IR35: What is an HMRC Business Risk Review, and how is BRR+ linked to off-payroll checks?

The Business Risk Review (BRR) is a process by which HMRC manages the tax compliance of the UK’s largest businesses – such as limited company contractors’ end-clients, writes Charlie Hemsworth, senior tax consultant at Bauer & Cottrell.

Having been around in some form for more than a decade, the BRR model was quite recently enhanced in October 2019 and is now known as the ‘BRR+.’  The primary objective remains to encourage businesses to adopt a more cautious approach to managing their UK tax affairs.

What does a BRR+ contain?

Key elements of the BRR+ include:

1. Categorisation of businesses into four groups: low, moderate, moderate-high, and high risk.
2. Consideration of the business landscape, taking into account factors such as size, complexity, and the extent of change.
3. A more detailed examination of each tax type, using 24 low-risk indicators categorised under Systems and Delivery, Internal Governance, and Approach to Tax Compliance.
4. A higher number of unmet low-risk indicators means an increased likelihood of a higher risk status.

Who does a Business Risk Review apply to?

The BRR+ applies to companies assigned to HMRC’s Large Business Directorate, specifically those with a UK turnover exceeding £200 million or gross balance sheet assets surpassing £2 billion (about 2,000 at the moment).

Companies not meeting these criteria may still be included in the Large Business Directorate if they are deemed complex, such as multinational businesses operating in the UK.

What does a BRR+ look like, or how is it conducted by HMRC?

These businesses must undergo a BRR+ by their HMRC customer compliance manager at least once every three years if their practices are deemed low risk. The frequency of the BRR may increase if HMRC assesses the business as medium or high risk at the conclusion of a BRR.

The BRR+ is typically conducted as a several-hour meeting, either virtually or in person, after completion by the business of various questionnaires and forms provided by HMRC covering the areas subject to the review, for example, VAT and, crucially for suppliers, IR35.

Since the introduction of the Off-Payroll Working rules (a.k.a. the OPW rules -- the ‘new’ IR35 introduced in the private sector for medium and large engagers on April 6th 2021), businesses subject to the BRR+ will find that the management of their IR35/OPW compliance now plays a key role in the overall HMRC review.

How could a BRR+ trigger an IR35 audit?

The BRR+ by HMRC comprehensively examines all taxes applicable to the business, ultimately assigning a risk rating to the business. This evaluation encompasses Income Tax and NIC, which means scrutiny to the management of off-payroll workers and the business's adherence to IR35 compliance within the BRR+.

Depending on the outcomes in this specific area, the business may face a further and more specific audit of its IR35 operations, with instances of such audits triggered by findings in a BRR+ already observed.

What IR35/OPW information is requested by HMRC during a BRR+?

As a minimum, a business undergoing the BRR+ should be prepared to provide IR33/OPW-related information on:

• The number of off-payroll workers it engages and in what capacity (e.g. own-limited company workers, umbrella company staff, sole traders).
• How many OPW workers are inside IR35 / outside IR35.
• Full details on the processes used to reach its IR35 determinations /decisions.
• Steps taken to identify and establish the responsibilities of its supply chains.

The above is a general guideline and where non-compliance is suspected, HMRC could open a full IR35 investigation which usually involves hundreds of questions and can last several years.

Is my business safe on the IR35 front if I am not subject to the BRR+?

While compliance with IR35/the OPW rules is considered as part of the broader BRR+, it is not the same thing as a specific IR35 check or audit. 

Medium and large private sector engagers who do not meet the criteria of a business subject to the BRR+ are still within scope of HMRC’s general compliance activity on IR35, as are limited company contractors who are engaging in contracts that are subject to the older IR35 rule, i.e. those with small engagers or wholly overseas clients.

IR35 checks and audits can be triggered in a number of ways in addition to the BRR+, including from check of employer records, Real Time Information data and random selection based on where you sit on the risk spectrum in HMRC’s eyes. A larger company using a higher number of off-payroll workers is likely to be at higher risk. 

Although less so in the current IR35 landscape, limited company contractors themselves are also still subject to HMRC investigations under the old Chapter 8 IR35 rules, and in our experience, these arise from either random compliance checks, or anomalies identified by HMRC in the company’s tax returns.

We are seeing increases in compliance activity in these areas.

How to quickly shut down an IR35 audit or the chance of one resulting from a BRR+

HMRC compliance activity is on the rise, and those subject to the BRR+ are in the unique position to be able to stop an IR35 audit before it even starts.

Here are a few pointers for all organisations with IR35 obligations:

• There is an abundance of free guidance available on HMRC’s platforms. Please read it, and read it again!
• Processes – ensure you have robust and tested procedures in place that identify your off-payroll workers, your supply chains, how you assess status, how you ensure decisions are passed down the chain, how you monitor and assess any changes and how you handle disputes. The larger your business and number of off-payroll workers you utilise, the more complex your processes will need to be. 
• Evidence – gather and record evidence of all the above and how and why you reached the decisions you did.
• Due diligence and documentation – don’t rely on automated tools in isolation. Comprehensive IR35 status determinations should be undertaken with consideration of both the working arrangements by the relevant person within your organisation and also the written contracts applicable to the engagement. For longer running engagements, the position should be re-assessed regularly.
• Ensure your staff are adequately trained. Have your written contracts reviewed by an expert to ensure they align with the working practices and determinations your appointed IR35 decision-makers are making.  If you outsource your IR35 assessments to a third party, don’t just take their determinations at face value – consider their reputation, experience in IR35 and the OPW rules, and how comprehensive their assessment process is and whether it involves human intervention.     
• Speak to an expert – the  off-payroll legislation is extremely complex and the requirements can be overwhelming for some organisations, even to the point they avoid engaging off-payroll workers altogether. By consulting with an experienced and reputable expert, you will receive guidance in structuring processes and making determinations that thoroughly address your responsibilities, demonstrating a proactive approach to compliance.

Finally, it’s all about doing all of the above with “reasonable care” – an approach specified in the OPW legislation. The above is a solid starting point and all will assist in mitigating HMRC penalties in the unfortunate event you come cropper of an IR35 audit in 2024, as a result of a BRR+ or otherwise.