This part of GOV.UK is being rebuilt – find out what beta means

HMRC internal manual

VAT Small and Medium Enterprises Assurance Manual

The audit process: procedure for contacting risk teams

If you identify a risk which is outside the remit of your team, you should pass on the information to the Risk and Intelligence Service (RIS). They will then assess the risk and instigate the appropriate intervention/treatment.

You should make your referral using the RIS mailbox process and remember to note EF with the action you have taken.