Introduction

Activity statements were introduced on 1 July 2000 as part of A New Tax System (ANTS).¹ They are the ATO approved forms used by taxpayers to report and remit certain tax obligations. ²

Under Australia's self-assessment taxation system, taxpayers are only required to provide a limited amount of information on activity statement forms regarding their relevant tax obligations. However, taxpayers are required to retain detailed records to substantiate the information provided in their activity statements.

The ATO uses a risk-based approach to identify activity statements (including activity statement refunds) that are at risk of being incorrect because:

• the large number of activity statements processed by the ATO limits the ATO's ability to conduct in-depth investigations of all the information it receives on activity statements; and
• taxpayers are only required to remit limited information on activity statements. The ATO may need to request additional information from taxpayers to determine whether the information on activity statements is valid. ³

An activity statement refund arises where the credit entitlements claimed on an activity statement are greater than the debts recorded on that statement. A taxpayer is entitled to receive a full activity statement refund amount where the taxpayer:

• does not have any other current primary tax debts (for example, unpaid Income Tax, Fringe Benefits Tax, or GST);
• has submitted all outstanding activity statements; and
• does not have a debt with another Commonwealth agency which is permitted to garnishee tax refunds.

In 2004–05, 68 per cent of the total value of activity statement refunds was claimed by large business, and the government and community sector.⁴ These claims account for two per cent of the total number of activity statements processed in 2004–05. Conversely, 97 per cent of all activity statement refunds claimed was made by micro, small and medium business⁵. However these refunds only accounted for 26 per cent of the total value of refunds claimed in 2004–05.

A High-Risk Refund (HRR)⁶ is a potentially incorrect refund claimed through an activity statement, which could result in a significant risk to revenue, or which could undermine the community's confidence in the ATO's administration of the tax system. The following are broad reasons why the ATO may classify an activity statement as a HRR: fraud; non-compliance with the tax law; misapplication of the tax law; and administrative error.

The following statistics illustrate the importance of having robust activity statement refund systems identify and resolve HRRs:

• HRRs account for 4 per cent (approximately 82 000 activity statements) of the total number of activity statement refunds processed in 2004–05;
• HRRs account for 45 per cent of the total value of activity statement refunds ($12.6 billion) processed in 2004–05; and
• through compliance activity applicable to HRRs, the ATO recovered approximately $450 million in 2004–05.

Objective and scope

The objective of the audit was to assess the ATO's administration of activity statement HRRs. Specifically the audit sought to:

• examine aspects of ATO governance relevant to its administration of activity statement HRRs. This includes: ATO planning, the integration between Lines to administer HRRs; corporate risk management processes; and performance management;
• assess the ATO's methodology and practice to identify and, if necessary, correct activity statement HRRs; and
• identify and assess the Information Technology (IT) and manual systems, processes and controls used by the ATO to process HRRs resulting from the lodgement of activity statements.

Overall Conclusion

The identification and resolution of HRRs has been a key management issue for the ATO since the introduction of the New Tax System in 2000–01. In 2004–05, the ATO processed approximately 2.1 million activity statement refunds. Of these, approximately 82 000 were identified as high-risk refunds worth $12.6 billion. The large number and high value of these refunds, combined with the limited information taxpayers are required to provide in activity statements, means it is important that the ATO has a sound risk-based approach to identify and resolve HRRs.

The cornerstone of the ATO's approach to identify and resolve HRRs is to assess the risk of an activity statement refund being incorrect before it is issued (this is also known as a pre-issue compliance approach). A key management challenge raised by this compliance approach is for the ATO to strike the right balance between obtaining assurance that the activity statement refunds it issues are valid, and the length of time it takes to process activity statement refunds.

The ATO has a well established governance framework in place to manage HRRs. This comprises a committee and management groups, the use of specific IT systems, and compliance staff from a number of functional areas to undertake specialist audit work on activity statement refunds. Although this framework does provide assurance that HRRs are being managed systematically, the ATO can improve its governance of HRR refunds. This would involve better coordinating its planning processes, developing a robust approach to assess and report on all aspects of activity statement refund processing, and clearly specifying the roles and functions of the relevant committee and management groups.

The ATO has undertaken work to identify and address risks applicable to the identification and resolution of HRRs. However, these risks were not clearly documented, or consistently reported. During the audit, the ATO commenced initiatives to improve its risk management processes.

The ATO uses a broad range of compliance products to identify and resolve high-risk refunds from simple telephone inquiries from ATO staff to taxpayers made before refunds are issued (pre-issue audits), to complex tax audits undertaken after a refund has been issued (post issue audits). Based on the data maintained by the ATO, it is difficult to determine the overall effectiveness of these compliance products to resolve HRRs. The ATO needs to develop and apply a robust methodology to determine the optimal combination, and overall cost effectiveness, of these compliance products.

The ATO uses the RRE IT system and the Refunder IT system to identify and process HRRs. The ANAO found that the ATO's ability to provide assurance around the correct operation of these two systems was mixed.

Although the ATO was able to provide robust assurance that the RRE IT system was operating correctly, it was not able to provide the same assurance for the Refunder IT system. The ATO needs to improve Refunder systems documentation and system testing to provide adequate assurance to the ATO Executive that this IT system is operating correctly.

The ANAO made seven recommendations aimed at strengthening the ATO's documentation, risk management and planning practices. The ANAO considers that the implementation of these recommendations will assist the ATO to determine whether it has an optimal balance of compliance products to resolve HRRs effectively, while also issuing timely activity statement refunds to taxpayers. The ATO agreed with all recommendations.

Key Findings

Background and context (Chapter 1)

With the introduction of ANTS in 2000–01, the ATO adopted a new approach to provide assurance that taxpayers were complying with their activity statement tax obligations. The cornerstone of this approach was assessing the risk of activity statements being incorrect before refunds are issued to taxpayers. Since that time the ATO has made significant and ongoing changes to the systems, processes and controls it uses to process activity statement refunds and identify HRRs.

After issuing a large, incorrect refund in 2001, the ATO adopted a conservative approach to identifying HRRs. This approach involved stopping large numbers of high value activity statement refunds for manual examination by ATO staff prior to being issued. This manual examination process to ensure the validity of refunds lengthened the time the ATO took to issue activity statement refunds.

A result of this conservative approach to refund processing was that the ATO received complaints from the community regarding the length of time taken to process activity statement refunds. In 2004–05, the ATO amended its conservative approach to decrease the time it takes to process HRRs.

Although timely refund processing is an important aspect of effective activity statement administration, the validity of the revenue refunded by the ATO is equally important. A failure of activity statement refund systems to effectively detect incorrect refunds has the potential to:

• impact Commonwealth revenue detrimentally; and
• undermine community confidence in the ATO's ability to manage the tax system.

A key challenge for the ATO is to achieve the right balance between issuing activity statement refunds in a timely manner, and establishing the validity of the refund.

High-risk refunds governance issues (Chapter 2)

The administration of activity statement HRRs is the responsibility of a number of different functional areas within the ATO. To provide assurance that HRR systems, processes and controls are coordinated well and managed effectively, it is important that the ATO has a robust governance framework that delivers a seamless approach to manage refunds.

The ANAO found that the ATO has a well established governance framework in place to manage activity statement refund processing (including HRRs). However, the ANAO considers that this framework could be strengthened by:

• improving planning processes for the ATO functional areas ⁸ responsible for activity statement refund processing;
• developing a robust approach to measuring the overall performance of activity statement refund processing which includes measures of both the timeliness and validity of activity statement refunds issued by the ATO;
• clearly specifying the roles and functions of the ATO committees and management groups responsible for monitoring activity statement refund processing and approving changes to activity statement processing; and
• establishing a fully effective Certificate of Compliance process. When operating effectively, this process will provide additional assurance that payments of public monies (including those related to activity statement refunds) are valid.

The ATO advised that it was making, or had made, progress to further enhance its governance arrangements around HRRs during the audit.

A risk-based approach to the identification and resolution of high risk refunds (Chapter 3)

The effective identification and timely resolution of HRRs using a robust risk-based approach is essential, given the large volume of work associated with activity statement processing, and the finite resources the ATO has to examine the validity of activity statement refunds.

The ANAO found evidence that the ATO had considered, and was addressing strategic and operational compliance risks relevant to the identification and resolution of HRRs. However, these risks were not clearly documented, or consistently reported. During the audit, the ATO commenced initiatives to reform its approach to risk management of HRRs. These initiatives had not been completed at the time of the audit.

The ATO uses a range of HRR compliance products⁹ to mitigate compliance risks relevant to identifying and resolving HRRs. If these products are not underpinned by a sound risk-based approach to compliance, there is the potential that: HRRs will not be identified, and the ATO will issue incorrect refunds; or valid refunds will be incorrectly identified as HRRs, and will be delayed from issuing.

The ANAO found that, based on data maintained by the ATO, it is difficult to determine the overall effectiveness of these compliance products. While analysis is undertaken for some products, the ANAO considers that it is now timely that the ATO analyses, and regularly reports on the performance of, all of its compliance products relating to HRRs. This will allow the ATO to determine whether it is using the ‘optimal balance' of compliance products to identify and resolve HRRs.

In mid 2004, the ATO extensively modified its conservative approach to identifying and resolving HRRs. These modifications included changing the automated tests applied by the Risk Rating Engine (RRE) IT system¹⁰ to identify HRRs. The ATO also introduced an ‘override policy', which excludes selected taxpayers' refunds from being fully assessed by the RRE. The ATO intended that the modifications would reduce the number and value of refunds delayed for manual examination, while improving the detection of incorrect or fraudulent refunds.

The ANAO found that ATO data shows some indications that the changes to the RRE tests, and the override policy, are successfully decreasing the overall time taken to process activity statements while increasing the total revenue adjustments made by ATO staff reviewing HRRs. Although these indicators are showing a positive trend, further analysis of this data needs to occur, and other measures of performance need to be explored, to fully understand these results. The ANAO considers that the ATO needs to develop, document and apply a methodology to assess the effectiveness of the override policy and the changes to the RRE tests.

High-risk refund systems, processes and controls (Chapter 4)

The ATO is heavily reliant on a number of complex IT systems, to process the large volume of activity statement refunds it issues to taxpayers. The failure of any one of these IT systems to support business processes and activities could result in incorrect refunds being issued, or in refunds being delayed unnecessarily.

The ANAO sought assurance that the ATO has effective controls in place for the two main IT systems used to identify and process HRRs. These IT systems are:

• RRE IT system. This is the principal IT system used by the ATO to identify HRRs before they are issued to taxpayers;
• Refunder IT system. This system is responsible for a number of functions applicable to refund processing, including offsetting refunds against garnishee commitments with applicable Commonwealth agencies, generating accounting transactions in individual taxpayer accounts, allocating Delayed Refund Interest (DRI) to taxpayers, and posting financial information to the ATO's financial management system.

The ANAO examined a range of controls that are essential to the effective operation of these two IT systems. Specifically, the ANAO assessed whether the Refunder and the RRE: had complete and accurate systems documentation; and whether robust system testing was undertaken for changes made to these IT systems.

Systems documentation
The ANAO found that the systems documentation for the RRE provides strong assurances that it is operating as specified, and in accordance with tax legislation and ATO policy.

In contrast the ANAO found that Refunder systems documentation lacks technical detail for certain functions, has inconsistent content, and changes to the system have not been incorporated appropriately in all cases. Without improvements to system documentation, it is difficult for the ATO Executive to be assured that this IT system is operating as specified.

System testing

The ANAO sought to examine a sample of relevant regression testing ¹¹for the two main activity statement refund processing systems (RRE and Refunder). The results of our analysis were that regression testing for the RRE is comprehensive and complete.

The ANAO found that the ATO did not conduct sufficient regression testing for a significant system change relevant to the Refunder system¹². Without comprehensive system testing it is difficult for the ATO to assess the effect of changes on the overall operation of the Refunder system and other related systems.

Manual controls

Manual processes and controls such as procedures documentation, staff skilling, and quality assurance are used to provide assurance that the work undertaken by compliance staff responsible for identifying and reviewing HRRs is timely and is consistent with relevant ATO policy and tax legislation. Overall, although some quality assurance results are below benchmark standards, the ANAO found that the manual processes and controls relevant to identifying and reviewing HRRs are sound.

Summary of the ATO's Response

Managing risk is an important imperative for the Tax Office. We welcome the ANAO's recognition of the Tax Office's well established governance framework to manage Activity Statement Refund processing and the suggestions to strengthen the framework.

The Tax Office supports the recommendations contained in your report and has provided a response to each.

Footnotes

1 There are two types of activity statements: Business Activity Statements (BAS) - which are used by taxpayers who are registered for the Goods and Services Tax (GST)) and Instalment Activity Statements (IAS) – which are used by taxpayers who are not registered for GST.

2 These specific tax obligations include: the GST; Pay As You Go (PAYG); Fringe Benefits Tax (FBT); Wine Equalisation Tax (WET); Luxury Car Tax (LCT); and deferred company instalment (COIN) obligations.

3 The amount and type of information contained in an activity statement does not allow the ATO to fully assess whether a refund claimed in that activity statement is correct. For the purposes of this audit, a valid activity statement refund is a refund that has been assessed using risk-based processes to determine whether the limited information provided in that statement is likely to be correct.

4 The Large Business includes all business entities that have an annual turnover of greater than $100 million. The government and community sector includes federal, state and territory government bodies and not for profit organisations.

5 Micro businesses are defined as entities with an annual turnover of less than $2 million as distinguished from small to medium business enterprises that have a turnover of between $2 million and $100 million annually.

6 Although the term High-Risk Refund (HRR) can also be used to describe certain income tax refunds, for the purposes of this audit, HRRs refer only to high-risk activity statement refunds.

7 An incorrect refund occurs where the ATO has paid to a taxpayer an amount to which they are not entitled.

8 At the time of the audit, eight teams are responsible for managing aspects of activity statement processing, ranging from IT support to activity statement refund compliance activity. These teams are situated throughout Australia, and are located within three ATO Lines: GST Line, Operations Line and the Information and Communications Technology Line.

9 The ATO uses approximately 20 different compliance products to mitigate HRR compliance risks. These products can range from the invasive (for example, large tax audits) to the less invasive (for example, telephone calls from ATO staff to taxpayers to confirm activity statement refund information).

10 The RRE is the main information technology system used by the ATO to identify HRRs.

11 Regression testing, is the process of testing which is used to assess whether system changes have an adverse or unexpected effect on existing system functionality. An example is whether particular RRE or Refunder system changes have an unexpected impact on other systems within the end-to-end refund process.

12 The ATO made a significant change to the Refunder system in May 2003. This significant change included the automatic calculation of DRI.