At the beginning of each month, a corporate tax team gathers withholding tax slips, reconciles tax invoices, enters data into monthly tax returns, and submits the reports before the deadlines. Once electronic filing receipts are issued and payments are recorded, the work is considered complete. In management reports, the company’s tax compliance status for the month is marked as fulfilled.
But are timely filings and payments enough to demonstrate tax compliance? While both are formal obligations, they do not guarantee that tax return data is complete, the tax base has been calculated correctly, all relevant transactions have been reported, or the company’s tax position can withstand scrutiny by the tax authorities.
The distinction between formal and substantive compliance is more than an academic concept. Minister of Finance Regulation (PMK) No. 111 of 2025 on Taxpayer Compliance Supervision provides for supervision through the review of data and information. Its implementation guidelines, set out in Circular Letter of the Director General of Taxes No. SE-8/PJ/2026, distinguish between Formal Compliance Reviews and Material Compliance Reviews.
Formal reviews focus on the timeliness of taxpayer registration, tax payments, and filings. Material reviews, meanwhile, assess whether tax obligations have been substantively fulfilled. At a deeper level, comprehensive reviews cover risk profile analysis, business processes, financial statements, the arm’s-length nature of related-party transactions, and field visits.
These reviews are mandatory for strategic taxpayers, including all taxpayers under the Large Taxpayer Regional Offices, the Special Jakarta Regional Office, and Medium Taxpayer Tax Offices. This requirement demonstrates that tax supervision assesses not only whether tax returns are filed on time but also whether their contents are accurate. Companies therefore need systematic processes to ensure that both formal and substantive compliance requirements are met.
Consider a hypothetical manufacturing company that files all its monthly income tax returns under Articles 23 and 26, as well as its value-added tax (VAT) returns, on time for 12 consecutive months. During the procurement process, its engineering division signs a technical assistance agreement with an overseas affiliated company.
The agreement covers services and technical know-how without separately specifying their respective values. The accounting team records all payments as service expenses. Withholding tax is applied at the rate for services rather than the rate that might apply to royalties. In addition, the supporting documents required to apply a tax treaty are incomplete.
Formally, tax has been withheld, withholding tax slips have been issued, and returns have been filed on time. Substantively, however, the company faces the risk of withholding tax shortfalls, expense disallowances, and administrative penalties. These risks go undetected because the company lacks controls designed to identify and address them.
Tax as a Corporate Risk
In corporate risk management, risk refers to the possibility of an event that impedes the achievement of a company’s objectives. Tax risk is part of this broader category. Tax management errors can reduce profits through tax adjustments, interest, and penalties. Tax uncertainty can also disrupt cash flow planning, particularly when disputes drag on for years. Meanwhile, publicly disclosed tax audit findings can affect a company’s reputation among investors, banks, and business partners.
Serious violations of tax regulations may also expose corporations and their management to criminal liability. Nevertheless, some companies maintain risk registers covering market, credit, liquidity, operational, and cyber risks without specifically identifying tax risks. Others include tax risk only as part of general legal compliance risk.
One reason is the perception that tax is the responsibility of a single department, calculated at the end of a reporting period and addressed only when an audit takes place. In reality, nearly every business process has tax implications.
Purchases give rise to input VAT and withholding tax obligations. Sales involve output VAT and tax invoice issuance. Payroll creates withholding obligations under Article 21 of the Income Tax Law. Payments to overseas parties may trigger withholding tax under Article 26 and VAT obligations on the utilization of services from outside the Indonesian customs area. Corporate restructurings may also have tax implications arising from asset transfers.
Because tax risks arise across business processes, their management cannot rest solely with the tax department. Procurement, sales, related-party transactions, and cross-border payments are among the key areas requiring controls. Other supporting functions also need attention to ensure that risks are not overlooked.
From Compliance to Tax Governance
Administrative compliance, tax risk management, and tax governance represent three levels of maturity in tax management. Administrative compliance focuses on timely payments and filings. Implementation typically follows a tax calendar and depends on the tax function or specific individuals.
Tax risk management involves identifying risks, assessing their impact, reviewing contracts, and determining mitigation measures. However, this process remains inadequate if the findings are confined to the tax department and do not influence business unit decisions.
Tax governance makes tax management part of the company’s decision-making and oversight system. The board of directors sets the tax strategy and risk appetite, each function understands its responsibilities, and controls are documented and tested regularly.
Tax governance does not mean that companies must pay more tax or stop using legitimate tax incentives. Its purpose is to ensure that tax decisions are made by authorized parties, supported by defensible analysis, and accompanied by an understanding of the risks that remain. Companies can still adopt reasonable tax positions, provided they are supported by the substance of the transactions and adequate documentation.
Control Framework
The Organisation for Economic Co-operation and Development (OECD) introduced the tax control framework (TCF) as a control framework designed to ensure the accuracy and completeness of tax reporting and disclosure. In its 2016 publication, Co-operative Tax Compliance: Building Better Tax Control Frameworks, the OECD explains that evidence-based controls can provide assurance to management and help tax authorities assess the reliability of taxpayer compliance.
TCF is part of a company’s internal control system, not a universal certification or a replacement for existing systems. Its implementation should be tailored to the company’s size, business complexity, group structure, and risk profile. TCF can also be integrated into existing risk management systems. Its adoption does not, in itself, create a legal obligation or entitle a company to specific tax benefits in Indonesia.
The OECD outlines six key elements of a TCF. First, a clearly defined tax strategy. The strategy should be documented and supported by senior management. It should set out compliance principles, the company’s tolerance for tax uncertainty, and escalation procedures for high-risk tax positions.
Second, comprehensive application. The tax strategy should cover all relevant entities, tax types, transactions, and business processes, rather than focusing solely on corporate income tax or the main operating entity.
Third, clear allocation of responsibilities. Each control should have an accountable owner with adequate authority and competence. Tax, finance, procurement, sales, human resources, and business units should implement controls in line with their respective responsibilities, with accountability assigned at the appropriate management level.
Fourth, governance documentation. Companies need to document their processes, risk and control matrices, procedures, responsible parties, and evidence of implementation. The documentation must reflect actual practices.
Fifth, periodic control testing. Testing should assess both the adequacy of control design and the consistency of implementation. A well-designed control can fail if it is not applied consistently. Conversely, a control performed routinely may still be ineffective if it does not address the relevant risk.
Sixth, reporting of test results. The results of testing and assessments of TCF effectiveness should be reported to management, including identified weaknesses and the corrective actions taken.
The implementation of these six elements should follow the principles of materiality and proportionality. Risk assessments need to consider both quantitative and qualitative impacts, including related-party transaction and reputational risks. The complexity of the TCF should be proportionate to the company’s size and risk profile to ensure effective implementation.
Implementing TCF in Corporations
Implementing a TCF begins with mapping business processes and tax events. Companies need to examine procurement, sales, payroll, financing, related-party transactions, and cross-border payments. Each process should then be linked to general ledger accounts, tax types, data sources, and responsible parties. This mapping provides the basis for identifying potential errors and assessing their impact.
The mapping results should be incorporated into a risk and control matrix covering identified risks, preventive or detective controls, implementation frequency, responsible parties, evidence of implementation, and testing methods. Priority should be given to risks that are material, recurring, complex, or likely to have significant consequences.
In procurement, the supplier registration system can require the recording of tax status and payment categories. Contracts for technical services, licenses, and overseas transactions should be reviewed by the tax function before signing. After payment, reconciliation among contracts, invoices, payments, and withholding tax can help detect discrepancies.
In sales, delivery and billing data should be linked to tax invoice issuance. Reconciliation among the general ledger, output tax invoices, and monthly VAT returns is also necessary to ensure consistent reporting.
For related-party transactions, companies should maintain a centralized register and monitor margins throughout the year. This helps identify deviations before annual documentation is finalized.
For cross-border payments, pre-payment reviews should cover income classification, the applicable domestic tax rate or tax treaty rate, and verification of supporting documentation. Payments that do not meet control requirements should be reviewed and escalated before processing.
Tax controls can be divided into three types. Preventive controls include supplier data validation and contract approval before transactions take place. Detective controls include reconciliations and analytical reviews to identify discrepancies. Corrective controls include amended tax returns and process improvements after weaknesses have been identified.
Companies also need a mechanism for monitoring regulatory changes. This should include assigning responsibility, analyzing the impact of new provisions, updating procedures, and monitoring their implementation.
TCF documentation should enable traceability from strategy to transaction-level evidence. Tax position memos prepared when decisions are made, approval records, reconciliation results, and testing evidence can support corporate accountability.
Control effectiveness can be monitored through indicators such as the number of tax return adjustments, discrepancies between the general ledger and tax filings, payments delayed because of incomplete documentation, and the time taken to resolve findings. Monitoring results should be used to determine improvement priorities.
The Indonesian Context and the Way Forward
TCF is becoming increasingly relevant as tax supervision evolves toward greater use of data analytics and risk profiling. The integration of data and electronic reporting increases the need for account mapping, information consistency, and traceable documentation. Corporate readiness therefore depends not only on the ability to use digital applications but also on the quality of the processes that generate the data.
In 2026, the Directorate General of Taxes (DGT) announced a pilot of a collaborative compliance approach involving Pertamina and strategic state-owned enterprises. This development signals efforts to foster a more open relationship between taxpayers and the tax authority. However, the pilot does not mean that TCF has become a universal requirement or automatically provides tax incentives. Participant eligibility, assessment mechanisms, information exchange, and program benefits should be based on the applicable official guidelines.
For corporations, TCF implementation can begin with a self-assessment, the selection of high-risk areas, and the establishment of a control cycle covering strategy, implementation, testing, and reporting. The board of directors needs to provide a clear mandate, assign risk owners, and ensure that business functions are involved from the decision-making stage.
For the tax authority, transparent guidance on participant eligibility, implementation procedures, the responsibilities of each party, information protection, and pilot evaluation can support the adoption of a collaborative compliance approach.
Formal compliance does not, by itself, demonstrate that tax risks are being managed effectively. Risks arise throughout business processes, while tax reporting reflects decisions and data generated beforehand. Tax management therefore requires a system that connects strategy, processes, control responsibilities, documentation, testing, and accountability.
The TCF provides a control framework built around the six elements outlined by the OECD. Its effectiveness depends on sound control design, consistent implementation, objective testing, and follow-up action to address identified weaknesses. TCF does not replace the obligation to calculate, pay, and report taxes, but it helps companies manage compliance systematically and reduces their reliance on individual diligence.
Legal References
- Law of the Republic of Indonesia Number 6 of 1983 concerning General Provisions and Tax Procedures, as amended several times, most recently by Law of the Republic of Indonesia Number 7 of 2021 concerning Harmonization of Tax Regulations (Articles 39 and 39A).
- Law of the Republic of Indonesia Number 7 of 1983 concerning Income Tax, as amended several times, most recently by Law of the Republic of Indonesia Number 7 of 2021 concerning Harmonization of Tax Regulations (Article 18).
- Law of the Republic of Indonesia Number 40 of 2007 concerning Limited Liability Companies (Article 97).
- Minister of Finance Regulation Number 172 of 2023 concerning the Application of the Arm’s-Length Principle in Transactions Affected by Special Relationships.
- Minister of Finance Regulation Number 111 of 2025 concerning Taxpayer Compliance Supervision.
- Regulation of the Director General of Taxes Number PER-6/PJ/2026 concerning Technical Provisions on Global Minimum Tax.
- Circular Letter of the Director General of Taxes Number SE-8/PJ/2026 concerning Guidelines for Taxpayer Compliance Supervision.
Also Read:
Tax Refunds Are a Right, Not a Fiscal Favor
Complete List of Tax Account Codes and Tax Payment Type Codes for e-Billing
Article 26 Withholding Tax on Foreign Taxpayers
Writer: Ideatax | Editor: Thomas Rizal