A corporate criminal offence tax risk assessment is the exercise that underpins your defence against the two offences in Part 3 of the Criminal Finances Act 2017: failing to prevent the facilitation of UK tax evasion, and failing to prevent the facilitation of foreign tax evasion. Both are strict liability, so prosecutors do not have to show that senior management knew what was happening. The only route to acquittal, once facilitation is proven, is evidence that reasonable prevention procedures were in place, or that none could reasonably have been expected. The risk assessment is where that evidence starts.1Legislation.gov.uk. Criminal Finances Act 2017 – Part 3 Do it properly and you have a documented, defensible view of your exposure. Do it badly and you face an unlimited fine, exclusion from public contracts, and reputational damage that no policy document can undo.
What the Assessment Has to Cover
Section 45 covers UK tax evasion, meaning fraud against HMRC involving income tax, corporation tax, VAT, or national insurance contributions. Section 46 covers foreign tax evasion, meaning conduct that is criminal in the country where the tax was owed and that UK courts would also recognise as tax fraud if it had happened here. That “dual criminality” test means multinationals need a working knowledge of the tax enforcement regime in every country their operations touch, not just UK law.1Legislation.gov.uk. Criminal Finances Act 2017 – Part 3
Both offences follow the same three-stage chain, and your assessment is built to address the third stage:
- A taxpayer deliberately cheats on their taxes. Aggressive planning is not enough; the conduct must be criminal.
- Someone acting on behalf of your organisation knowingly helps them do it. The facilitator must have criminal intent.
- Your organisation failed to have reasonable prevention procedures in place.
All three must be present for corporate liability to attach, and there is no minimum threshold for the amount of tax involved. Even small facilitation can trigger the offence.
One boundary matters enormously to a workable assessment: the offences target evasion, not avoidance. Evasion is deliberate dishonesty against a tax authority. Avoidance is the use of legal structures or reliefs to reduce a tax bill, and it stays legal even when HMRC challenges it. An assessment that treats all tax planning as suspect will strangle legitimate work; one that never spots fraud indicators leaves you exposed. Frame the scenarios you assess around concealment, misrepresentation, and fraud against a tax authority, not around aggressive positions taken openly.
Who Counts as an Associated Person
Section 44 defines associated persons broadly. An associated person is anyone performing services for or on behalf of the organisation while acting in that capacity, whether as an employee, an agent, or in any other capacity.1Legislation.gov.uk. Criminal Finances Act 2017 – Part 3 The Act tells you to look at all the relevant circumstances, not just the label on the contract.
In practice that pulls in independent contractors, external accountants, tax advisers, payroll providers, and joint venture partners. If someone negotiates deals, moves money, or files tax paperwork on your behalf, they are almost certainly inside the definition. Joint venture partners’ employees can trigger your liability when the partner is acting on your behalf. Subsidiaries fall in when they act in a capacity that serves the parent.
Not every associated person carries the same risk. People with direct access to billing systems, client accounts, or payment processes have more opportunity to facilitate evasion than an outsourced IT provider. Agents in jurisdictions with weak tax transparency need closer scrutiny. So do intermediaries handling cash or complex offshore structures. These are the relationships where facilitation is most likely and hardest to detect, and your assessment should weight them accordingly.
Gather the Documentation Before You Score Anything
A defensible assessment runs on evidence. Assumptions score badly under scrutiny.
Build an Associated Persons Register
Compile a register of everyone performing services on your behalf, sorted by role and function. Employees, agents, contractors, external tax advisers, payroll providers, and joint venture partners all belong on it. For each entry, note what they do, what access they have to financial systems or client accounts, and whether they handle tax-sensitive transactions. You cannot score risks you have not identified, and this register is the backbone of everything that follows.
Map the Jurisdictions
Where associated persons operate matters as much as what they do. For each country, check whether it participates in the OECD’s automatic exchange of information under the Common Reporting Standard, whether it has activated bilateral exchange relationships, and whether its own law treats tax evasion as criminal. That last point feeds directly into the dual criminality requirement for the Section 46 offence.2OECD. Tax Transparency and International Co-operation Low-transparency or weak-enforcement jurisdictions get flagged as higher risk.
Document Existing Controls and History
Write down the financial controls, approval workflows, and oversight mechanisms you already have, in enough detail that gaps become visible. Pull records from prior tax audits, internal compliance reviews, and any past reports of financial irregularities. If you already have anti-bribery procedures under the Bribery Act 2010, use them as a reference point; the corporate offences framework was built on the same structural model. Cross-reference existing controls against high-value or unusual transactions: complex offshore structures, cash-heavy operations, atypical payment routes. Training records belong here too, including frequency, coverage, and who has received what.
Score the Risks
Most organisations use a matrix that rates each risk by likelihood and impact, sorted into high, medium, and low. Larger or more complex businesses sometimes use numerical scales. Precision is not the point. Honest prioritisation is. Score inherent risk first, before factoring in what controls exist, so you get a clear view of what you are actually working with. An external agent handling large cash payments in a low-transparency jurisdiction scores nothing like an employee running domestic payroll, and the assessment should show that plainly.
Run the Gap Analysis
This is the core of the exercise. For every risk on the register, identify which existing policy, procedure, or control is meant to address it. A risk with no control is a gap. A risk with a control that is weak, outdated, or inconsistently applied is nearly as bad. The comparison shows whether your defences are proportionate to your actual exposure, which is precisely what the reasonable procedures defence turns on.3GOV.UK. Tackling Tax Evasion: Government Guidance for the Corporate Offences
Base every conclusion on evidence. “We have a policy” is not the same as showing the policy is followed, that staff know it exists, and that it has been tested against realistic scenarios. Tick-box gap analyses produce documents that look thorough and collapse under real scrutiny.
Produce the Report and Take It to the Board
The assessment culminates in a written report pulling together the risk scores, the effectiveness of existing controls, and the gaps found across every business unit. It should give the organisation a clear plan for where to strengthen oversight or build new safeguards. Present it to the board or senior management. Their engagement is not a nicety; top-level commitment is one of the six principles the government uses to judge reasonableness, and a risk report that never reaches decision-makers undercuts everything below it. The finalised report is your primary evidence that the organisation took its prevention obligations seriously before anything went wrong.
The Six Principles Your Assessment Will Be Judged Against
The government’s Section 47 guidance sets out six principles that define what “reasonable” looks like. Your assessment sits inside this framework and should be shaped by it.3GOV.UK. Tackling Tax Evasion: Government Guidance for the Corporate Offences
- Risk assessment. The organisation assesses the nature and extent of its exposure to associated persons facilitating tax evasion, documents the exercise, and keeps it under review.
- Proportionality. Prevention procedures match the risks actually faced, given the organisation’s nature, scale, and complexity. A small professional services firm and a multinational bank should not end up with the same manual.
- Top-level commitment. Senior management actively fosters a culture in which facilitating tax evasion is unacceptable, not a signed policy on a shelf.
- Due diligence. Risk-based checks are applied to people performing services on the organisation’s behalf, before problems materialise.
- Communication and training. Policies are communicated, embedded, and understood inside the organisation and among relevant external parties, with training scaled to the risk.
- Monitoring and review. Procedures are monitored and improved over time.
The guidance does not prescribe a single template. Departing from it is not automatically fatal if you can articulate why your approach is fit for purpose. If you cannot, that flexibility works against you.
When to Review and What Triggers a Fresh Look
A risk assessment is not a one-off. The monitoring and review principle expects ongoing attention, and procedures must stay proportionate to the risks you face at any given moment. Annual review works for most organisations. Smaller businesses with stable operations may justify a longer cycle. What matters is that the schedule tracks how fast your risk profile actually changes.
Some events should trigger an immediate review whatever the schedule says:
- Entering a new market or jurisdiction with unfamiliar tax enforcement.
- Mergers, acquisitions, or new joint venture arrangements. The combined entity inherits both risk profiles.
- New product lines or services, especially those involving complex financial structures, cross-border payments, or tax-sensitive transactions.
- Legislative changes, shifts in enforcement priorities, or new HMRC guidance.
- Internal incidents. A suspicious activity report, an employee raising concerns, or an audit flagging irregularities all mean the assessment needs updating right away.
If the Assessment Finds Something Already Happened
If the exercise uncovers facilitation that has already occurred, HMRC operates a voluntary self-reporting route through GOV.UK, and organisations in the regulated sector under the Proceeds of Crime Act 2002 must file a Suspicious Activity Report with the National Crime Agency first.4GOV.UK. Tell HMRC Your Organisation Failed to Prevent the Facilitation of Tax Evasion Self-reporting can support a reasonable procedures defence by showing willingness to cooperate and remediate, though it does not guarantee immunity from prosecution.