Business Risk Review - Guide on HMRC Business Risk Reviews

Introduction

The Business Risk Review plus (BRR+) is the primary mechanism through which HMRC assesses the tax compliance risk of the UK’s largest and most complex businesses.
 

Under the "plus" model introduced in 2019, the review has shifted from a simple "Low Risk/Non-Low Risk" assessment to a more granular, four-tier rating system. 

Scope of the Review & Frequency

​

The BRR+ is usually conducted by a Customer Compliance Manager (CCM). It applies to large businesses, meeting one or more of the following:
 

• UK Turnover: Over £200 million.

• Assets: Gross balance sheet assets over £2 billion.

• Complexity: Smaller businesses that HMRC deems high-risk or complex (e.g., multinational groups).
   

The frequency of these reviews is determined by a company's current risk rating:
 

• Low Risk: Usually reviewed every 3 years.

• Moderate, Moderate-High, or High Risk: Reviewed annually.
   

Risk Categories

HMRC assigns one of the following ratings based on the review:
 

Low - HMRC has high confidence in the business's systems and openness. Interaction is minimal.
 

Moderate - Generally compliant but has some gaps in processes or occasional aggressive tax positions.
 

Moderate-High - Significant concerns regarding governance or recurring errors.
 

High - Frequent disputes, poor systems, or lack of transparency. This triggers intense HMRC scrutiny.

Assessment Pillars
 

HMRC evaluates the business across all applicable tax regimes including VAT using three standards
 

Systems and Delivery - HMRC reviews your VAT processes and controls to determine if it is robust enough to deliver accurate VAT reporting.
 

• Resources - Is the tax team sufficiently staffed and skilled?

• Technology - Are accounting systems fit for purpose for the business's scale?

• Accuracy - Is there evidence of repeated basic errors or "failure to take reasonable care
   

Internal Governance - This focuses on management accountability and compliance with statutory regimes.
 

• SAO Compliance: Adherence to Senior Accounting Officer (SAO) requirements.

• Tax Strategy: Is your tax strategy published and followed in practice

• Uncertain Tax Treatment (UTT): How you identify and notify HMRC of uncertain positions.

​

Internal Policy on VAT Compliance - Basically the business's relationship with HMRC.
 

• Transparency: Do you disclose issues in real-time before filing

• Interpretation: Do you take aggressive positions that push the boundaries of legislation

• Collaboration: How quickly and accurately do you respond to HMRC queries

Low Risk Checklist

​

• VAT Risk Matrix - Ensure there is an up to date VAT risk and control matrix that outlines all VAT Team, VAT operational, Finance operational risks  and controls and who owns and operates them including frequency of testing the controls.

• Documented Processes - Ensure all VAT processes and workflows are written down and documented.

• Real-Time Disclosure - Discuss all  complex transactions with HMRC before filing your VAT return.

• Audit Trail - Ensure there is a robust audit trail for all transactions and manual adjustments for VAT.
   

Note: A "Low Risk" rating is not permanent. HMRC can withdraw it immediately if a serious breach occurs or if the business enters into a tax avoidance scheme.