Tax governance, control, and risk management

Please provide the GRI 207-2 evidence for tax governance, control, risk management, concerns mechanisms, and assurance.

Why it fails: It uses framework language only, so the owner has to translate the ask before they can act. It also does not say which internal records, systems, or named roles to pull, so the response is likely to be incomplete or inconsistent.

Please send the current tax policy or equivalent, the named person or committee that oversees tax, the way tax is built into business processes, the tax risk log and review cadence, the check used to confirm controls are working, the route for raising tax-related concerns, and any external assurance note for tax disclosures. Use your team’s own terms and include document name, version/date, owner, and file link.

Explain the basis used to describe the tax governance setup, including how roles, controls, risk handling, concern-raising routes and any external assurance were identified and summarised.

Set out what the disclosure tells readers about how tax is overseen, who is accountable, how tax is embedded in the organisation, and how confidence in the information is supported.

If the description changes from one period to the next, note whether that reflects a change in governance, control design, risk handling, reporting routes or the scope of assurance rather than a change in tax outcomes.

Evidence pack to prepare

Common reporting gaps

*Synthetic example for training only.* We describe a tax control set that sits under our finance policy, with board oversight through the audit committee and day-to-day ownership by the group tax lead, who reports into the chief financial officer. Tax thinking is built into budgeting, pricing, acquisitions, and country filings through written procedures, staff training, and quarterly reviews; we track risks by jurisdiction, log issues in a register, and test controls through internal review and periodic management checks. - We assess whether the control set is working through self-assessments, internal audit testing, and sign-off from finance leaders, while staff can raise tax-related conduct concerns through our ethics line, whistleblowing route, and direct escalation to the audit committee chair. - For this disclosure, an external firm reviewed the tax narrative and selected data points, and its limited assurance statement is referenced in our annual report appendix.

This example shows how a reporter can explain who owns tax oversight, how tax is built into operations, how risks and controls are monitored, how concerns can be raised, and how the disclosure was externally checked, without using the standard’s wording.

*Synthetic example for training only.* Our tax approach is set out in a group policy that the board approves, with the finance director responsible for delivery and the risk committee receiving regular updates. We embed that approach through approval limits, project-stage tax reviews, country-by-country filing calendars, and training for finance and commercial teams; tax exposures are identified through a risk map, monitored through monthly dashboards, and escalated where controls or filings fall behind. - We check compliance by combining control testing, internal audit work, and management review of exceptions, and people may report concerns about conduct or integrity through our speak-up channel, the ethics mailbox, or direct contact with the chair of the risk committee. - An independent assurance provider reviewed the disclosure package and issued a separate assurance statement, which we refer to in the sustainability section of our annual report.

This example illustrates a different reporting style and governance set-up, while still covering the same required points: control design, ownership, embedding, risk management, compliance checks, speak-up routes, and external assurance.

A group has a written tax policy, but the finance team says the board only sees tax matters when a problem has already escalated. The tax lead also cannot point to any named person who owns oversight of the tax approach.

A business has a tax risk register, but it was last updated 18 months ago and only lists transfer pricing. Local teams handle VAT and payroll tax issues informally, with no common method for spotting or tracking them.

The company has annual internal audit testing of tax controls, but the tax team cannot explain how the results are used, and there is no evidence that failures lead to action plans or reporting to leadership.

Employees can raise ethics concerns through a general whistleblowing line, but the tax team has never publicised that route for tax-related conduct issues. An external assurance provider has reviewed the tax disclosures, but the draft report does not mention the assurance statement anywhere.