Tax Risk Assessment: Categories, Exposures, and Penalty Tiers

A tax risk assessment is a structured review that identifies, measures, and prioritizes the exposures in your company’s tax positions before the IRS or a state authority finds them for you. The federal assessment window runs three years from the date a return is filed, six years when more than 25% of gross income is omitted, and indefinitely for fraud or unfiled returns.¹ Every undetected exposure inside those windows keeps accruing interest, penalties, and professional fees. Running a formal assessment catches those exposures while you still have room to fix them cheaply.

The Four Categories of Tax Risk

Every exposure you find will fit into one of four buckets, and the bucket determines your response.

Compliance risk is the failure to file the right forms on time. A partnership return is due by the 15th day of the third month after year-end; a C corporation return is due by the 15th day of the fourth month. Miss those and automatic penalties begin whether or not any tax is owed.²

Reporting risk is the chance that your tax provision under ASC 740 is materially misstated on the financial statements. A miscalculated deferred tax liability can trigger restatements that hurt investor confidence far beyond the tax dollars involved.

Strategic risk covers poor tax planning decisions: an aggressive structure the IRS later challenges, or the failure to adapt when legislation changes the rules underneath you.

Operational risk is the mundane category. Data entry errors, spreadsheet-based depreciation schedules, understaffed tax departments. These feel small until they produce a six-figure adjustment.

Most real exposures span more than one category. Worker misclassification, for instance, is operational (wrong form), compliance (payroll taxes not withheld), and often strategic (the company chose contractor treatment to cut costs). When a business misclassifies an employee, it becomes liable for the income taxes, Social Security, and Medicare taxes that should have been withheld, plus unemployment taxes that were never paid.³

Setting the Scope

Scope defines what the assessment covers. Get this wrong and you will miss your highest-exposure areas entirely. Three choices drive it: which entities, which tax types, and which years.

Entities: cover every legal structure in the organization. Subsidiaries, partnerships, disregarded entities, and foreign affiliates with U.S. reporting obligations all belong in scope.

Tax types: go beyond federal income tax. Include payroll, sales and use, property, excise, and information returns. Each has its own filing calendar and its own penalty regime.

Years: cover at minimum the current fiscal year plus every open year. The IRS generally has three years from the filing date to assess additional tax.⁴ That stretches to six years when a return understates gross income by more than 25%, and it never closes for a fraudulent or unfiled return.¹

Write down what is out of scope, too. Stating boundaries explicitly stops the team from assuming someone else reviewed a high-exposure area like R&D credit substantiation when no one actually did.

Where Domestic Exposures Hide

With scope set, work through the transactions, positions, and processes most likely to generate additional liability.

Corporate events create immediate exposure. Mergers, acquisitions, and divestitures require careful purchase price allocation, and mistakes in how goodwill is treated or how tax elections are documented can lock in bad results for years. The same applies to restructurings or ownership changes that affect net operating loss carryforwards.

Legislative changes catch tax departments off guard on a rolling basis. The One Big Beautiful Bill Act, signed in 2025, restored immediate deduction of domestic research and experimental expenditures rather than five-year amortization, and reinstated 100% bonus depreciation for qualifying property placed in service after January 19, 2025.⁵ Any company that built its 2025 or 2026 provision on the old amortization rules now has a compliance gap. State economic nexus thresholds for sales tax are another moving target. After the Supreme Court’s 2018 decision in South Dakota v. Wayfair, virtually every state adopted economic nexus standards, and remote sellers who have not tracked the changing thresholds face unexpected collection obligations.

Internal process weaknesses deserve the same scrutiny as external changes. Spreadsheet-based depreciation schedules mean every manual formula is a potential error. E-commerce platforms that do not automatically update sales tax sourcing rules accumulate liability with every transaction. These are the easiest exposures to overlook because they involve no aggressive positions and no novel transactions. They just quietly compound.

Finally, flag every position where the company took an aggressive or non-standard approach. Capitalizing costs that might more properly be expensed, claiming a deduction at the edge of established authority, or treating income based on a favorable reading of ambiguous guidance all belong on the inventory. These draw the most examiner attention.

International and Transfer Pricing Exposures

International operations deserve their own review because the penalties are severe and often automatic.

Any U.S. person with an interest in a foreign corporation may need to file Form 5471. Failing to file a complete and correct Form 5471 triggers a $10,000 penalty per form, per year. If the IRS sends a notice and the form is still not filed within 90 days, another $10,000 accrues for every 30-day period the failure continues, up to a $50,000 continuation cap.⁶ These penalties apply per entity, per year. A company with three foreign subsidiaries and two missed years can face well over $100,000 in penalties before any tax deficiency is calculated.

Foreign financial accounts create a separate obligation. If the aggregate value of all foreign accounts exceeds $10,000 at any point during the calendar year, you must file a Report of Foreign Bank and Financial Accounts (FBAR) by April 15, with an automatic extension to October 15.⁷ Willful violations can reach $100,000 or 50% of the account balance per violation, whichever is greater.

Transfer pricing between related entities is where many international exposures originate. Under IRC Section 482, the IRS can reallocate income between commonly controlled organizations to reflect arm’s-length pricing.⁸ Contemporaneous documentation is the only defense. The IRS has stated that a taxpayer can avoid the net section 482 adjustment penalty only if it satisfies the documentation requirements of Section 6662(e)(3)(B) and the related Treasury regulations, and that documentation must be both adequate and timely.⁹

Scoring Risks and Understanding the Penalty Tiers

Identifying exposures fills the inventory. Scoring them tells you where to spend money and attention. Each risk gets rated on two dimensions: how likely it is to materialize, and how much it will cost if it does.

Likelihood is typically a one-to-five scale. A one is a theoretical risk with no examination history. A five is a near-certain event like an automatic penalty for a late-filed information return. Financial impact captures not just the primary tax deficiency but the interest and penalties that pile on top. The IRS compounds underpayment interest daily and adjusts the rate quarterly. For the first quarter of 2026 the underpayment rate was 7%; it dropped to 6% for the second quarter.¹⁰ Non-corporate taxpayers pay the federal short-term rate plus three points; large corporate underpayments use the short-term rate plus five points.

Penalty exposure escalates in tiers. Knowing which tier applies is what separates a useful assessment from a guess.

The accuracy-related penalty is 20% of the underpayment attributable to negligence, disregard of rules, or a substantial understatement of income tax. This is the baseline for most compliance failures. A substantial understatement generally means the understatement exceeds the greater of 10% of the correct tax or $5,000.¹¹

The substantial valuation misstatement penalty is also 20%. It applies when the value or basis claimed is 150% or more of the correct amount, when a transfer price is 200% or more (or 50% or less) of the arm’s-length price, or when a net section 482 adjustment exceeds the lesser of $5 million or 10% of gross receipts.¹²

The gross valuation misstatement penalty doubles to 40% when the claimed value reaches 200% or more of the correct amount, a transfer price hits 400% or more (or 25% or less) of the correct price, or the net adjustment reaches the lesser of $20 million or 20% of gross receipts.¹²

The civil fraud penalty is 75% of the fraudulent portion of any underpayment. Once the IRS establishes that any part of the underpayment is attributable to fraud, the entire underpayment is treated as fraudulent unless the taxpayer proves otherwise by a preponderance of the evidence.¹³

Plot the scores on a matrix with likelihood on one axis and impact on the other. High-likelihood, high-impact risks demand immediate action. Do not ignore medium-likelihood risks with catastrophic impact, though. A transfer pricing adjustment that seems unlikely but would trigger a $20 million reallocation deserves more attention than a near-certain $5,000 late-filing penalty.

If your company issues audited financial statements, uncertain tax positions require a parallel analysis under ASC 740’s more-likely-than-not threshold, and corporations with total assets of $10 million or more that record a reserve for unrecognized tax benefits must file Schedule UTP with their federal return.¹⁴

Cutting Penalties Through Disclosure

One of the most practical outputs of the assessment is identifying positions where proactive disclosure can eliminate or reduce penalties.

Form 8275 lets taxpayers disclose return positions that are not otherwise adequately disclosed on the return. Filing it can eliminate the accuracy-related penalty for substantial understatement, provided the position has at least a “reasonable basis,” which the IRS describes as significantly higher than merely arguable but lower than “substantial authority.”¹⁵ Positions taken contrary to a regulation require Form 8275-R instead, and the position must represent a good-faith challenge to the regulation’s validity.

Disclosure has limits. Form 8275 cannot protect against penalties for negligence, valuation misstatements, transactions lacking economic substance, or undisclosed foreign financial asset understatements.¹⁵ It works best where you have a genuine legal basis but fall short of substantial authority. The assessment should identify exactly which positions fall in that gap.

Building the Controls That Prevent Recurrence

Identifying and scoring risks is diagnostic. A Tax Control Framework is where you build the systems that stop those risks from repeating.

Governance comes first. Someone must own every risk on the inventory, and accountability must run from the preparer up to the CFO and the board or audit committee. When the IRS evaluates whether a company exercised “ordinary business care and prudence,” it looks at compliance history, systems, and whether management was paying attention.¹⁶ A documented governance structure is your best evidence that someone was.

The framework needs both preventive and detective controls. Preventive controls stop errors before they happen: mandatory dual review of journal entries affecting tax accounts, segregation of duties so the preparer does not authorize the payment, and automated tax engines that apply current rates and sourcing rules without manual input. Detective controls catch what slips through: reconciliations between tax provision workpapers and the general ledger, exception reports flagging unusual effective tax rate movements, and periodic sampling of sales tax exemption certificates.

Written policies keep judgment calls consistent. Every recurring decision, from how you determine nexus thresholds to how you distinguish repair costs from capital improvements, should be governed by a policy that removes ad-hoc reasoning. Transfer pricing policies should require annual preparation of the contemporaneous documentation package, since that documentation is the only defense against the net adjustment penalty if the IRS challenges intercompany pricing.⁹

A formal change management process closes the loop on legislation. When a bill like the One Big Beautiful Bill Act restores immediate R&D expensing and 100% bonus depreciation,⁵ someone must trace the impact through every affected calculation, update the compliance procedures, and confirm the changes flow into the current-period provision. Companies that treat legislative monitoring as someone else’s job discover the problem during an audit.

Controls that are not tested are assumptions. Public companies under the Sarbanes-Oxley Act must include a management assessment of internal controls over financial reporting in every annual report,¹⁷ and tax controls over the provision, deferred tax balances, and uncertain positions are typically among the most complex areas tested. Private companies are not subject to SOX, but annual testing is still good practice. A control that worked last year may have been undermined by a system upgrade, a staffing change, or a new transaction type.

Training is the other half. The best framework fails if the people executing it do not understand it. That includes personnel outside the tax department, such as accounts payable staff processing vendor payments or sales teams issuing exemption certificates, whose daily decisions affect tax outcomes.

Responding When the Assessment Finds Problems

A thorough assessment almost always turns up something that needs correcting. How you respond matters as much as what you found.

The first question is whether the error warrants an amended return. Filing one is voluntary, and the IRS does not penalize taxpayers for choosing not to amend. But when the assessment reveals a clear underpayment, filing an amended return and paying the additional tax stops interest from accruing and demonstrates the good faith that supports a reasonable cause defense if penalties are later proposed. The IRS evaluates reasonable cause by asking whether the taxpayer exercised ordinary business care and prudence, whether they attempted to comply once the problem was identified, and what the overall compliance history looks like.¹⁶

For more serious issues, including willful failures to report income or file required international information returns, the IRS Criminal Investigation division operates a Voluntary Disclosure Practice. Participation requires preclearance from CI before submitting the disclosure, and the taxpayer must be prepared to pay the full liability or enter an installment agreement. A voluntary disclosure does not guarantee immunity from prosecution, but it significantly reduces the likelihood the government pursues criminal charges.

If the assessment overlaps with an active examination and you disagree with the IRS’s proposed adjustments, you generally have 30 days from the date of the IRS letter to file a formal written protest requesting review by the IRS Independent Office of Appeals.¹⁸

Documentation and Record Retention

Every part of the assessment, from scoping decisions to final risk scores and remediation steps, belongs in a centralized repository. The documentation serves three audiences: your own team, so the assessment can be repeated and compared year over year; internal and external auditors; and the IRS if it ever examines a position you assessed.

The formal report to senior management and the board or audit committee should present residual risk after controls are in place, not just gross exposure. That means showing gross exposure for each identified risk, the controls designed to mitigate it, and any reserves already established.

Record retention should match the longest applicable statute of limitations, not the general three-year rule. Keep records for six years if there is any possibility that unreported income exceeds 25% of gross income stated on the return, or if a return involves income attributable to foreign financial assets exceeding $5,000. Keep records for seven years if you filed a claim for a loss from worthless securities or a bad debt deduction. Employment tax records should be kept for at least four years after the tax becomes due or is paid, whichever is later.¹⁹ If a return was never filed or was fraudulent, there is no expiration. Keep those records indefinitely.

1
Office of the Law Revision Counsel. 26 U.S. Code 6501 – Limitations on Assessment and Collection
2
Internal Revenue Service. Starting or Ending a Business 3
3
Internal Revenue Service. Worker Classification 101 – Employee or Independent Contractor
4
Internal Revenue Service. Time IRS Can Assess Tax
5
Internal Revenue Service. One, Big, Beautiful Bill Provisions
6
Internal Revenue Service. International Information Reporting Penalties
7
Internal Revenue Service. Report of Foreign Bank and Financial Accounts (FBAR)
8
Office of the Law Revision Counsel. 26 U.S. Code 482 – Allocation of Income and Deductions Among Taxpayers
9
Internal Revenue Service. Transfer Pricing Documentation Best Practices Frequently Asked Questions
10
Internal Revenue Service. Quarterly Interest Rates
11
Internal Revenue Service. Accuracy-Related Penalty
12
Office of the Law Revision Counsel. 26 USC 6662 – Imposition of Accuracy-Related Penalty on Underpayments
13
Office of the Law Revision Counsel. 26 U.S. Code 6663 – Imposition of Fraud Penalty
14
Internal Revenue Service. Uncertain Tax Positions – Schedule UTP
15
Internal Revenue Service. Instructions for Form 8275
16
Internal Revenue Service. IRM 20.1.1 Introduction and Penalty Relief
17
U.S. Government Publishing Office. Sarbanes-Oxley Act of 2002
18
Internal Revenue Service. Preparing a Request for Appeals
19
Internal Revenue Service. How Long Should I Keep Records