Tax Risk Management, Audits and Dispute Resolution

Introduction and context

Tax risk management is the disciplined process through which an organisation identifies, assesses, controls, reports and responds to uncertainty arising from taxation. It includes not only the risk of an incorrect tax liability, but also risks involving cash flow, reputation, financial reporting, governance, cross-border operations, data quality and relationships with tax authorities.

For a large enterprise, tax is a strategic function. Decisions about financing, supply chains, intellectual property, acquisitions, workforce location and digital business models may alter tax exposures. A technically correct tax position may nevertheless be commercially unsustainable if it depends on weak evidence, inconsistent systems or an aggressive interpretation unlikely to withstand scrutiny. Conversely, excessive conservatism can create unnecessary tax costs and reduce competitiveness.

A post-graduate tax professional must therefore move beyond return preparation. The professional must design a control environment, judge materiality, manage examinations and investigations, advise senior management, preserve privilege and evidence, and determine when an issue should be corrected, disclosed, appealed or settled.

Tax administration differs by jurisdiction. Statutory deadlines, disclosure rules, privilege, penalty regimes, appeal routes and settlement powers must always be verified against current local law. The frameworks in this chapter are jurisdiction-neutral unless stated otherwise.

Learning objectives

By the end of this chapter, the reader should be able to:

1. Explain the nature and sources of tax risk.
2. Design a tax-control framework, governance policy and compliance calendar.
3. Assess tax risk using likelihood, impact, uncertainty and materiality.
4. Manage tax audits, investigations, information requests and evidence.
5. Evaluate penalties, voluntary disclosures, appeals, litigation and settlements.
6. Develop constructive cooperative-compliance relationships with tax authorities.
7. Critically assess technology, data governance, ethics and emerging risks in tax administration.

1. The architecture of tax risk

1.1 Tax risk defined

Tax risk is the possibility that an organisation will fail to achieve an intended tax outcome or will incur an unintended tax consequence. It may arise from an error, omission, fraud, late filing, system failure, uncertain law, poor advice, an aggressive transaction or a change in the business model.

Important categories include:

Tax risk is interconnected. For example, a transfer-pricing error may be simultaneously a transaction, reporting, controversy and reputational risk.

1.2 Inherent and residual risk

Inherent risk is the exposure before controls are considered. Residual risk is the exposure remaining after controls operate. Controls do not eliminate risk; they reduce its likelihood, impact or detectability.

A useful qualitative model is:

Here, risk is represented on a comparable scale and control effectiveness is expressed as a proportion from 0 to 1. The expression is a management model, not a statutory formula. It assumes that the control effect can reasonably be represented as a proportional reduction and that the scales are meaningful. It should not be used to disguise uncertainty or create false precision.

Risk is often prioritised through a likelihood–impact matrix. A simple score can be expressed as:

Likelihood and impact must be defined consistently, for example on scales from 1 to 5. A score is a prioritisation aid, not a measurement of the true probability or expected monetary loss. Where data permit, a stronger quantitative model is:

where pᵢ is the probability of scenario i and Lᵢ is its monetary loss. The probabilities should sum to 1 across mutually exclusive, sufficiently complete scenarios. Expected loss may be inappropriate where outcomes are highly uncertain, legally non-monetary or dependent on strategic reputation effects.

1.3 Tax materiality

Materiality is context-dependent. An amount may be immaterial to consolidated profit but material to a covenant, a regulated entity, a local subsidiary, a cash forecast, a public commitment or a high-risk disclosure. Assessment should consider:

• quantitative magnitude;
• effect on effective tax rate, cash tax and deferred tax;
• recurrence and aggregation with similar errors;
• legal significance, including fraud or abusive conduct;
• impact on investors, regulators, lenders or employees;
• effect on tax authority relationships; and
• whether the issue reveals a control deficiency.

A materiality policy should define quantitative thresholds, qualitative triggers, escalation levels and aggregation rules. It should distinguish accounting materiality from tax filing thresholds and from the practical significance of an issue during an audit.

2. Tax governance and the control framework

2.1 Governance principles

Effective tax governance rests on accountability, documentation, proportionality, transparency and challenge. The board or an appropriate board committee should approve the organisation’s tax strategy and risk appetite. Senior management should implement the strategy, allocate resources and ensure that tax decisions are integrated into enterprise risk management.

A tax governance policy should address:

• the organisation’s approach to compliance and tax planning;
• risk appetite and prohibited or restricted arrangements;
• responsibilities for tax, finance, legal, procurement and business units;
• approval requirements for material transactions;
• use and oversight of external advisers;
• documentation and retention;
• escalation of uncertain positions and suspected misconduct;
• interaction with tax authorities; and
• reporting to the board and audit committee.

The policy should not merely state that the organisation will comply with the law. It should specify how compliance will be demonstrated.

2.2 The three-lines model

The three-lines model provides a useful allocation of responsibilities:

1. First line—business and tax operations: prepare data, execute controls, identify issues and own operational risks.
2. Second line—tax risk, compliance and oversight: establish policies, review risk assessments, monitor controls and challenge first-line decisions.
3. Third line—internal audit: independently assess design and operating effectiveness and report significant deficiencies to the audit committee.

The external auditor is not a substitute for internal control or internal audit. External assurance has a distinct purpose and scope.

2.3 Core tax controls

Controls should be linked to identifiable risks and tested for both design and operation. Common controls include:

• tax-sensitive transaction checklists;
• segregation of preparation, review and approval;
• reconciliation of tax returns to the general ledger and subledgers;
• validation of tax codes, rates, exemptions and registration numbers;
• review of uncertain tax positions by appropriately qualified personnel;
• documented transfer-pricing analyses and intercompany agreements;
• automated deadline alerts with evidence of completion;
• access controls over tax systems and amendments to master data;
• review of tax authority correspondence;
• exception reporting for unusual transactions and late items; and
• post-filing reviews and lessons-learned processes.

A control is stronger when its owner, frequency, evidence, reviewer, exception procedure and remediation deadline are explicit. A checklist alone is weak if no one is accountable for investigating exceptions.

2.4 Compliance calendars

A compliance calendar is a controlled inventory of obligations. It should include the obligation, jurisdiction, period, trigger, deadline, responsible owner, reviewer, payment requirement, source data, evidence location and escalation route.

The calendar should be generated from a legal obligation inventory rather than copied from the previous year. It must capture changes in law, new registrations, dormant entities, indirect taxes, payroll taxes, withholding, information reporting, customs and local obligations.

3. Risk assessment and decision-making

3.1 The tax risk register

A tax risk register translates broad concerns into manageable actions. Each entry should identify the risk event, cause, consequence, affected taxes and jurisdictions, inherent rating, existing controls, residual rating, owner, treatment plan, due date and status.

Risk responses normally include:

• avoid: do not undertake the activity;
• reduce: introduce controls or alter the transaction;
• transfer: use contractual allocation or insurance where appropriate;
• accept: tolerate the residual risk within approved appetite; or
• escalate: seek a ruling, authority agreement, board decision or external advice.

Acceptance must be informed and documented. It is not a default response to uncertainty.

3.2 Uncertainty and technical positions

A tax position may be uncertain because legislation is ambiguous, facts are incomplete, administrative practice varies, or authorities have competing interpretations. The organisation should distinguish:

• uncertainty about facts;
• uncertainty about the applicable law;
• uncertainty about administrative practice; and
• uncertainty about enforcement or settlement outcomes.

A defensible technical file normally contains the facts, legal authorities, assumptions, alternatives considered, conclusion, strength of evidence, materiality, disclosure analysis and approval. Advice should be updated when facts or law change.

The tax professional must avoid “opinion shopping”—obtaining an answer selected for its desired result rather than its quality. Independent challenge is especially important where remuneration depends on tax savings.

3.3 Escalation thresholds

Escalation should be triggered by more than monetary size. Examples include suspected fraud, deliberate non-compliance, a novel interpretation, a threatened criminal consequence, a cross-border mismatch, a significant control failure, a whistleblower allegation or an issue likely to attract media attention.

A sound escalation protocol specifies whom to notify, how quickly, what information may be shared, how privilege is preserved and who may communicate externally.

4. Managing tax audits and investigations

4.1 Audit versus investigation

A tax audit is generally an examination of records and tax positions to verify liability. An investigation may involve suspected evasion, fraud, abusive arrangements, serious non-compliance or criminal conduct and may carry stronger information-gathering powers. The distinction is jurisdiction-specific, but the practical response should assume that communications and evidence may later be scrutinised.

4.2 Preparation before contact

Audit readiness is continuous, not something begun when a notice arrives. Organisations should maintain:

• an indexed document repository;
• reconciliations between returns, accounts and source systems;
• a record of prior rulings, audits and open issues;
• current legal-entity and transaction maps;
• a correspondence log;
• a protocol for interviews and site visits; and
• trained personnel authorised to interact with officials.

The organisation should appoint an audit coordinator. Requests should be logged, scoped, assigned and reviewed before release. Over-disclosure can create confusion and reveal irrelevant sensitive material; under-disclosure can damage credibility or breach legal obligations.

4.3 During the audit

The taxpayer should be cooperative, accurate and organised. It should clarify ambiguous requests, agree realistic timetables, preserve original records and correct errors rather than defend indefensible positions. Responses should distinguish facts from opinions and identify assumptions.

Management should maintain an issue log containing the authority’s question, the company’s response, documents supplied, open points, responsible owner and next action. Oral discussions should be confirmed in writing where appropriate.

Interviews require particular care. Employees should receive procedural guidance, but not coaching to conceal facts. Legal advice should be obtained where privilege or potential misconduct is involved. Privilege rules vary substantially and may not protect communications involving accountants or non-lawyers in every jurisdiction.

4.4 Evidence and data

Digital records should be preserved in a defensible manner. Relevant considerations include access logs, version history, metadata, retention holds, chain of custody, privacy restrictions and cross-border transfer rules. Data extraction should be reproducible: the organisation should be able to explain the source, transformation, filters and reconciliation of any electronic schedule.

Artificial intelligence can help classify documents, identify anomalies and draft issue summaries, but it cannot replace professional judgment. Confidential data must not be entered into an unapproved public model. Outputs require verification for hallucinated authorities, incomplete context, bias and accidental disclosure.

4.5 Audit outcomes

Possible outcomes include no change, an agreed adjustment, a formal assessment, penalties, interest, a ruling, a settlement or referral to another authority. At closure, the organisation should record the result, update provisions and disclosures where necessary, remediate control weaknesses and circulate lessons learned.

5. Penalties, interest and voluntary correction

Penalties commonly reflect late filing, late payment, inaccurate returns, failure to keep records, failure to disclose or deliberate conduct. Some systems distinguish strict-liability penalties from behaviour-based penalties and provide reductions for reasonable care, cooperation, voluntary disclosure or reliance on appropriate advice.

A response should establish:

1. the statutory basis and calculation of the penalty;
2. the relevant behaviour standard;
3. the facts supporting reasonable care or other mitigation;
4. the effect of voluntary correction and timing;
5. whether similar errors occurred in other periods or jurisdictions; and
6. whether the issue indicates a systemic control failure.

Interest is generally separate from a penalty and may continue even where a penalty is reduced. The exact computation must follow local law; no universal formula should be assumed.

A voluntary disclosure is not automatically beneficial. Before disclosure, the organisation should understand eligibility, waiver of rights, penalty consequences, limitation periods, related-party implications and the possibility that disclosure triggers a broader audit. Delaying a required correction merely to improve negotiation leverage may create additional risk.

6. Dispute resolution

6.1 Administrative review and objection

Many systems provide an internal review or objection stage after an assessment. The submission should identify the decision challenged, relevant facts, legal grounds, evidence, relief requested and limitation deadline. It should be concise enough to be usable but complete enough to preserve the argument.

The tax professional must distinguish a disagreement over facts from a disagreement over law. Factual disputes are often resolved through records, witness evidence and expert analysis; legal disputes require structured interpretation, precedent and statutory purpose.

6.2 Appeals and litigation

An appeal may proceed to a specialist tribunal, administrative court or superior court. Litigation strategy involves merits, evidence, costs, timing, precedent, confidentiality, cash-flow exposure and reputational consequences. A technically strong case may still be commercially unattractive if the expected benefit is small relative to cost and delay.

For a simplified decision model, the expected value of litigating rather than accepting an assessment can be represented as:

where EV is expected value, p is the estimated probability of success, B is the benefit if successful, C is litigation cost and F is the financial consequence of failure, including interest and penalties. The model assumes scenarios are sufficiently defined and that values are expressed on a common present-value basis. It excludes non-financial effects unless they are monetised; therefore it supports, but does not replace, professional judgment.

6.3 Settlement and alternative resolution

Settlement may take the form of an agreed adjustment, mediation, competent-authority agreement, advance pricing arrangement or other statutory mechanism. A settlement should be evaluated against legal merits, consistency, precedent, cash flow, confidentiality, future periods and the risk of creating an undesirable pattern.

Negotiators should have a clear mandate, authority limits and documentation. They must not misrepresent facts, conceal adverse authority or promise concessions outside their power. A settlement is not ethically sound merely because it reduces tax cost.

6.4 Cross-border disputes

Cross-border double taxation may require treaty-based mutual agreement procedures or arbitration. The taxpayer must coordinate domestic remedies, filing deadlines, competent-authority submissions, transfer-pricing evidence and interactions among group entities. Unilateral concessions in one country can affect relief in another.

7. Cooperative compliance and tax authority relationships

Cooperative compliance is a relationship model based on transparency, timely disclosure, commercial awareness and assurance that the taxpayer’s tax-control framework operates effectively. It does not mean preferential treatment or immunity from audit. Its legitimacy depends on equal application, documented criteria and accountability.

A mature relationship may involve:

• named relationship managers;
• advance discussion of significant transactions;
• regular risk reviews;
• real-time access to relevant information;
• agreed protocols for issues and escalation; and
• assurance over tax-control design and operation.

Benefits may include earlier certainty, fewer surprises and more efficient use of authority resources. Risks include dependence on informal understandings, unequal access, disclosure of commercially sensitive information and the possibility that an authority’s view changes. Communications should therefore be accurate, documented and based on formal legal mechanisms where certainty is important.

8. Case study: Northstar Components Ltd. (illustrative)

Background

Northstar Components Ltd. is a manufacturing group operating in three jurisdictions. Its procurement centre, manufacturing subsidiary and distribution company transact extensively with one another. The group recently implemented an enterprise-resource-planning system and appointed a new regional tax manager.

Problem

During a routine review, the manager discovered that the distribution company had used an outdated indirect-tax code for several product categories. Two quarterly returns understated tax by the equivalent of 0.7% of local revenue. At the same time, the transfer-pricing file had not been updated after a major change in procurement functions. A tax authority announced a sector audit focusing on value chains and digital records.

The error was not large relative to group profit, but it was potentially material locally, recurring, and indicative of weak change control. The transfer-pricing issue also created cross-border controversy and double-taxation risk.

Analysis

The manager established an incident team comprising tax, finance, legal, internal audit, IT and operations. The team preserved system logs, mapped affected transactions, quantified the error by period and product, reviewed whether other entities used the same code, and assessed penalty and disclosure rules.

The team’s risk assessment identified:

• immediate filing and payment exposure;
• possible penalties, mitigated by prompt correction and reasonable care;
• a control-design deficiency in system change approval;
• transfer-pricing documentation risk; and
• reputational risk if the authority concluded that the error was concealed.

The team separated the indirect-tax correction from the transfer-pricing analysis. This prevented a defensible correction from being delayed while a more complex issue was evaluated.

Approach and solution

Northstar filed a voluntary correction where legally available, paid tax and statutory interest, and requested penalty mitigation. It disclosed the control failure accurately without speculating about unrelated misconduct. The ERP tax-code change process was redesigned so that tax sign-off, testing, version control and post-implementation reconciliation were mandatory.

For transfer pricing, Northstar prepared a functional analysis, updated intercompany agreements, obtained independent review and opened a documented dialogue with the relevant authorities. It did not assume that informal discussions created legal certainty. The board audit committee received a report covering exposure, remediation, disclosure and lessons learned.

Outcome

The authority accepted the corrected indirect-tax returns and reduced the penalty because Northstar had acted promptly, cooperated and demonstrated improved controls. The transfer-pricing issue remained under review, but the documented analysis narrowed the disputed facts and improved the prospects of a bilateral resolution.

Learning points

The case demonstrates that materiality is not merely a group-profit percentage. Early escalation, evidence preservation, separation of issues, controlled disclosure and credible remediation can materially improve an organisation’s position. It also shows that cooperative compliance depends on reliable controls rather than persuasive correspondence alone.

9. Challenges, ethics and contemporary developments

Tax risk management faces persistent limitations. Laws may be ambiguous, authority resources uneven, data fragmented and probability estimates subjective. A risk matrix can conceal correlation: several individually moderate risks may arise from the same deficient system. Models should therefore be supplemented with scenario analysis, control testing and expert challenge.

Ethical duties include honesty, professional competence, confidentiality, independence and compliance with law. Tax professionals should resist pressure to convert uncertainty into certainty, should report suspected misconduct through appropriate channels and should consider the public-interest consequences of advice. Confidentiality does not authorise concealment of crime or evasion where law requires reporting.

Technology is reshaping compliance through real-time reporting, e-invoicing, transaction-level analytics, automated controls and authority data matching. These tools improve detection but increase the consequences of inaccurate master data. Governance should cover model validation, access, explainability, bias, cyber security, retention and human review.

Contemporary international developments include greater transparency, minimum-tax implementation in many jurisdictions, increased scrutiny of transfer pricing and digital business, beneficial-ownership reporting, mandatory disclosure regimes and expanded information exchange. Organisations need horizon scanning, not merely annual compliance planning.

Best-practice implementation framework

A practical implementation sequence is:

1. inventory all taxes, entities, jurisdictions and obligations;
2. define board-approved tax strategy and risk appetite;
3. map processes, systems, data owners and control points;
4. assess inherent and residual risks using documented criteria;
5. establish the compliance calendar and escalation protocol;
6. test controls and remediate deficiencies according to priority;
7. maintain technical files for material or uncertain positions;
8. prepare an audit-response and evidence-preservation protocol;
9. review penalty, disclosure and dispute options promptly; and
10. report trends, incidents, control effectiveness and emerging risks to governance bodies.

The framework should be reviewed after major transactions, system changes, audits, legislative developments and control incidents.

Chapter Summary

Tax risk encompasses compliance, transaction, reporting, operational, controversy, regulatory, ethical and reputational exposures. Effective management requires a board-approved strategy, clear accountability, a risk register, materiality criteria, reliable controls and a complete compliance calendar. Inherent risk must be distinguished from residual risk, and quantitative scores should support rather than replace judgment.

Audit readiness depends on accurate reconciliations, document preservation, controlled communications, trained personnel and disciplined data extraction. Investigations require particular attention to evidence, privilege, confidentiality and ethical conduct. Penalties, interest and voluntary disclosure must be assessed under applicable law and in light of behaviour, timing and systemic control weaknesses.

Dispute resolution involves administrative review, appeals, litigation, settlement and, in cross-border cases, competent-authority procedures. Decisions should consider merits, probability, cost, cash flow, precedent and non-financial consequences. Cooperative compliance can improve certainty, but it depends on transparency, effective controls and formal accountability. Technology and AI offer substantial benefits only when governed through data-quality, security, validation and human-review controls.

Key Terms

Tax risk: The possibility of an unintended tax outcome or failure to achieve an intended outcome.

Inherent risk: Exposure before considering controls.

Residual risk: Exposure remaining after controls operate.

Risk appetite: The level and type of risk an organisation is willing to accept.

Tax materiality: The significance of a tax issue in quantitative or qualitative terms.

Tax control: A policy, procedure or activity designed to prevent, detect or correct tax error.

Compliance calendar: A controlled schedule of tax obligations, owners, deadlines and evidence.

Tax risk register: A structured record of identified risks, ratings, controls and treatments.

Technical file: Documented facts, law, assumptions, analysis and conclusions supporting a tax position.

Tax audit: An authority examination of records and tax positions.

Tax investigation: A potentially more serious examination involving suspected serious non-compliance or misconduct.

Voluntary disclosure: A taxpayer-initiated correction or disclosure made under applicable statutory rules.

Penalty mitigation: Reduction of a penalty because of factors such as reasonable care, cooperation or prompt correction.

Administrative review: Review of an assessment or decision within an administrative process.

Litigation: Formal resolution of a dispute through a court or tribunal.

Settlement: An authorised agreement resolving some or all disputed issues.

Cooperative compliance: A structured, transparent relationship between taxpayer and authority intended to improve certainty and compliance.

Privilege: Legal protection for specified communications, subject to jurisdictional rules.

Residual exposure: The remaining financial, legal, operational or reputational consequence after treatment.

Review Questions

Short Answer Questions

1. Distinguish inherent risk from residual risk.
2. Identify four fields that should appear in a tax compliance calendar.
3. Why should tax materiality include qualitative factors?
4. State two responsibilities of the second line in the three-lines model.
5. What is the purpose of a tax risk register?

Long Answer Questions

1. Explain how a board-approved tax governance policy can influence operational tax compliance.
2. Discuss the principal controls required to manage uncertain tax positions.
3. Explain how an organisation should prepare for and manage a tax audit.
4. Evaluate the advantages and limitations of cooperative compliance.
5. Compare administrative review, litigation and settlement as dispute-resolution strategies.

Analytical / Application Questions

1. A group discovers a recurring withholding-tax error that is immaterial to consolidated profit but significant in one jurisdiction. Design an escalation, correction and control-remediation response.
2. A tax authority requests a large volume of electronically stored information during an investigation. Develop a defensible protocol covering scope, preservation, review, privilege and submission.
3. A company estimates a 60% chance of winning a dispute with a benefit of 900,000 monetary units, litigation cost of 180,000 and failure consequence of 300,000. Using EV = p × B − C − F, calculate the simplified expected value and explain why qualitative factors are still required.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes inherent risk from residual risk?

A. Inherent risk is measured after controls, while residual risk is measured before controls.

B. Inherent risk exists before controls are considered, while residual risk remains after controls operate.

C. Inherent risk relates only to fraud, while residual risk relates only to compliance.

D. Inherent risk is always financial, while residual risk is always reputational.

Correct Answer: B. Inherent risk exists before controls are considered, while residual risk remains after controls operate.

Question 2

Which item is most appropriately included in a tax compliance calendar?

A. Only the total annual tax expense

B. Only the name of the tax director

C. The obligation, deadline, owner, reviewer and evidence of completion

D. A list of tax rates without filing responsibilities

Correct Answer: C. The obligation, deadline, owner, reviewer and evidence of completion

Question 3

What is the principal purpose of a tax risk register?

A. To replace statutory tax returns

B. To record risks, controls, owners, ratings and treatment actions

C. To determine the legal tax rate in every jurisdiction

D. To guarantee that no tax audit will occur

Correct Answer: B. To record risks, controls, owners, ratings and treatment actions

Question 4

Which activity is primarily associated with the second line of the three-lines model?

A. Processing invoices in the business unit

B. Independently auditing the tax function

C. Setting tax policies, monitoring risk and challenging operational decisions

D. Filing every tax return without review

Correct Answer: C. Setting tax policies, monitoring risk and challenging operational decisions

Question 5

Why is tax materiality not determined solely by consolidated profit?

A. Tax law never uses monetary amounts.

B. A small group amount may be significant locally, legally, reputationally or for a covenant.

C. All tax differences are automatically material.

D. Materiality applies only to indirect taxes.

Correct Answer: B. A small group amount may be significant locally, legally, reputationally or for a covenant.

Question 6

Which is the most appropriate response when an audit request is ambiguous?

A. Ignore it until the authority repeats the request.

B. Provide every document held by the organisation without review.

C. Clarify the scope, log the request and provide an accurate, reviewed response.

D. Destroy irrelevant documents before responding.

Correct Answer: C. Clarify the scope, log the request and provide an accurate, reviewed response.

Question 7

Using the simplified model EV = p × B − C − F, what is the expected value when p = 0.60, B = 900,000, C = 180,000 and F = 300,000?

A. 60,000 monetary units

B. 180,000 monetary units

C. 360,000 monetary units

D. 540,000 monetary units

Correct Answer: A. 60,000 monetary units

Question 8

Which statement about voluntary disclosure is most accurate?

A. It always eliminates penalties.

B. It should be evaluated against eligibility, timing, legal consequences and the possibility of wider scrutiny.

C. It is appropriate only after litigation begins.

D. It permits an organisation to disclose incomplete facts strategically.

Correct Answer: B. It should be evaluated against eligibility, timing, legal consequences and the possibility of wider scrutiny.

Question 9

What is a central ethical requirement during a tax investigation?

A. Coach employees to avoid all unfavourable facts.

B. Provide accurate information and avoid concealing relevant misconduct.

C. Use informal promises instead of documented communications.

D. Prioritise tax savings over legal obligations.

Correct Answer: B. Provide accurate information and avoid concealing relevant misconduct.

Question 10

Which control is most directly relevant to an AI-assisted tax analytics system?

A. Removing all human review

B. Allowing confidential data to be entered into any public model

C. Validating outputs, controlling access and documenting model limitations

D. Treating model-generated legal authorities as automatically correct

Correct Answer: C. Validating outputs, controlling access and documenting model limitations