Corporate Tax Risk Assessment: A Checklist for CFOs and Audit Committees

The audit committee’s agenda for the next meeting covers financial performance, internal audit, and cyber security but not tax, which has been absent for six quarters.

A scrutiny notice arrives for a transaction completed a year and a half ago. Despite deal team structuring, legal review, and board approval, no one assessed the tax risks. Now, the CFO must explain the oversight.

A corporate tax risk assessment checklist bridges this gap through periodic reviews of direct tax, transfer pricing, GST, international tax, litigation, and governance.

This post gives CFOs and audit committee members a practical framework for bringing that picture together. It covers six risk categories, the questions to ask in each and a quarterly review you can run from next quarter onwards.

Why Tax Risk Belongs on the Audit Committee Agenda

Tax risk is foremost a compliance risk but it also is a financial reporting risk, a governance risk, a cash flow risk and a reputational risk. 

For CFOs and audit committees, the priority is to ensure tax returns are accurate, identify material tax risks, and monitor how they are managed.

Tax risk reaches the financial statements in four key ways:

• Tax provisions: Under Ind AS 12, Appendix C, uncertain tax positions must be measured on the basis of how likely the tax authority is to accept them. A weak position should already be reflected in the provision.
• Contingent liabilities and disclosures: Disputed demands that are not provided for are disclosed as contingent liabilities. Their size and trend are read closely by lenders and analysts.
• Audit and reporting: CARO 2020 requires statutory auditor to report statutory dues that remain unpaid because of disputes, with the forum where each is pending. It also requires reporting of income surrendered or disclosed in tax assessments that was not recorded in the books.
• Cash flow: Tax demands, interest, appeal-related payments, and delayed GST input tax credit can tie up cash even before a dispute is finally resolved.

The governance responsibility is equally important. Section 177(4) of the Companies Act, 2013 includes evaluating internal financial controls and risk management systems within the audit committee’s terms of reference. For listed entities, SEBI’s Listing Regulations also define the committee’s oversight responsibilities.

Yet tax often remains a compliance function: returns are filed, provisions are booked, and disputes are reported individually without a consolidated view of the group’s exposure.

A corporate tax risk assessment helps here. It gives the CFO and audit committee a structured view of material tax positions, control weaknesses, pending disputes, potential financial impact, and management’s remediation plans, enabling them to prioritise risks before they become larger financial or governance problems.

The Tax Risk Assessment Framework

A corporate tax risk assessment is a structured review of the group’s tax risks across six categories:

1. Direct Tax Compliance: income tax return filing, TDS compliance, deductions and exemptions
2. Transfer Pricing: intercompany transactions, benchmarking, documentation
3. Indirect Tax (GST): registration, classification, input tax credit, reconciliation
4. International Tax: cross-border transactions, withholding tax, treaty benefits, permanent establishment
5. Litigation and Disputes: ongoing assessments, appeals, and notices
6. Tax Governance and Controls: policies, processes, and oversight

For each category below, assess risk on three factors:

Factor	What to look at
Amount	Tax, interest and penalty at stake, including future years if the issue repeats
Likelihood	Strength of the legal position, past outcomes on the same issue, quality of documentation
Control	Whether a process exists to prevent, detect or correct the issue, and whether it works

The assessment creates a tax risk register outlining each risk, its likelihood, impact, existing controls, and responsible owner. The CFO reviews it quarterly, and the audit committee reviews it annually.

Risk Category 1: Direct Tax Compliance

Direct tax risk often builds through small, repeated errors across entities and branches. Incorrect TDS rates, advance tax shortfalls, unsupported deductions, and mismatches between books and tax records can remain unnoticed until a tax audit or assessment exposes them. 

For large companies, the priority is to ensure that compliance is consistent across locations and that exceptions are identified before they create additional interest, penalties, or expense disallowances.

CHECKLIST

• Return filing and tax computation: Are all entities filing returns within applicable deadlines? Does taxable income reconcile with the financial statements, tax adjustments, and final tax computation?
• Advance tax: Are quarterly installments based on updated profit forecasts and reconciled centrally? Shortfalls may attract interest under Sections 234B and 234C of the Income-tax Act, 1961.
• TDS/TCS: Are deduction rates, deposits, and returns checked monthly across all entities? Errors can trigger interest, penalties, and, where applicable, expense disallowances under Section 40(a)(ia).
• Deductions and depreciation: Are claims supported by appropriate documentation, and are depreciation schedules reconciled with the fixed asset register?
• MSME payments: Are payments to micro and small enterprises tracked against applicable timelines under Section 43B(h), with overdue amounts assessed for potential disallowance?
• Tax records and audit readiness: Do the books reconcile with Form 26AS, the Annual Information Statement (AIS), TDS returns, and applicable tax audit disclosures? Are filing deadlines and reporting requirements tracked for each entity?

Example: A ₹280 crore manufacturing group had three entities, each filing its own TDS returns without consolidated oversight.

A tax audit uncovered recurring TDS short-deductions of ₹18 lakh at one entity over two years, with an estimated ₹7 lakh in interest and penalties.

A tax risk assessment could have flagged the gap earlier.

Risk Category 2: Transfer Pricing

For multinational groups, recurring disputes often involve management fees, royalties, shared-service charges, and the profit margins earned by Indian subsidiaries. 

An adjustment in one assessment year can lead to further disputes if the underlying pricing method or benchmarking remains unchanged.

CHECKLIST

• Transaction coverage: Are all international transactions identified and reported? Have specified domestic transactions exceeding the applicable aggregate threshold been assessed for coverage?
• Benchmarking: Are comparable companies, margins, and the most appropriate method reviewed annually? Do the comparables reflect the Indian entity’s actual functions, assets, risks, and market conditions?
• Intra-group services and royalties: Is there evidence that services were actually received and benefited the Indian entity? Are royalty payments supported by agreements, commercial justification, and defensible benchmarking?
• Documentation and reporting: Is transfer pricing documentation maintained contemporaneously? Are the accountant’s report and applicable Master File and country-by-country reporting obligations assessed against the relevant thresholds and filing deadlines?
• Dispute prevention: Has management evaluated whether safe harbour rules or an APA could provide greater tax certainty?
• Recurring adjustments: Have previous transfer pricing adjustments been analysed for root cause? Has the company assessed whether the optional three-year block transfer pricing mechanism is suitable for similar recurring transactions? 

For Tax Year 2026–27 onward, companies should also verify the applicable requirements under the Income-tax Act, 2025 and Income-tax Rules, 2026, including the new Form 48, which replaces Form 3CEB for the relevant reporting framework.

Example: An Indian pharmaceutical subsidiary pays an 8% royalty to its European parent, supported by a benchmarking study using European comparables that do not reflect Indian market conditions.

The Transfer Pricing Officer challenges the analysis and proposes a ₹12 crore adjustment.

Reviewing the comparables, commercial rationale, and pricing methodology before filing could help identify and address the risk early.

Risk Category 3: Indirect Tax (GST)

GST risk in multi-location enterprises is largely because of reconciliation and control issues. Each state registration has its own compliance requirements, while transactions flow across branches, warehouses, vendors, and related entities. 

Small errors in ITC, classification, invoicing, or turnover reporting can accumulate across registrations, leading to tax demands, interest, penalties, and blocked working capital.

CHECKLIST

• Registration and returns: Are GST registrations active wherever required? Are GSTR-1, GSTR-3B, and applicable annual returns filed accurately and within deadlines?
• ITC reconciliation: Is credit claimed in GSTR-3B reconciled monthly with GSTR-2B? Are mismatches investigated, ineligible credits reversed, and supplier compliance issues monitored?
• Time limits: Is eligible ITC claimed within the applicable statutory deadline, generally 30 November following the relevant financial year or the date of filing the annual return, whichever is earlier?
• Classification and rates: Are HSN/SAC classifications, tax rates, and place-of-supply rules reviewed when products, services, or GST requirements change?
• Multi-state transactions: Are inter-branch stock transfers, related-party supplies, and cross-state transactions invoiced and reported correctly, including supplies between distinct GST registrations?
• Common input services: Where applicable, is the ISD mechanism used to distribute eligible common input-service credit across registrations in accordance with current requirements?
• Reconciliation and reporting: Does GST turnover reconcile with the financial statements and income-tax records? Are applicable GSTR-9 and GSTR-9C reconciliations completed for each GSTIN?

Example: A retail chain operating in 6 states discovers an ₹8 crore difference between GST-reported turnover and its financial records. The investigation reveals that inter-state stock transfers were recorded in one state’s books but omitted from GST returns. 

The discrepancy creates potential tax, interest, and penalty exposure. A central reconciliation of turnover, stock transfers, and returns across all GST registrations could have identified the gap earlier.

Risk Category 4: International Tax

Your international tax risks often arise outside the tax department through cross-border payments, employee assignments, intercompany arrangements, or overseas business decisions. 

Errors in withholding tax, treaty claims, or permanent establishment (PE) assessments can lead to unexpected tax liabilities in India or abroad.

CHECKLIST

• Withholding tax: Are payments to non-residents correctly classified and assessed for withholding obligations? Are applicable tax rates, treaty provisions, and Forms 15CA/15CB requirements checked before remittance?
• Treaty benefits: Are valid Tax Residency Certificates (TRCs), Form 10F where required, beneficial ownership evidence, and commercial substance documentation maintained? Have applicable treaty anti-abuse provisions been considered?
• Permanent establishment: Could employees, dependent agents, project activities, or services performed across borders create a taxable presence for the company or an overseas affiliate?
• Place of effective management: Are key strategic and commercial decisions of foreign subsidiaries genuinely made in the relevant jurisdiction, with supporting records?
• Cross-border financing: Have interest deductibility restrictions and applicable thin-capitalisation rules been assessed for debt involving overseas associated enterprises?
• Global minimum tax: Where the group falls within the scope of OECD Pillar Two rules, has management assessed potential top-up tax exposure and reporting obligations across relevant jurisdictions?
• Repatriation and foreign exchange: Are dividends, royalties, service fees, and other cross-border payments supported by appropriate tax documentation and compliant with applicable FEMA requirements?

Example: A ₹200 crore IT services company sent two senior managers to oversee its Singapore subsidiary for over 183 days without assessing whether their presence created a permanent establishment (PE) for the Indian parent.

This could expose the parent to Singapore tax on profits attributable to the PE. A tax risk assessment could have flagged the issue early.

Risk Category 5: Litigation and Disputes

Tax litigation becomes a business risk when disputes are tracked individually rather than assessed as a consolidated exposure. 

Direct tax assessments, transfer pricing adjustments, and GST demands can tie up cash through disputed payments, interest, and appeal-related deposits while consuming management time. 

Repeated disputes over the same issue can also indicate unresolved weakness in your underlying tax position or process.

CHECKLIST

• Consolidated litigation register: Are all direct tax, transfer pricing, and GST cases recorded in one tracker, showing the disputed amount, tax year, current forum, next hearing, response deadline, and responsible adviser?
• Exposure assessment: Has each material case been assessed for potential financial impact and likelihood of an adverse outcome, with assumptions documented and periodically reviewed?
• Provisioning and disclosures: Are disputed tax positions evaluated under the applicable accounting standards? Are provisions and contingent liability disclosures reviewed at each reporting date?
• Deadlines and recovery: Are notices, appeal deadlines, responses, stay applications, and pre-deposit requirements monitored centrally to prevent avoidable losses of appeal rights or cash flow disruption?
• Recurring disputes: Are cases grouped by underlying issue across entities and tax years? Has management identified whether a recurring adjustment can be prevented by changing a contract, pricing method, transaction process, or tax position?
• Litigation strategy: Are cases prioritised by value, precedent risk, business impact, and strength of evidence? Have appropriate settlement or tax-certainty options been considered where available?

Example: A ₹450 crore infrastructure group had 12 tax cases pending at various stages. The total amount in dispute was ₹28 crore. The cases had been pending for an average of four years. 

No one had assessed the likelihood of adverse outcomes or the adequacy of the tax provision. The audit committee discovered that the provision was insufficient by approximately ₹6 crore. The assessment checklist would have identified the provision gap.

Risk Category 6: Tax Governance and Controls

Your tax governance determines how effectively the other tax risks are managed. Even a capable tax team can leave the group exposed if responsibilities are unclear, significant tax decisions are undocumented, or the board receives updates only when a major demand arises. 

A consistent governance framework you identify risks early, apply controls across entities, and bring material decisions to the right level of management.

CHECKLIST

• Tax policy: Is there a documented, board-approved tax policy covering compliance, tax planning, risk appetite, and engagement with tax authorities?
• Ownership and accountability: Are tax responsibilities clearly assigned across entities and functions, with a designated owner for the group’s consolidated tax risk register?
• Compliance calendar: Is there a central tax calendar covering direct tax, TDS/TCS, GST, transfer pricing, and other applicable filing and payment deadlines?
• Internal controls: Are key tax processes included in the internal financial controls framework, with periodic testing of controls such as TDS deductions, GST reconciliations, ITC claims, and advance tax calculations?
• Decision documentation: Are material tax positions documented and approved before implementation, with the facts, legal basis, commercial rationale, and key risks recorded?
• Regulatory change management: Is there a defined process to assess changes in tax legislation, rules, circulars, and notifications, assign implementation responsibility, and update systems and procedures?
• Escalation and oversight: Are material exposures escalated promptly to the CFO and audit committee, with regular reporting on disputes, emerging risks, control failures, and remediation?
• Resources and audit trail: Is the tax function adequately staffed and supported by appropriate systems? Where applicable, is the accounting software audit trail feature enabled and preserved in accordance with the Companies (Accounts) Rules?

Example: A ₹500 crore manufacturing group had no common tax policy, and individual entities made tax decisions independently. When the group pursued a slump sale of a business unit, tax implications were assessed only after the agreement was signed.

Earlier review could have identified and evaluated alternative structuring options. A documented policy requiring tax review of material transactions before approval could have reduced this risk.

The CFO’s Quarterly Tax Risk Review

A corporate tax risk assessment is an ongoing process, not a one-time exercise.

Quarterly reviews led by the CFO and coordinated by the head of tax help keep exposures visible as laws, transactions, and disputes evolve, enabling management to address risks before they become significant financial or governance issues.

What the quarterly pack should cover:

Review area	What to report
Exposure summary	Total tax at risk by category, split into provided, disclosed as contingent and remote.
Movement	New notices, orders and assessments received; cases closed; changes in amounts.
Top risks	The five largest or fastest-growing risks, with likelihood, potential impact, accountable owner, mitigation plan and due date.
Compliance status	Advance tax, TDS, GST returns, tax audit and TP filings: on time or late, with reasons
Reconciliations	Status of relevant AIS, Form 26AS, GSTR-2B and financial statement reconciliations, with unresolved differences highlighted.
Law changes	New tax provisions, changes in business models, acquisitions, restructuring, cross-border transactions and their estimated impact
Control effectiveness	Control failures, recurring findings, overdue remediation actions and evidence that corrective measures are working.

Each quarter, ask the following:

• Has any provision or contingent liability changed by more than an agreed threshold, and why?
• Are any appeal or filing deadlines falling in the next 90 days?
• Has the same issue appeared in more than one entity or year?
• Has any recommendation from the last review not been completed?

Is my finance team and statutory auditor enough?

It is a reasonable question, especially when your company already has an experienced finance team and engages a statutory auditor. The difference is one of scope and purpose.

The finance team manages day-to-day compliance, while the statutory auditor reviews tax matters within the financial statement audit. Neither necessarily provides a consolidated, forward-looking assessment of tax risks across all entities, transactions, and jurisdictions.

A formal tax risk assessment with specialists like PKC Management Consulting helps you identify control gaps, evaluate dispute exposure, address recurring issues, and present a consolidated view of the group’s tax position to the audit committee. It complements existing compliance and audit processes.

Having said that, external support is not always necessary. An experienced tax team can maintain the framework internally, while external expertise can help establish the baseline, resolve backlogs, or assess complex groups with multiple entities, state registrations, and cross-border transactions.

How PKC Supports the Assessment

PKC’s tax advisory practice brings corporate tax, transfer pricing, international tax, GST and litigation into one team, which suits a review that has to cover all six categories together. 

A first assessment usually starts with existing returns, tax audit and TP reports, GST filings and the litigation tracker. These are consolidated into a single risk register, rated and ranked so the audit committee can see the full picture in one view.

If your audit committee does not yet see one consolidated view of tax exposure across all entities and taxes, a baseline assessment is the place to start. It sets up the register that every quarterly review will build on.

Request a Tax Risk Assessment

FAQs

What is a corporate tax risk assessment, and why does the audit committee need it?

A corporate tax risk assessment is a structured review of the group’s tax risks across six categories: direct tax compliance, transfer pricing, GST, international tax, litigation, and governance. The audit committee needs it to fulfil its oversight responsibility for financial reporting, internal controls, and reputational risk. It provides a consolidated view of the group’s tax exposure and the controls in place to manage it.

How often should a company conduct a tax risk assessment?

A full assessment should be conducted annually, with quarterly reviews of the tax risk register. The assessment should be updated whenever there is a material change in the business, tax law, or the group’s risk profile, for example, an acquisition, a restructuring, or a significant change in tax regulations.

What are the key risk categories in a tax risk assessment?

The six categories are: direct tax compliance (income tax, TDS, deductions), transfer pricing (intercompany transactions, benchmarking, documentation), indirect tax (GST registration, classification, ITC), international tax (cross-border transactions, withholding tax, PE risk), litigation and disputes (assessments, appeals, notices), and tax governance and controls (policies, processes, oversight).

How does a tax risk assessment differ from a tax audit?

A tax audit under Section 44AB is a statutory review of the books of account and the return. A tax risk assessment is a management review of the group’s tax risks across all categories. The tax audit looks at what has been filed. The tax risk assessment looks at what could go wrong, what controls are in place, and what needs to be improved.

How does PKC support CFOs and audit committees with tax risk assessments?

PKC’s corporate tax risk assessment is a structured diagnostic covering the six risk categories. The assessment produces a tax risk register with likelihood, impact, and mitigation assessments for each risk. The register is reviewed quarterly and presented to the audit committee. PKC also assists with tax governance framework design and implementation.