Beta This part of GOV.UK is being rebuilt – find out what beta means

HMRC internal manual

Compliance Operational Guidance

Supporting Guidance: employer compliance: guidance by subject: commencing the compliance check: risk based systems audit (RBSA)

Risk Based Systems Audit is a review methodology that has developed over many years. It has evolved into a process, universally accepted in the accountancy profession that will:

  • enable you to deal with the ever increasing size and complexity of the businesses that you visit and
  • reduce the amount of time spent on issues with little or no risk whilst undertaking a compliance check.

You will explore in detail the reasons why specific processes were put in place and how these work in practice. By understanding the business needs you will be better able to

  • understand and advise how best these processes can support the employer/contractor in meeting his statutory obligations
  • identify any inaccuracies at an early stage
  • decide after discussion with the employer/contractor, the extent of records examination and testing required.

A risk based systems audit approach has at its core the necessity to understand the systems and controls put in place by the employer/contractor to enable the business to function properly and to enable the employer/contractor to meet his statutory obligations.

You need to use effective questioning (COG905275) to:

Understand the overall objectives of the employer/contractor

What does the employer/contractor do, how do they do it and what type of employees/subcontractors do they need to achieve results?

For example:

  • weekly paid staff working on production
  • salaried sales representatives who also receive commission (and possibly travelling expenses)
  • directors who receive an annual bonus
  • subcontractors required by trade types.

Top of page

Establish what type of systems the employer/contractor has set up to support the business

For example:

  • are there weekly, monthly and/or separate director payrolls?
  • how are the employees paid?
  • what type of expenses are paid and how do the employees make a claim?
  • what are the systems for making statutory returns of:

    • Full Payment Submission (FPS) (from 6 April 2013)
    • Employer Payment Summary (EPS) (from 6 April 2013)
    • Earlier Year Update (EYU) (from 6 April 2013)
    • P35, P14s (up to and including 2012-13)
    • P11Ds, P11D(b) (if benefits have not been voluntarily payrolled)
    • CIS36 (to 5 April 2007)
    • CIS300 (from 6 April 2007)?
  • understand the systems objectives.
  • what is the purpose of each system?
  • how does each system operate?
  • who operates, authorises and controls each system?
  • does the system work?

For example, expenses

  • what can employees claim?
  • how are employees made aware of this?
  • do subcontractors claim?
  • is there a standard claim form?
  • how are they authorised?
  • how are they paid?
  • are they properly returned?

A risk is defined as ‘something that casts doubt on the figures on the return’.

Top of page

Real Time Information (RTI) returns from 6 April 2013

Due to be submitted to HMRC on or before an employer makes a payment to an employee:

  • Full Payment Submission (FPS) - employer’s return of payments and deductions for each employee, see COG904240
  • Employer Payment Summary (EPS) - employer’s return of statutory payments the employer is entitled to recover, see COG904240.

Due to be submitted to HMRC after 19 April where the employer identifies an inaccuracy for the previous year:

  • Earlier Year Update (EYU) - employer’s return to correct any errors following the end of the tax year, see COG904240.

Top of page

Returns up to and including 2012-13

Due to be submitted to HMRC by 19 May each year

  • P35 - employer annual return
  • P38A - employers supplementary return
  • P14 - end of year summary for each employee
  • P38(S) - student declaration.

Top of page

Expenses and Benefits

Due to be submitted to HMRC by 6 July each year

  • P9d - expenses payments for employees (up to 6 April 2016)
  • P11d - expenses and benefits for employees
  • P11d(b) - employers return of Class 1A NIC due on employee benefits.

Top of page

Construction Industry

Due to be submitted to HMRC by 19 May each year (to 5 April 2007):

  • CIS36 - contractor’s end of year return.

Due to be submitted to HMRC by the 19th of each month (from 6 April 2007):

  • CIS300 - contractors return of payments made to subcontractors.

Some risks may be inherent to the type of business or system in place.

For example

  • P46 failures within catering/hospitality trades.

Note: From 6 April 2013 RTI employers:

  • are not required to obtain a completed P46
  • are required to complete the RTI starter checklist (or equivalent) to gather information about new employees
  • must include all new starters on an FPS.

A risk may be identified at any stage of the compliance check.

See also the attached flowchart (Word 38KB).

Please also refer to the guidance in COG11000 on Our Conduct and behaviour.