Safety Norms: International Tax and Transfer Pricing

1Purpose, Scope, and Safety Principles

These norms set minimum standards for how intercompany pricing, cross-border tax positions, and related filings are prepared, reviewed, approved, and stored. They apply to every person and entity in the group that handles tax data, intercompany agreements, pricing models, or tax returns, including outsourced providers and advisers working under contract.

Four principles guide the norms: accuracy over speed, evidence over assertion, separation of duties over individual discretion, and escalation over silence. Rules marked mandatory are required by company policy or by a law the company has confirmed applies. Rules marked recommended reflect good practice that local leadership may adapt after documented review. Nothing here replaces professional tax advice, formal training, or approved local procedures.

2Roles, Competence, and Accountability

The head of tax is accountable for the tax control framework, approves the transfer pricing policy, and signs off on material tax positions. Finance controllers link tax entries to the general ledger and own intercompany reconciliations. Transfer pricing analysts prepare functional analyses, benchmarking studies, and pricing calculations. Legal counsel reviews intercompany agreements and dispute strategy. Information security staff protect systems, and internal audit independently tests controls.

Competence is a safety requirement. Tax and accounting staff must hold the qualifications that local rules or company policy require, and human resources must verify them before access is granted. Where a task needs a qualified tax professional, such as a formal opinion on a complex treaty question, it must not be performed by an unqualified colleague.

Every person has a duty to report concerns, even when unsure. Staff who raise a concern in good faith must not face retaliation, and managers must not discourage reporting. Silence is treated as a control failure.

• Mandatory: No person may both create and approve the same intercompany invoice, pricing adjustment, or tax computation.
• Mandatory: Access profiles must match current duties, and each profile has a named business owner.
• Mandatory: Advisers and contractors sign confidentiality terms and work under a named internal owner.
• Recommended: Give new analysts a documented mentoring period, with a reviewer who signs off their first several working papers.

3Course-Specific Hazards and Risk Assessment

The hazards in international tax and transfer pricing are mainly financial, legal, and informational rather than physical. They arise from routine decisions such as setting a management fee, pricing an intercompany loan, classifying a royalty, or approving a bank payment to a new counterparty. Errors can cause double taxation, penalties, reputational harm, or theft.

Each hazard is scored for likelihood and impact using the five-level matrix approved by the head of tax. Any item scored high requires a documented mitigation plan, a named control owner, and review before the next filing or payment run.

Realistic example: a regional sales entity is charged a management fee that rises sharply late in a period, with no new service description. The control response is to match the charge to the agreement, request evidence that the service was received, and hold the entry until the transfer pricing lead confirms the method. Such a hold is a norm, not a judgment about intent.

• High: Fictitious or inflated intercompany charges, such as services not received or fees above the agreed method. Control owner: finance controller.
• High: Unauthorized or undocumented changes to pricing models, benchmarking inputs, or ratios after approval. Control owner: transfer pricing lead.
• High: Payment fraud through altered bank details or spoofed invoices appearing to come from group entities. Control owner: treasury lead.
• High: Disclosure of unpublished tax positions, dispute strategy, or taxpayer data to unauthorized people or personal devices. Control owner: head of tax with information security.
• Medium: Misclassification of related-party transactions such as loans, royalties, cost contributions, or services, creating mismatched positions across jurisdictions. Control owner: transfer pricing lead.
• Medium: Wrong withholding rates, unsupported treaty eligibility assumptions, or currency conversions taken from outdated templates. Control owner: tax compliance manager.
• Medium: Late or incomplete local documentation, causing missed deadlines and penalties. Control owner: tax compliance manager.
• Low to medium: Inconsistent statements to authorities, auditors, or group members across filings. Control owner: head of tax.

4Preventive Controls and Safe Work Practices

Preventive controls stop errors and fraud before they reach a return, ledger, or bank file. The core controls are segregation of duties, maker-checker review, reconciliation of tax and accounting records, and controlled change management for models and templates.

Working practices reinforce these controls. Analysts keep working papers showing sources, assumptions, and the reasoning behind each judgment. Estimates and provisions are labeled as estimates, with the basis stated. Staff do not make verbal commitments to tax authorities or counterparties without written approval from the head of tax. Where the law on a point is uncertain, the uncertainty and the reviewer's conclusion are recorded rather than hidden.

• Mandatory: Separate preparation, review, approval, and payment. The preparer of an intercompany invoice cannot approve it or release its payment.
• Mandatory: Support each intercompany charge with a signed agreement or documented policy, a service description, evidence the service was received, and a calculation that follows the agreed method.
• Mandatory: Reconcile intercompany balances with counterparty entities at each period close, and investigate any difference before the close is signed off.
• Mandatory: Lock final transfer pricing models and keep a version log showing the reason for each change, the reviewer, and the approver.
• Mandatory: Verify any change to supplier or counterparty bank details by calling a number already held on file, never a number supplied in the change request.
• Mandatory: Do not split transactions to avoid approval thresholds set in the delegation of authority.
• Mandatory: Document benchmarking search criteria, comparable selections, and rejection reasons. Never adjust data to reach a preferred result.
• Mandatory: Obtain written approval from the head of tax before entering a new intercompany arrangement or changing an existing pricing method.
• Recommended: Run analytics on intercompany entries for round amounts, weekend postings, unusual counterparties, and reversals near period end.

5Equipment, Environment, Information, and Protective Safeguards

Tools and working environments create their own risks. Tax software, enterprise resource planning systems, shared drives, and data rooms must be used through approved accounts. Multi-factor authentication is required where the information security policy requires it, and devices must meet the company standard before they connect to corporate systems.

Privacy safeguards apply wherever personal information appears in tax files, payroll data, or vendor records. Each jurisdiction sets its own rules on collection, cross-border transfer, retention, and disclosure. Confirm those rules with a qualified data protection professional, and treat this document as operational guidance only, not legal advice.

• Mandatory: Grant access on least privilege. Review access at the frequency set in the security policy and immediately after any role change or departure.
• Mandatory: Store taxpayer, employee, and pricing data only in approved repositories, never in personal email, consumer messaging apps, or removable media.
• Mandatory: Share sensitive files with external advisers only through approved secure transfer methods, with access limited to named individuals.
• Mandatory: Restrict printing of unpublished positions. Store printed copies in locked storage and shred them when no longer needed.
• Mandatory: Do not discuss unpublished positions in public areas, open-plan conversations, or calls with people outside the need-to-know group.
• Recommended: Use screen locks and a clean-desk habit, and collect equipment from departing staff before their last working day.

6Incident Reporting, Emergency Response, and Escalation

An incident includes suspected fraud, an unexplained change to payment details, a misstated return, a data leak, or a tax authority notice with a short response window. Near misses, such as a payment to a spoofed account that was stopped, must also be reported so patterns can be identified and controls improved.

Escalation should be factual and brief: what was seen, who is involved, what action was taken, and what evidence exists. Do not investigate alone or attempt to recover funds yourself. Let the designated owner decide next steps.

• Mandatory: Report suspicious activity to the finance controller and head of tax within one business day. If either of them is involved, report to the designated ethics or compliance channel.
• Mandatory: Hold the suspect payment, posting, or filing until review is complete. Do not alert a suspected individual while an investigation is underway.
• Mandatory: Preserve evidence. Keep emails, logs, and files unchanged, and do not delete or edit them.
• Mandatory: Log every tax authority notice with its deadline and escalate it the same business day. The head of tax decides who responds.
• Mandatory: Report any suspected taxpayer data breach immediately to information security and legal counsel, who determine notification duties under applicable law.
• Mandatory: Where there is an immediate threat to personal safety or a building emergency, follow local emergency procedures and contact local emergency services first. Tax matters never override this.
• Recommended: Maintain a pre-approved contact list of external counsel, forensic accountants, and tax advisers.

7Records, Training, Inspection, and Review

Records are the evidence that tax and pricing decisions were sound. Retention periods differ by jurisdiction and by record type, so confirm them with local counsel. Where no retention rule is confirmed, keep records until the matter is closed and legal counsel approves disposal. Records that are incomplete, or that were reconstructed after the fact, must be labeled as such and never presented as contemporaneous.

Internal audit reviews control design and operation independently and reports exceptions to the head of tax and the governing body. These norms are reviewed on a regular cycle and after any major change in group structure, business model, or applicable law. Each review records what changed, who approved it, and why.

• Mandatory: Maintain a tax position register listing each significant position, its supporting evidence, its approver, and its review status.
• Mandatory: Complete role-based training on the code of conduct, intercompany controls, and data handling before receiving access. Refresh it when rules or systems change.
• Mandatory: Keep training attendance records and retain them with the access approval file.
• Recommended: Test a sample of intercompany transactions and provisions each quarter against these norms, and record exceptions.
• Recommended: Hold a lessons learned review after each major filing or dispute, and update these norms where gaps are found.

Implementation checklist

• Confirm the tax position register lists each significant position with a named approver.
• Verify that the preparer, reviewer, and payment approver are different people for every intercompany charge.
• Check that each service charge has an agreement, evidence of receipt, and a calculation that follows the agreed method.
• Confirm any bank detail change was verified by calling a number already held on file.
• Reconcile intercompany balances with counterparty entities at each period close and resolve differences.
• Lock final transfer pricing models and confirm the version log is complete.
• Confirm system access matches current duties and was reviewed after any role change.
• Keep taxpayer and pricing data only in approved repositories and approved secure transfer methods.
• Report suspicious activity or near misses within one business day and preserve all evidence.
• Confirm local tax, transfer pricing, and data rules with qualified professionals before relying on this document.