Five Common Flaws Related to Income Tax Controls (and How to Prevent Them)

Article three of a four-part series discussing ways to reduce risk and increase controls related to income tax accounting.

Two decades after the enactment of Section 404 of the Sarbanes-Oxley (SOX) Act, income tax-related material weaknesses continue to be a major issue for companies. With the costly ramifications of a weakness, the obvious question is: “How does a company prevent such an occurrence?” The simple answer is by implementing effective internal controls.

While all public companies must be SOX compliant, many have not refreshed income tax controls since initial implementation, which is a cause for concern. Several new items of guidance and alerts on internal controls have been issued by the Public Company Accounting Oversight Board (PCAOB). This new guidance has significantly changed the standards required to be SOX compliant. With an ever-changing tax compliance landscape, optimizing internal controls that can scale with your business can help you navigate challenges, mitigate risk, and maintain compliance.

Common Reasons Tax Controls Fail to Be SOX Compliant

Income tax is often seen as a separate, specialized area of a company’s financial statements. The preparation activities and control responsibility for income tax often lies outside the core accounting team with professionals who have deep technical tax knowledge but less experience with or visibility into auditing and internal controls procedures. Further, companies with strained or limited in-house tax resources may not prioritize income tax accounting and reporting until it is too late. In such an environment, setting time aside to refresh an area that isn’t seen as broken is difficult.

Common Flaws with Income Tax Controls

When tax controls fail, it occurs in one of two key areas: Either the controls are not adequately designed or they are not operating as intended. Income tax controls are often heavily focused on management review procedures. While management review controls can be efficient, it is critical that they are designed appropriately, documented thoroughly, and executed effectively. There are five common pitfalls in the design of tax controls:

1. Missing control(s) - The income tax provision comprises numerous calculations affecting all areas of the financial statements. Many of these calculations require significant judgment and technical knowledge. Sufficient control procedures to cover all material areas of the provision and all areas of significant judgment should be in place. However, it is unlikely that one overarching management review control can cover all the areas of an income tax provision.
2. Lack of adequately defined procedures - With so many unique calculations and judgment items within the income tax provision, companies may attempt to write one vague control that doesn’t clearly identify the nature of the review procedures performed on each key component of the income tax provision. Simply stating something along the lines of “management reviews the calculations” doesn’t provide sufficient detail about the procedures a reviewer performs to gain confidence in the calculation.
3. Undefined investigation criteria or precision - The controls don’t clearly indicate what events or characteristics (e.g., dollar amount, percentage) will trigger further investigation into items within the income tax provision. For consistency in monitoring, it’s important to clearly define what factors will cause the reviewer to explore the cause of the outlier identified.   
4. Lack of supporting evidence of review - While effective procedures may be designed and performed, in some instances, the actual activities performed and reviewed are not captured, documented, and retained. For example, initials on a workpaper are not an indication of the actual activities that were performed or adequate evidence of management review. 
5. Appropriate Information Produced/Provided by the Entity (IPE) — IPE is considered any information, regardless of the form, produced by the entity’s personnel, information systems (including report writers), or third-party service organizations used by the entity as part of its internal control process. Controls may lack specificity on what evidence is available to support that the control was performed and reviewed by management, which includes validation of the completeness and accuracy of the IPE (e.g., reports used with parameters retained, validation of spreadsheets).

Time to Refresh

If this sounds familiar, it’s probably time to take a closer look at your internal controls procedures. Improper design and execution of internal controls can result in material weaknesses leading to costly remediation, even if management review procedures are in place. Because many tax departments do not have the bandwidth to focus on the income tax provision, co-sourcing services and partnering with income tax professionals to address these issues can fix those flaws, helping to ensure you have the proper processes and procedures in place.