Background

Income tax in 2005–06 accounted for 74 per cent of total revenue collected by the Australian Taxation Office (Tax Office). Income tax includes personal tax, company tax, capital gains tax and taxation of superannuation funds, including the superannuation contribution surcharge.

Australia's taxation system of self assessment places a responsibility on taxpayers to declare all of their assessable income and claim only deductions and/or offsets to which they are entitled. In administering the taxation system, the Tax Office has to balance the underlying principles of self assessment with the need to protect Commonwealth revenue.

The Tax Office uses information supplied by taxpayers to calculate the net amount of income tax payable or refundable. In 2005–06 the Tax Office processed around 8.3 million income tax refunds for individuals. The refund amount paid ($13.4 billion) exceeded Budget estimates by $307 million or 2.3 per cent. In the same period, around 1.5 million micro enterprises received income tax refunds amounting to some $5.5 billion.

Over the last ten years, total annual income tax refunds paid to individual taxpayers have increased from $8.8 billion to $17.2 billion.¹ Growth in income tax refunds, over the 10 years, has exceeded relative growth in income tax collections by 2.7 per cent.² During recent periods, the Tax Office has reported an escalation in the amounts being claimed as work related expenses and rental income expenses. The non-disclosure of income and benefits is also a compliance risk for the Tax Office.

High risk income tax refunds

The Tax Office began to increase its focus on high risk income tax refunds in 2002 when it created the Refund Integrity Steering Committee, now known as the Credit Refund Integrity Steering Committee (CRISC), and the position of Tax Office Refund Integrity Custodian. The Tax Office defines a high risk income tax refund as a ‘potentially incorrect refund claimed through an income tax return, that could result in a significant risk to revenue, or that could undermine the community's confidence'³. In practice, where an income tax refund is tested and meets certain risk based criteria, the Tax Office classes the refund as high risk. These criteria are coded in the Tax Office's return processing system, the National Taxpayer System (NTS).

Historically, each year, the Tax Office had reviewed around 6700 high risk income tax refunds payable to individual taxpayers. In the 2004–05 Budget the Tax Office received additional funding to, in part, increase its coverage of high risk personal income tax refunds. Over the four years of the funding, the Tax Office committed to undertake reviews of an additional 34 100 high risk income tax refunds. The Tax Office expected the additional reviews to result in income tax refund adjustments of $44.2 million.

Changes made to the Tax Office's NTS high risk income tax refund test criteria resulted in a significantly larger number of income tax refunds being identified as potentially high risk. The Tax Office subjects all income tax refunds classified as high risk to additional verification procedures, either manual review by a high risk refund case officer or a combination of system based and manual review processes. During 2005–06, due to the significant increase in the number of high risk income tax refunds, the Micro Enterprises and Individuals Business Line reviewed 31 560 high risk income tax refunds payable to individual taxpayers, and made revenue adjustments of around $41 million.⁴ In the same period, the Client Account Services Business Line separately reviewed 52 240 income tax refunds relating to both individuals and other taxpayers and made adjustments in the order of $50 million.⁵

The Tax Office's high risk income tax refund compliance approach

In administering income tax refunds, the Tax Office aims to pay the correct refund amount to the right taxpayer in a timely manner. The Tax Office's processes for administering high risk income tax refunds are designed to ensure the integrity of the refund process and mitigate associated risks. This includes potential fraud, errors in income tax return preparation and large or unusual refund claims.

The Tax Office's 2006–07 Compliance Program states that it will check high risk income tax refunds against a set of criteria determined by intelligence from its compliance activities, prior to payment. The Tax Office may also match income tax return information with other data, and contact taxpayers or third parties to verify information included on income tax returns. Although the Tax Office's high risk income tax refund strategy focuses on the pre issue review of income tax refunds, related compliance risks are also managed through the Tax Office's broader compliance programs. These range from education and advice to active compliance and enforcement activities.⁶

Audit objective and scope

The objective of the audit was to assess the effectiveness of the Tax Office's compliance approach for high risk income tax refunds in the individuals and micro enterprises market segments. The audit examined three key areas:

• management and organisational arrangements relating to high risk income tax refund processes;
• processes and procedures for identifying high risk income tax refunds, and the processes and tools used to evaluate and verify taxpayers' entitlements to income tax refunds; and
• information technology systems, processes and controls supporting the processing of income tax returns and refunds.

Overall Conclusion

In administering high risk income tax refund processes, the Tax Office seeks to balance client service against the need to maintain refund integrity and protect Commonwealth revenue. The Tax Office's governance framework supports the administration of high risk income tax refunds. The Credit Refund Integrity Steering Committee (CRISC), which oversees the income tax refund process, provides coordinated guidance and is involved in the ongoing administration of high risk income tax refunds. The Tax Office has also implemented risk based frameworks to identify and assess high risk income tax refunds.

The Tax Office, in recent years, has identified as high risk and consequently reviewed prior to payment, income tax refund claims that are equal in total value to more than half of the value of all income tax refunds paid. The income tax refunds reviewed were payable to less than 2 per cent of taxpayers. However, following review or verification, the Tax Office has historically adjusted only 3 to 6 per cent of income tax refunds that it has classified as high risk.⁷ This indicates that prior to payment the Tax Office is withholding all higher value income tax refunds for review, as they potentially represent a significant risk to revenue and/or may be difficult to recover if paid. Nevertheless, due to the relatively low number of these refunds that are adjusted, there is considerable scope for the Tax Office to refine its high risk income tax refund tests to better target the underlying risks associated with the payment of high risk income tax refunds. This would have the dual benefit of better targeting Tax Office resources on income tax refunds that represent an actual risk to revenue, while reducing the average elapsed time for the processing of high risk income tax refunds.

The ANAO acknowledges that the Tax Office currently has limited ability to assess the effectiveness of its high risk income tax refund tests, due to technical limitations in its information technology systems. This impairs its capacity to complete sensitivity or other analysis to refine the scope of its high risk income tax refund tests.

The ANAO found that the Tax Office has focused on understanding the behaviour of taxpayers' whose income tax refunds have been identified as high risk. Consequently, there would be benefit in the Tax Office giving greater emphasis to understanding the changing environment and dynamics of taxpayer behaviour that may influence the broader population of taxpayers to make claims for large and/or unusual income tax refunds. Adopting such an approach would provide a more balanced strategy for addressing income tax refund risks across the individuals and micro enterprises market segments.

As part of the audit, the ANAO examined the information technology systems, processes and controls supporting the processing of income tax returns and refunds. The ANAO considers that the Tax Office needs to strengthen its information technology and security controls around the Risk Assessment Profiling Tools (RAP Tools).⁸ Related information technology and security control weaknesses have exposed the Tax Office to the risk of fraud and processing error. The Tax Office is progressively implementing strategies to mitigate the risks posed by operation of the RAP Tools.

The ANAO completed a performance audit of the Tax Office's administration of activity statement high risk refunds in March 2006.⁹ The ANAO made seven recommendations aimed at improving the Tax Office's administrative practices relating to its administration of activity statement refunds. The ANAO recognises that while the processing of activity statement and income tax refunds is administered by different business areas of the Tax Office, some common themes relating to risk management, systems based identification of high risk refunds, and information systems development have emerged in both audits. In implementing its new tax administration system and associated business processes, the Tax Office has the opportunity to address these issues from a whole of agency perspective.

Key audit findings

Management arrangements (Chapter 2)

Within the Tax Office the CRISC has been given the responsibility to mitigate risks associated with the credit and/or refund process. These risks include fraud, over claim of entitlement and error (either taxpayer or Tax Office). The CRISC's role has evolved over recent years with the committee extensively involved in ongoing administration of high risk income tax refunds. The CRISC provides:

• governance and leadership in managing credit and/or refund risks;
• maintains a risk methodology and framework; and
• assesses and endorses significant system or work practice changes, that may have an impact on the Tax Office's credit and/or refund controls.

The audit identified two areas where the Tax Office's management arrangements in relation to the administration of high risk income tax refunds could be enhanced. These relate to the Tax Office:

• improving its understanding of the risks associated with the administration of high risk income tax refunds and using this information to refine its high risk income tax refund controls; and
• enhancing its external reporting, in particular reporting to the Government through its Compliance Challenges reports and annual reports. Existing high risk income tax refunds information reported for individuals, only relates to cases actioned by the Micro Enterprises and Individuals Business Line and not cases actioned by the Client Account Services Business Line. Therefore, the information reported does not relate to total cases actioned for the individuals market segment.

Identifying and assessing high risk income tax refunds (Chapter 3)

The Tax Office focuses on managing income tax refunds identified as high risk as part of the income tax assessment process. The Tax Office classifies approximately 2 per cent of all income tax refund claims, as high risk. In 2005–06 high risk income tax refunds accounted by value, for more than half of all income tax refunds paid.

High risk income tax refunds once identified are subject to additional manual and/or system based verification procedures. The Tax Office has developed system based RAP Tools to assist with the automated testing of high risk income tax refunds. Approximately 84 per cent of high risk income tax refund claims made in 2006–07 were reviewed by the RAP Tools with the remainder being manually reviewed by high risk refund case officers.¹⁰ Those high risk income tax refunds which fail the RAP Tools tests are similarly subject to manual review. High risk income tax refunds that have been assessed by the RAP Tools as lower risk are processed for release to taxpayers without further review and/or verification.

To maintain refund integrity in a dynamic environment it is important that the Tax Office collects, analyses and uses risk based information to support ongoing development of its information technology systems' controls. The ANAO found that the Tax Office has focused on managing only identified high risk income tax refunds. These are income tax refunds which are potentially payable to less than 2 per cent of taxpayers.

To provide assurance that key underlying risks associated with the administration of high risk income tax refunds in the individuals and micro enterprises market segments are being identified, the ANAO has recommended that the Tax Office consider developing a specific post issue income tax refund compliance strategy. This strategy would have regard to broader compliance risk issues and assess whether the Tax Office's existing pre issue high risk income tax refund tests are effective in targeting non compliance. The Tax Office could use the information and/or intelligence gained as an input into any broader Tax Office strategic risk assessments of income tax refund processing and the further development of its high risk income tax refund tests.

As a measure of the effectiveness of the Tax Office's controls supporting the processing of high risk income tax refunds, the ANAO reviewed the value and number of income tax refunds recorded by the Tax Office as having been incorrectly paid. The Tax Office advised that an ‘incorrect refund register' was not fully implemented until May 2005. Between June 2005 and June 2007, the Tax Office recorded the incorrect payment of $283 434 in high risk income tax refunds to individuals and micro enterprises. The Tax Office indicated that it had been able to recover approximately 80 per cent of the value of high risk income tax refunds incorrectly paid to individuals and micro enterprises.

The Tax Office has review processes to verify the accuracy of refunds where they have been identified as having been incorrectly paid. These processes are currently manual and only undertaken on a selected case-by-case basis. The Tax Office in reviewing incorrect refunds is well positioned to identify system or business process weaknesses. The ANAO considers that following the introduction of the Tax Office's new tax administration system, it should systematically analyse all incorrectly paid high risk income tax refunds, in order to identify and address system or business process weaknesses, and identify other potentially incorrectly paid high risk income tax refunds.

Information technology systems, processes and controls (Chapter 4)

The Tax Office's two main information technology systems used to identify and assess high risk income tax refunds are NTS and the RAP Tools. Both NTS and the RAP Tools are to be replaced in late 2007 when the Tax Office introduces its new tax administration system, as part of its Easier, Cheaper and More Personalised Change Program.

Change management and systems development

Sound management practice suggests that agencies should have in place change management processes that support development and modification of their information technology systems. Changes to, and maintenance of, the NTS is subject to the Tax Office's formal change management and systems development methodologies. The ANAO was advised that no changes have been made to the NTS's high risk income tax refund tests since Tax Time 2004.¹¹ The ANAO reviews the change processes associated with Tax Time each year as part of its audit of the Tax Office's financial statements.

The Refund Integrity Team developed the RAP Tools outside of the Tax Office's change management policies and procedures, including those procedures relating to system design and development. When the CRISC was requested to approve the current operation of the RAP Tools in late 2005, it identified that the documentation and governance supporting the RAP Tools was below standard. The Refund Integrity Team, who developed the RAP Tools, subsequently developed business requirements and other systems documentation in order to obtain CRISC sign off of the system. Notwithstanding, due to the limited nature of the Tax Office's documentation around the RAP Tools, the ANAO is not able to confirm that all aspects of the RAP Tools have been adequately tested and/or align with user requirements.

User access and security

The regular and ongoing review of user access to the Tax Office's systems is an important control mechanism. This supports timely revocation of user access and maintenance of appropriate access levels for individual staff in the execution of their duties. A Tax Office review of Case Reporting System¹² user access in mid 2006, identified a large number of users who no longer required access to the System. In line with the Tax Office's national information technology security policy and ACSI 33¹³ guidelines, the Refund Integrity Team should periodically review all user access to the Case Reporting System.

The Refund Integrity Team controls administrator level access to the RAP Tools. The logging of user access and changes to the system is critical to provide an adequate audit trail of users' actions within the systems. The ANAO noted that the systems do not incorporate user access logging and consequently the Tax Office does not maintain an adequate audit trail of a users' actions within the systems.

Agencies should have clear and segregated levels of responsibility, particularly over information technology systems development, operation, technical support and security administration. The ANAO found that a single individual had been responsible for systems development, aspects of systems testing, release management, support and ongoing systems maintenance of the RAP Tools. The ANAO considers that the lack of segregation of duties in relation to the RAP Tools has exposed the Tax Office to a higher than acceptable level of fraud risk and processing error. The Tax Office advised that the systems developer moved to a new position in mid July 2007 and that other members of the Refund Integrity Team are now providing support for the systems.

Information technology systems threat and risk assessments, generally consider internal and external threats largely from an information technology security perspective. The ANAO noted that no threat or risk assessment had been completed for the RAP Tools or Case Reporting System. Further, operation of the RAP Tools has not been reviewed from a fraud control perspective. The ANAO expected that the Tax Office would have considered operation of the RAP Tools in preparing its Micro Enterprises and Individuals Business Line Fraud Control Plan, finalised in mid 2007. The Tax Office advised that it will consider development and operation of the RAP Tools in preparing the Client Account Services Business Line Fraud Control Plan, as it is the business owner of the system.

The ANAO observed that the Tax Office has adopted a risk based approach where by it is implementing strategies to mitigate the risks associated with the continued operation of the RAP Tools and Case Reporting System. In this regard the Tax Office is aiming to balance client service and refund integrity.

Recommendations

The ANAO has made five recommendations. The first four recommendations focus on strengthening the Tax Office's management arrangements and risk identification process supporting the administration of high risk income tax refunds. The final recommendation in the audit relates to improving the Tax Office's information technology controls supporting the ongoing operation of the Tax Office's income tax refund RAP Tools which are key systems used to identify and assess high risk income tax refunds.

The Tax Office has agreed to the five recommendations made in this report.

Summary of agency response

The Tax Office welcomes the ANAO's recommendations in relation to the administration of high risk income tax refunds in the individuals and micro enterprises market segments and will adopt them in full (with the clarification at Recommendation 2). The Tax Office accepts that many of the ANAO's recommendations are the result of the technical limitations of its existing information technology systems.

The introduction of an entirely new tax administration system, as part of the Easier, Cheaper and More Personalised Change Program, will provide the Tax Office with the opportunity to complement and build on existing manual processes for assessing risks, undertaking reviews and reporting on and/or analysing outcomes in relation to high risk income tax refunds.

It is encouraging to note that although the ANAO identified areas for improvement, it was supportive of the overall approach that the Tax Office has taken in administering high risk income tax refunds. That is, an approach that seeks to balance the delivery of timely refund processing in a self assessment environment with the need to maintain refund integrity and protect Commonwealth revenue.

Footnotes

^{1 Commissioner of Taxation 2006, Commissioner of Taxation Annual Report 2005–06, Canberra, p. 84.}

^{2 Including the impact of the Family Tax Benefit, Baby Bonus and Private Health Insurance Rebate, growth in income tax refunds has exceeded growth in income tax collections by 20.3 per cent.}

^{3 Definition supplied by the Tax Office's Credit Refund Integrity Steering Committee in November 2006.}

^{4 Commissioner of Taxation 2006, Commissioner of Taxation Annual Report 2005–06, Canberra, p. 139.}

^{5 ibid., p. 139.}

^{6 The Tax Office publishes a Compliance Program booklet each year that outlines risks to Australia's taxation system and how the Tax Office is proposing to use its resources to address those risks.}

^{7 The adjustment rate has been calculated by dividing the number of high risk income tax refunds adjusted by the number of high risk income tax refunds identified by the NTS's high risk income tax refund tests. The Tax Office advised that it calculates strike rate by dividing the number of high risk income tax refunds adjusted by the number of high risk income tax refunds manually reviewed by high risk refund case officers. Calculating the strike rate in this way increases the ratio of cases adjusted to between 7 and 14 per cent.}

^{8 The RAP Tools are key information technology systems supporting high risk income tax refund processing.}

^{9 Australian National Audit Office 2006, Audit Report No.35 2005–06, The Australian Taxation Office's Administration of Activity Statement Refunds, Canberra.}

^{10 The RAP Tools are only applied to selected high risk income tax refunds that have failed one of a number of the NTS high risk income tax refund risk based tests.}

^{11 Tax Time is the Tax Office's annual information technology development process for maintenance of its key information technology systems. A well developed information technology governance process supports Tax Time.}

^{12 Access to the RAP Tools is controlled through the Tax Office's Case Reporting System. The Case Reporting System is also used to manage workflow, and record and monitor high risk income tax refund case outcomes including adjustments.}

^{13 Australian Government Information and Communications Technology Security Manual, ACSI 33, released by the Defence Signals Directorate on 29 September 2006.}