advised to start with a small team of two or three staff and to build the size of the team as the workloads grow.

The key is to get started. The model depicted in this note is a mature model and represents an end-state vision for tax administrations. For those at an early stage of CRM implementation, the recommendation is to use the data available to better understand the taxpayer population and begin conducting matching. Pilot projects can be used to test anomalies in the data or in matching discrepancies to evaluate the degree of risk. Incorporating lessons learned in the next analysis will continually improve results. Administrations are also encouraged to engage with development partners to assist in strengthening capacity.

Build as the administration grows in capacity. Given CRM touches virtually every part of the organization, strengthening administrative capacity around people, the tax administration systems, the available tools and data, as well as ensuring the legal framework supports the CRM effort should be a priority. This administrative strengthening should be conducted concurrently wherever possible.

1

For example, segmenting taxpayers by gender to better meet the compliance needs of women taxpayers, by size (large, medium, small) or by industry sector.

3

Other terminology includes Commissioner, Commissioner General, or Director General.

4

The IMF Fiscal Affairs Department’s Revenue Administration Gap Analysis Program provides revenue administrations with a comprehensive framework for estimating the gap between current and potential tax collections with the aim of evaluating their effectiveness in collecting taxes.

5

A random audit program seeks to understand the potential revenue leakage in the system by applying the value of noncompliance found in randomly selected cases across the entire population to arrive at estimated total noncompliance. A random audit program can also be used to measure the impact of risk-based approaches compared to random audit selection.

6

For long-term construction contracts, various accounting methods are available to determine when revenue under the contract should be recorded for accounting purposes (that is, percentage of completion, completion basis). The country’s laws should specify the allowable basis for reporting taxable income.

7

See IMF Technical Note “Compliance Risk Management: Developing Compliance Improvement Plans.”

8

See also Revenue Administration: Developing a Taxpayer Compliance Program.

  • Collapse
  • Expand