Share with your friends

HMRC: Revised Business Risk Review

HMRC: Revised Business Risk Review

HMRC have now circulated guidance concerning the new Business Risk Review process that will be introduced from 1 October 2019.

Chris Davidson

Tax Director

KPMG in the UK


Also on

HMRC have circulated guidance concerning the new Business Risk Review (BRR) process that will be introduced from 1 October 2019. The new BRR methodology is intended to introduce more flexibility by increasing the number of risk categories which determine the level of resource that HMRC devote to large businesses from two to four and by applying a separate analysis to each area of tax, but it remains to be seen how this will work in practice and the consequences of being placed in each category are still unclear.

The introduction of the new methodology follows a pilot exercise which was primarily intended to determine whether those businesses dealt with by HMRC’s Large Business Directorate could sensibly be split into four risk categories: Low, Moderate, Moderate-High and High, replacing the existing Low Risk and Not Low Risk ratings.

The feedback received from the participants was generally positive and so the pilot methodology remains largely intact. This involves the measurement of risk by reference to a series of ‘indicators’ of low risk, the final categorisation being determined by the number of indicators that are present under each of three headings: Systems and Delivery, Internal Governance and Approach to Tax Compliance. These indicators are applied to each area of tax separately, the objective being that HMRC can focus their resource on those areas of greatest risk.

It is HMRC’s view that the indicators are not intended to be used as a checklist but it is not obvious how the guidance can be interpreted otherwise and it remains to be seen how they will be applied in practice, specifically how Customer Compliance Managers (CCMs) will distinguish between those indicators that are critical for an individual business and those that are of less significance. HMRC are incorporating guidance within their CCM training programme but the published guidance is silent on this point and so inconsistencies of approach are almost inevitable.

Nor is it clear what the practical consequences of being placed in each category will be. The FAQs that accompany the guidance suggest that a low risk rating will result in ‘fewer interventions’ by HMRC and a BRR will only be carried out every three years. However, it goes on to say that BRRs for businesses in the moderate, moderate-high and high risk categories will ‘usually’ be carried out annually and so the differences between the implications of those ratings and for example the incentive to take the steps necessary to move from moderate-high risk to moderate risk remain unclear. It is hoped that we will have clarity in this respect when HMRC have developed their thinking further.

One aspect of the guidance that is welcome is a clear statement that complex businesses can still be low risk if they meet the behavioural risk indicators i.e. their systems and controls are sufficiently robust to mitigate the increased level of risk that arises from their complexity. This has always been HMRC’s view centrally but many CCMs have expressed the view that businesses cannot be low risk because of inherent factors. Hopefully, the guidance will be sufficient to prevent such conclusions in the future.

For further information please contact:

© 2021 KPMG LLP a UK limited liability partnership and a member firm of the KPMG global organisation of independent member firms affiliated with KPMG International Limited, a private English company limited by guarantee. All rights reserved.

For more detail about the structure of the KPMG global organisation please visit

Connect with us


Want to do business with KPMG?


loading image Request for proposal

Save, Curate and Share

Save what resonates, curate a library of information, and share content with your network of contacts.

Sign up today