vaayaa Inclusive Education
Finance risk assessment

International Tax and Transfer Pricing Risk Assessment: Pricing, Data and Control Risks

A worked example of how a finance and tax team in a multinational group finds, scores and controls the risks that arise when intercompany prices, cross-border payments and tax records are not properly managed.

Updated November 2026 8 hazards assessed Review every 6 months Highest risk: High to Medium
See the International Tax and Transfer Pricing course

Executive summary

This assessment shows how the finance and tax functions of a multinational group can find, rate and control the risks that arise when intercompany prices, cross-border payments and tax records are not properly managed. Eight risks were chosen because they are plausible in everyday transfer pricing, intercompany accounting and tax work. Pricing misalignment and intercompany errors are the most likely, while fraud and weak access control are less likely but cause serious harm. Each risk is scored before controls and again after existing and added controls. Most risks fall to Medium or Low once added controls are in place, but fraud remains at Medium because its impact stays high. The first actions are price bands from the benchmark study, separated approval rights, evidence checks on charges and secured tax records. The group is a teaching example, so every score illustrates method and does not describe a real organization. Specialist tax review is needed for any real pricing decision.

Focus area
International tax and transfer pricing
Setting
Tax and finance function of a mid-sized group with cross-border intercompany trade and services
Method
Five by five likelihood and impact risk register

Scope

This assessment covers intercompany pricing, cross-border transactions, transfer pricing documentation, tax filings and the data and controls that support them. It looks at risks to accuracy, cash, legal duties and trust. It does not give tax advice or set the prices of any real group. Assumed for teaching: the group has three operating companies in different countries, uses one accounting system, and does not name any jurisdiction, so legal duties are described only in general terms.

Context

The group has a head of tax, a transfer pricing manager, an intercompany accountant, a treasury lead and an IT manager who supports the finance systems. Goods and services move between entities under written intercompany policies, with pricing supported by benchmark studies prepared by external advisers. Invoices are raised in the accounting system, with spreadsheets used for margin models and tax computations. Each risk is scored before controls to show its natural level, then again after existing controls and the additional controls that should be added.

Objectives, assets and stakeholders

The objective is to set and document intercompany prices that meet the arm's length principle, keep intercompany records accurate and timely, meet filing and disclosure duties in each country, protect cash and tax records, and keep the confidence of tax authorities, auditors, lenders and shareholders. The assets in scope are intercompany contracts and price policies, benchmark studies, tax computations and filings, the accounting system, pricing models, cash held by group entities and the reputation of the tax team. Stakeholders include the head of tax, the transfer pricing manager, group finance, the board, shareholders, external advisers and auditors, operating companies, and the tax authorities in each country where the group files. Every risk has one owner role, and the group financial controller keeps the register current and reports to the board each quarter.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely Likelihood 4, impact 3, score 12, high: H02 Likelihood 4, impact 4, score 16, high: H01 H03
3 Possible Likelihood 3, impact 3, score 9, medium: H07 Likelihood 3, impact 4, score 12, high: H04 H08 Likelihood 3, impact 5, score 15, high: H05
2 Unlikely Likelihood 2, impact 5, score 10, high: H06
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible Likelihood 3, impact 2, score 6, medium: H08
2 Unlikely Likelihood 2, impact 2, score 4, low: H07 Likelihood 2, impact 3, score 6, medium: H01 H02 H03 H04 H06 Likelihood 2, impact 4, score 8, medium: H05
1 Rare
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Transfer pricing misalignment with agreed policy 16 High 6 Medium Transfer pricing manager
H02 Intercompany transaction processing and reconciliation errors 12 High 6 Medium Intercompany accountant
H03 Data quality and cyber exposure in tax records 16 High 6 Medium IT manager
H04 Weak access control and segregation of duties on intercompany approvals 12 High 6 Medium Head of tax
H05 Fraud and misstatement in intercompany charges 15 High 8 Medium Internal auditor
H06 Conflicts of interest and conduct of advisers 10 High 6 Medium Compliance officer
H07 Forecasting and valuation uncertainty in profit allocation 9 Medium 4 Low Group financial controller
H08 Cross-border cash, currency and counterparty exposure 12 High 6 Medium Treasury lead
H01

Transfer pricing misalignment with agreed policy

Legal and compliance Before 16 After 6

Intercompany prices for goods, services or loans drift from the group policy or from the range supported by benchmark studies, so taxable profit is allocated in a way that cannot be defended.

Who or what is affected: Tax authorities, group finance and the board

Causes

Changing trade volumes, prices set by operating teams and benchmarks that age over time.

Consequences

Adjustments by tax authorities, double taxation, penalties and disputes between group entities.

Existing controls

  • A written intercompany pricing policy is approved each year.
  • An external benchmark study is reviewed by the head of tax.

Control gaps

Margins are checked only at year end, so drift can go unnoticed for many months.

Additional controls

  • Prevent: Set price bands from the benchmark study and require approval for any price outside the band.
  • Detect: Compare actual intercompany margins with the policy range each quarter and record each variance.
Likelihood 4 x impact 4 before; 2 x 3 after Owner: Transfer pricing manager Target: Within 60 days Early warning: An intercompany margin that falls outside the approved band for two quarters running.
H02

Intercompany transaction processing and reconciliation errors

Operational Before 12 After 6

Intercompany invoices are raised in the wrong entity, currency or period, and balances between group companies do not agree, so consolidated figures and tax computations are wrong.

Who or what is affected: Group finance, tax team and external auditors

Causes

Manual invoices, different charts of accounts across entities and late month-end postings.

Consequences

Misstated consolidated profit, wrong tax computations and a delayed close.

Existing controls

  • Monthly intercompany balances are agreed between the two entities.
  • Invoices above a set value need a second check before posting.

Control gaps

Mismatches below a set threshold are written off without any review.

Additional controls

  • Prevent: Use a standard intercompany price list and fixed currency rules built into the accounting system.
  • Detect: Run a monthly intercompany mismatch report and clear each difference within ten working days.
Likelihood 4 x impact 3 before; 2 x 3 after Owner: Intercompany accountant Target: Within 45 days Early warning: Intercompany differences that are carried forward for more than one month.
H03

Data quality and cyber exposure in tax records

Technology and data Before 16 After 6

Weak passwords, phishing and unprotected spreadsheets expose transfer pricing models and tax records, while poor master data creates wrong figures in filings and benchmarks.

Who or what is affected: Tax team, group finance, tax authorities and advisers

Causes

Phishing, reused passwords and pricing models copied between people by email.

Consequences

Stolen or altered records, incorrect filings and enquiries from tax authorities.

Existing controls

  • Finance systems require individual sign in and are backed up daily.
  • Tax files are stored only in the shared finance folder.

Control gaps

Spreadsheet models used for pricing sit outside access controls and have no version history.

Additional controls

  • Prevent: Enable multi-factor sign in for finance and tax users and restrict file sharing to named staff.
  • Recover: Test restoring tax computation files from backup and keep a written recovery plan.
Likelihood 4 x impact 4 before; 2 x 3 after Owner: IT manager Target: Within 30 days Early warning: A finance user reports repeated payment or document request scams.
H04

Weak access control and segregation of duties on intercompany approvals

Operational Before 12 After 6

One person can set an intercompany price, raise an invoice and approve it, or holds ledger access in several entities beyond what the role needs, so errors and misuse go unseen.

Who or what is affected: Group finance, tax team and shareholders

Causes

Small teams, rights that are added and never removed, and shared logins for shared mailboxes.

Consequences

Unapproved price changes, profit misstated by entity and loss of trust with auditors.

Existing controls

  • Users sign in with individual accounts rather than shared logins.
  • Price changes above a set limit need a second approval.

Control gaps

Access reviews happen only when someone leaves the group or changes role.

Additional controls

  • Prevent: Separate the roles that set prices, raise invoices and approve them in the accounting system.
  • Detect: Review user access across all entities each quarter and record each removal made.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Head of tax Target: Within 60 days Early warning: A user who holds both price setting and invoice approval rights.
H05

Fraud and misstatement in intercompany charges

Financial Before 15 After 8

Invoices are inflated, fictitious service charges are raised between entities, or prices are altered to move profit for personal or unlawful gain, and the change is hidden in consolidated figures.

Who or what is affected: Shareholders, tax authorities, lenders and employees

Causes

Pressure to meet profit targets, weak checks on service evidence and too much trust in one manager.

Consequences

Direct loss, tax assessments, legal action and lasting damage to reputation.

Existing controls

  • Benchmark studies are reviewed by an independent external adviser.
  • Intercompany service charges need a written description of the service.

Control gaps

Charges are checked on a sample basis, so small repeated charges can pass unnoticed.

Additional controls

  • Prevent: Require evidence of the service received before any intercompany charge is paid.
  • Detect: Match intercompany charges to contracts and flag any charge with no evidence or a round sum.
  • Respond: Freeze related payments and refer the case to the internal auditor and legal counsel.
Likelihood 3 x impact 5 before; 2 x 4 after Owner: Internal auditor Target: Within 45 days Early warning: An intercompany charge with no contract or service record attached.
H06

Conflicts of interest and conduct of advisers

People Before 10 After 6

An adviser or group employee has a personal or business link to a party whose pricing is under review, or feels pressure to soften findings, which weakens independence and the value of the benchmark.

Who or what is affected: Tax authorities, group management and the public

Causes

Long adviser relationships, fee pressure and unclear rules on gifts and hospitality.

Consequences

Loss of independence, unreliable benchmarks, disciplinary action and reputational harm.

Existing controls

  • A code of conduct is signed by all tax staff each year.
  • Advisers are asked to declare any links to group companies.

Control gaps

Declarations are collected but never compared against current engagements.

Additional controls

  • Prevent: Require a written independence check before each adviser is engaged for a benchmark study.
  • Respond: Provide a confidential route to raise concerns and record how each one is handled.
Likelihood 2 x impact 5 before; 2 x 3 after Owner: Compliance officer Target: Within 60 days Early warning: A declared link between an adviser and a group company under review.
H07

Forecasting and valuation uncertainty in profit allocation

Strategic Before 9 After 4

Forecasts of sales, costs and asset values used to set prices or allocate profit rest on optimistic assumptions, so the profit allocated to each entity is wrong when conditions change.

Who or what is affected: Board, group treasury, tax team and auditors

Causes

Reliance on one market view, pressure for good results and assumptions that are not revisited.

Consequences

Misallocated profit, poor pricing decisions and later tax adjustments.

Existing controls

  • Forecasts are reviewed by the head of finance at each budget round.
  • Key assumptions are written into the working papers.

Control gaps

Past forecasts are not compared with outcomes, so bias goes unseen.

Additional controls

  • Prevent: Document each key forecast assumption with its evidence and test a low and a high case.
  • Detect: Compare past forecasts with actual results by entity and report the gaps to the board.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Group financial controller Target: Within 90 days Early warning: Forecast error above the agreed tolerance in two consecutive quarters.
H08

Cross-border cash, currency and counterparty exposure

Financial Before 12 After 6

Intercompany loans, payments and tax refunds move across borders, and exchange rate moves, a delayed payment or a failed group company leave cash short or create losses that are hard to recover.

Who or what is affected: Group treasury, lenders, staff of affected entities and suppliers

Causes

Currency swings, slow cross-border payments and concentration of cash in a few entities.

Consequences

Liquidity shortfall, forced borrowing, currency losses and tax disputes over intercompany interest.

Existing controls

  • Cash positions are reviewed by treasury each week.
  • Intercompany loans are agreed in writing with interest terms.

Control gaps

Exposure is measured monthly rather than daily, so a sharp currency move can go unseen.

Additional controls

  • Prevent: Set limits on net exposure per currency and per entity and require approval before any breach.
  • Respond: Agree a standby funding plan and an order of payments for a cash shortfall.
Likelihood 3 x impact 4 before; 3 x 2 after Owner: Treasury lead Target: Within 60 days Early warning: Net exposure in one currency above the agreed limit for more than one week.

Rating method and evaluation

Each risk is rated on two five-point scales. Likelihood runs from Rare to Almost certain, and impact runs from Insignificant to Catastrophic. Multiplying the two gives a score from 1 to 25, which falls into one of four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. Low means accept and watch. Medium means routine controls with a named owner. High means senior attention and a dated plan. Critical means immediate action and board oversight. Inherent risk is the score before any controls. Residual risk is the score after existing and added controls, and it must never be higher than the inherent score. Impact is judged on tax exposure, cash lost, time to correct, effect on reported results and harm to trust. A risk is never rated down only because it has not yet happened. The people who do the work challenge the ratings at each review, and any rating is reopened when an indicator reaches its threshold.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 6 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Intercompany margins outside the approved price band for two quarters running.Escalate to the head of tax when any margin falls outside the band, and to the board if it remains outside after two quarters.
Intercompany differences carried forward for more than one month.Escalate to the group financial controller at once, and to the head of finance if still open after 30 days.
Users holding both price setting and invoice approval rights.Escalate to the head of tax when any such user is found, and remove one right within a week.
Intercompany charges with no contract or service evidence attached.Hold payment and escalate to the internal auditor at once, and to the audit committee if not resolved within 30 days.
Net currency exposure above the agreed limit for any entity.Escalate to the treasury lead when the limit is exceeded, and to the board when it stays above the limit for one week.

Contingency arrangements

If a serious event occurs, such as a suspected fraud, a tax authority challenge with a short deadline or a data breach, the head of tax stops related payments, preserves records and informs the board. The IT manager isolates affected accounts and restores data from the latest tested backup. Legal counsel and the external adviser are engaged through the head of tax, and specialist review is needed in each relevant jurisdiction before any response is filed. Treasury protects cash through the standby funding plan, and staff, lenders and affected entities are told what they need to know early and plainly.

Prioritized action plan

  1. Set transfer pricing bands from the benchmark study and require approval for any price outside them, owner transfer pricing manager, within 60 days.
  2. Separate price setting, invoicing and approval rights across entities, owner head of tax, within 60 days.
  3. Require evidence of the service received before any intercompany charge is paid, owner internal auditor, within 45 days.
  4. Enable multi-factor sign in and test restoring tax files from backup, owner IT manager, within 30 days.
  5. Set currency exposure limits and a standby funding plan, owner treasury lead, within 60 days.

Conclusion

Sound transfer pricing rests on a few steady habits: price bands tied to evidence, reconciled intercompany balances, separated approval rights, checked service charges, secured tax records and tested cash limits. The highest scores sit with pricing misalignment, fraud and cyber exposure, and each has actions that bring the residual score down. Treat the register as a living record, review it on the stated cycle, and seek qualified tax and legal advice for any real pricing, filing or dispute.

Assumptions and limitations

Assumptions

  • The group operates in several countries, but the specific jurisdictions are not named and the teaching example does not depend on any one tax code.
  • Intercompany policies are written and reviewed each year, and all group transactions are recorded in one accounting system.
  • External advisers prepare benchmark studies, and the internal tax team reviews them before any filing is made.

Limitations

  • The scores are examples for learning and do not describe any real group, tax authority or adviser.
  • Tax and transfer pricing rules differ by country and change over time, so specialist review is needed.
  • This is educational content and is not tax, legal or financial advice, and it does not replace a formal site-specific assessment.

Related frameworks to study

  • Arm's length principle for related party pricing
  • Internal control framework with control activities and monitoring
  • Three lines model of risk ownership
  • Hierarchy of controls

Finance Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

International Tax and Transfer Pricing course Read the best practices for this course

More Finance risk assessments

Hourly Active: 39,499 Learners