How UK CFOs Should Build HMRC-Ready Tax Governance in 2026

UK CFOs at large companies must certify annually to HMRC that tax accounting arrangements are adequate under the Senior Accounting Officer regime. That requirement is now backed by sharply rising enforcement activity, making 2026 the year tax governance moves from a compliance footnote to a board-level control priority.

According to HMRC, large-business compliance yield rose from £7.1 billion in 2021-22 to £15.8 billion in 2024-25 — a return the department describes as £95 for every £1 spent on compliance activity. The UK’s 2,000 largest businesses now account for roughly £337 billion of tax receipts, around 39% of the total, and HMRC’s direction of travel is explicit: the question is no longer whether a company has tax controls, but whether it can prove, consistently, that those controls work in practice.

What Is the Senior Accounting Officer Regime and Who Does It Apply To?

The Senior Accounting Officer (SAO) regime applies to UK-incorporated companies with turnover above £200 million or a balance sheet total above £2 billion for the preceding financial year, assessed on aggregated — not consolidated — group figures. The SAO is the director or officer with overall responsibility for the company’s financial accounting arrangements, and in practice this is almost always the CFO or Finance Director. The role carries personal, not just corporate, accountability: the SAO signs the certificate, and the SAO bears the penalty if it is wrong.

Executive Action:

• Confirm whether your group meets the £200 million turnover or £2 billion balance sheet threshold on an aggregated basis, including UK subsidiaries of overseas parents.
• Formally document who holds the SAO designation each financial year and notify HMRC within the required window to avoid the £5,000 notification penalty.
• Review whether the SAO designation has followed a recent restructuring, acquisition, or finance leadership change.

Why Is HMRC Scrutiny on Tax Governance Intensifying in 2026?

HMRC’s large-business compliance model now runs through assigned customer compliance managers who expect consistency across VAT, corporation tax, employment taxes and customs — a structured review approach reported under the “Project Snowball” umbrella covering VAT, corporate tax and employment duty systems and processes. The shift is from box-ticking to evidence: HMRC increasingly expects a company to identify who owns tax risk, how responsibilities are allocated across teams, how escalation works when issues arise, and how judgement calls are documented and reviewed. A control framework that exists only in policy documents, without evidence it operates day to day, no longer satisfies HMRC’s expectations.

Executive Action:

• Map current tax controls against HMRC’s “identify, allocate, escalate, evidence” expectations rather than against internal policy alone.
• Brief the audit committee on Project Snowball’s scope and the shift toward operational evidence over documented policy.
• Request a copy of your firm’s HMRC Business Risk Review classification and address any “moderate” or “high” risk flags before the next review cycle.

What Should a CFO’s Tax Control Framework Actually Cover?

A defensible tax control framework covers all taxes in scope of the SAO certificate — corporation tax, VAT, PAYE and customs duty — and evidences three things for each: who owns the risk, how the control operates, and how exceptions are escalated. This is distinct from a general internal controls framework built for Companies Act or Provision 29 purposes; HMRC wants tax-specific evidence, not a cross-reference to a broader governance statement. CFOs should treat the SAO certificate as an audit trail exercise conducted continuously through the year, not a document assembled in the weeks before the filing deadline.

Executive Action:

• Build a tax control matrix that names an owner, control activity and evidence source for each of corporation tax, VAT, PAYE and customs duty.
• Separate tax-specific control evidence from your wider internal controls and Provision 29 documentation — HMRC will not accept one as a substitute for the other.
• Run a mid-year dry run of the certificate with finance, tax and internal audit before the formal sign-off window opens.

How Should CFOs Prepare for the Annual SAO Certificate?

The SAO certificate must reach HMRC within six months of financial year end for public companies and nine months for private companies, confirming either an “unqualified” position — appropriate arrangements were in place throughout — or a “qualified” one that discloses shortcomings. A qualified certificate is not automatically penalised; an unqualified certificate that later proves inaccurate is the more dangerous outcome, since it exposes the SAO personally. CFOs should treat early identification and disclosure of control gaps as the lower-risk path, supported by a clear remediation plan HMRC can see is being actioned.

Executive Action:

• Calendar the six- or nine-month filing deadline against your specific financial year end, not a generic date.
• Set a quarterly control-testing cadence so certification is a confirmation exercise, not a discovery exercise.
• Use INFORMD’s executive self-assessment tools and capital approval assessment template as a starting structure for board-level control reporting.

What Happens If Tax Governance Fails?

Failure carries personal financial consequences alongside reputational ones. HMRC can levy a £5,000 personal penalty on the SAO for failing to maintain appropriate tax accounting arrangements, a further £5,000 for a late or incorrect certificate, and a separate £5,000 corporate penalty for failing to notify HMRC of the SAO’s identity — with no statutory reduction available except a reasonable-excuse defence. Beyond the fines, a qualified or inaccurate certificate typically triggers closer HMRC scrutiny across the group’s wider tax affairs, extending review cycles and audit committee reporting burdens well beyond the immediate issue.

Executive Action:

• Confirm D&O or personal indemnity coverage explicitly addresses SAO personal penalties, not just general director liability.
• Escalate any known control gap to the audit committee before certification, with a dated remediation plan attached.
• Review our related briefing on Economic Crime Act filing obligations for how adjacent corporate compliance deadlines interact with tax certification timing.

INFORMD provides intelligence briefings, tools and frameworks for senior business leaders across technology, finance, strategy and compliance. Based in Milton Keynes, UK, we help executives stay informed and act with confidence. Explore our full briefing library (/resources/) or access our free assessment tools (/tools-assessments/). Our upcoming video briefings will cover SAO certification walkthroughs in more depth — contact us if you’d like to suggest a topic.

Stay ahead. Subscribe to INFORMD’s weekly executive briefing at informd.co.uk (/resources/).