Title: SGATAR
1PROFESSIONAL
SGATAR
20-23 November 2006
SEGMENT
AUDIENCE
DATE
Development of Risk Intelligence Systems
Presented byPhilip Hind, Chief Knowledge
Officer Australian Taxation Office
2- Contents
- Tax Office Context understanding the context
for our risk management policy, processes and
products - What risk frameworks and methodologies does our
tax administration use? - What are our tax administrations key strategies
for determining risk? - How are emerging risks identified?
- What levels of risk analysis does our tax
administration undertake? - What tools has our tax administration developed
for risk analysis? - To what extent is our audit strategy built around
risk assessment? - To what extent does our tax administration share
data with other government departments and how
useful is such data?
3Tax Office ContextUnderstanding the Tax Office
business environment provides the context against
which to view our risk management policy,
processes products
4TAX OFFICE CONTEXT
- Understanding the Tax Office environment
- Our commitment to government
- To effectively manage and shape administrative
systems that support and fund services for
Australians and give effect to social and
economic policy through the tax, superannuation,
excise and other related systems. - Our commitment to the community
- To administer the tax system fairly by helping
people to do the right thing, by making it as
easy as possible for taxpayers to comply, and by
identifying people who are not meeting their
obligations and dealing with them appropriately. - Our business intent
- To optimise voluntary compliance and make
payments under the law in a way that builds
community confidence.
Risk Those events that could impact upon our
ability to deliver our commitments intent
5TAX OFFICE CONTEXT
- We deliver our business intent by
- Helping taxpayers and their agents understand
their rights and obligations - Making it as easy as possible for people to
comply with the law - Ensuring effective strategies are in place to
deter, detect and deal with non-compliance - Developing and supporting the capability of our
people and others in the system - Our outputs reflect the delivery of our business
intent - Shape, design and build administrative systems
that support and deliver community and government
expectations of the tax system - Manage tax collections, transfers and payments
- Assure compliance and support for revenue
collection - Assure compliance and support for transfers and
regulation of superannuation funds - Deliver services to government and government
agencies which facilitate government policy and
meet community expectations - Give effect to, monitor and provide feedback to
Treasury on the tax law and policy
6CONTEXT OUR BUSINESS MODEL
We do this through our Business Model which is
reliant on intelligence and risk capabilities
The Intelligence Blueprint defines how we intend
to build and shape internal capability
We need to minimise unnecessary intrusions into
compliant clients affairs
Good data sets, analytics and intelligence are
the foundation of client segmentation and
appropriate treatment differentiation.
EXTERNAL ENVIRONMENT
We seek to strengthen whole of government
capabilities in Intelligence Risk through
collaboration with law enforcement agencies
We need to understand taxpayer behaviours and
changes in our environment
Data matching, analytical risk profiling and
intelligence inform our risk management approach
7CONTEXT COMPLIANCE MODEL
We use our compliance model to guide our
compliance work and better understand why people
are not complying
High Risk
Use full force of the law
Have decided not to comply
Deter by detection
Dont want to comply
Help to comply
Try to, but dont always succeed
Make it easy
Willing to do the right thing
Create pressure down
Compliance Attitude
Compliance Strategy
Low Risk
8CONTEXT IMPROVE INTELLIENCE
Improving our intelligence capability is at the
core of our approach to managing risk
Our vision To provide actionable intelligence
which supports the Tax Office sense environmental
changes, manage strategic risks and position
itself to anticipate future challenges.
Current state Risk based organisation Dissects
and analyses Relies on internal and media
views Reactive to new threats Keeps things to
themselves Business area results Audit and legal
skills dominant Isolated, competing systems
Future state Intelligence led organisation Synthe
sises views Open to new sources Strongly
proactive, anticipates Share information by
habit Collaborate for results Intelligence skills
seen as a career must have Same platform,
shared design
9CONTEXT IMPROVE INTELLIGENCE
- We have four core components for improving
intelligence - Processes
- Tax Office intelligence process
- Tax Office management processes (planning,
governance, assurance and conformance) - Distributed capability working to a central
intent enabling sharing, mapping to revenue
products and market views - People
- Key role of intelligence analyst and decision
maker - Intelligence professional career stream
- Systems
- Shared intelligence repository
- Information technology enablers (eg search
engines, data mining, data modelling) - Products
- Types of products alert, scan, assessment and
scenario - Level of products strategic, operational and
tactical
10CONTEXT IMPROVE INTELLIGENCE
We identified the Intelligence lifecycle as the
basis of our user pathway
LOGICAL STEPS SHOWN STEPS ARE NOT NECESSARILY
SEQUENTIAL IN PRACTICE
?
Did this answer my question? Has something new
come out of this?
Review
Recognition of need
Needs analysis
DECISION MAKERS
Collect
Evaluate
Organise Store
Plan
Collection plan
COLLECTORS
Analyse
Report
Disseminate
Analysis plan
Note In the IMSF the Report step is included in
Use/Disseminate
ANALYSTS
NOTE The intelligence refinement process is not a
strictly sequential process. Some components can
be actioned to some extent before moving to the
next phase eg in analysis you can find the need
to plan for and collect additional information.
LEGEND Not a formal step in process Formal step
in process
11CONTEXT IMPROVE INTELLIGENCE
- How we use intelligence to inform our work
1
1
1
1
1
1
1
1
2
3
1
Metrics
1
Intelligence Focus Area
Candidate Case
Compliance Case
Case Outcome
SourceData
Efficiency
Effectiveness
Stakeholder Satisfaction Decisions Influenced
Quantity Quality Timeliness Cost
1
1
1
FinalisedCase
1
1
1
Selected Case
1
1
Intelligence Lead
1
Intelligence Context
InformationUniverse
12CONTEXT IMPROVE INTELLIGENCE
- Our implementation plan
- Strategic leverage model
- Set up a small central unit (45 FTEs) with
capability and strategic leadership roles - Supported by collaborative relationships with
business line functional areas - Functional areas retain responsibility for
primary intelligence collection, evaluation and
risk management, but within a broader framework
of centrally managed capability and strategic
assessment - Benefits of this approach
- Leveraged change through central leadership of
capability development - Consistent focus and distillation of strategic
intelligence and risk issues - Local management of intelligence and risk where
local know-how is best placed - A measured approach to change
13CONTEXT IMPROVE INTELLIGENCE
- Intelligence is positioned now as a corporate
rather than line capability
- Governance
- Chief Knowledge Officer provides leadership of
corporate intelligence capability reports to
Second Commissioner, Change Program - Dotted line accountability to Second
Commissioner, Compliance - Executive overview exercised through Change
Program Executive, Audit Committee and Compliance
Executive - Intelligence and Risk Leadership Group (cross
business line executives) provide strategic
guidance and support - Corporate Design Forum provides ultimate review
of Corporate Environmental Scan and HOTSA - Intelligence policy and practices to be issued as
companions to the Risk Management Corporate
Management Practice Statements and Instructions - Assurance process including Certificate of
Conformance to be introduced
14CONTEXT IMPROVE INTELLIGENCE
- We are helping by developing guides and support
- Common business language same song sheet
- Consistent business practice (first 3 guides
relating to the phases of the intelligence
pathway officially launched in August) harmony - Consistent metadata
- Comprehensive view
- Communities of practice
- Debriefing (pull intelligence)
15IDENTIFYING THREATS OUR PRODUCTS
We have four key intelligence products . . .
Identify key matters that require more analysis
and understanding
This is what we are seeing. Here are the
Patterns and Trends SCAN
Strategic Value Add
Identify key trends and drivers that require
an analysis of their future Impacts on us
These are the Drivers of the Patterns and Trends.
This is the Impact on us. ASSESSMENT
Allows Exec to consider the development of
control systems to reduce the likelihood of
occurrence and contingency plans to reduce the
impact of an occurrence.
This is what might or may happen SCENARIO
Frequency of Product
What / Who When / Where
Why / How
Look what we found ! ALERT
Look out for this/ Look what we found ALERT
Look out for this ! ALERT
Identify key matters that should be escalated
as a priority
Identify key matters that should be escalated
as a priority
Identify key matters that should be escalated
as a priority
Look at this!
Look at this!
Look-out !
Describe
Explain
Predict
Depth of analysis
16IDENTIFYING THREATS DISCOVERY AND DETECTION
- An example of standardised intelligence
reporting. . .
17CONTEXT IMPROVE INTELLIGENCE
We are developing a competency based model to
guide recruitment, training and career development
USE THE INTELLIGENCE RISK FRAMEWORK
UNDERSTAND THE ENVIRONMENT
CHAMPION THE INTELLIGENCE FUNCTION
INTELLIGENCE COMPETENCYFRAMEWORK
APPLY ANALYTICAL, CRITICAL SYSTEMS THINKING
WORK AS PART OF A WIDER COMMUNITY
FOCUS ON COMMUNICATING
18Tax Office Intelligence risk frameworks
methodologiesIntelligence risk processes have
different processes they need to be
systemically integrated
19FRAMEWORKS HIGH LEVEL RISK PROCESSES
- The Tax Office Risk Management Practice Statement
translates the AS NZS 43602004 benchmark
framework into our environment, our process and
our products
20FRAMEWORKS TAX OFFICE INTELLIGENCE RISK
MANAGEMENT POLICY, PROCESS AND PRODUCT
21FRAMEWORKS RISK MAPPING
We use risk mapping to identify risk from
source to impact
Risk Impact
Source of Risk
Risk Event
Late or non-lodging behaviour
- Operational
- X returns not lodged for review
- Increased workload cost pressure
- Financial
- Y Income tax revenue delayed or not collected
- Reputation
- Z decline in community perceptions of fairness
integrity
Taxpayers have obligation to lodge income tax
returns annually by a certain date
22FRAMEWORKS
We differentiate but link intelligence and risk
management.
Intelligence is now recognised as separate from
the overall discipline of risk management but
with clear links via risk identification and
assessments
gt
gt
gt
gt
RISK IDENTIFICATION
RISK ASSESSMENT
RISK MITIGATION
RISK MONITORING
INTELLIGENCE
ASSETS AND OBJECTIVES CREDIBLE THREATS/
OPPORTUNITIES CRITICAL VULNERABILITIES COLLAT
E AND DOCUMENT
RISK RATING IDENTIFY CLIENT SEGMENTS AT RISK
EDUCATE AND ENCOURAGE DETER AND DEAL
WITH LEGISLATE / SYSTEM CHANGES
REPORT AND EVALUATE
INTELLIGENCE GATHERING
Systems/products
- Intelligence database (ATOi)
- Scans
- Assessments
- Scenarios
- Alerts
- Product and campaigns, for example
- Marketing and education
- Compliance
- Easier, cheaper and more personalised
- Internal and external reports, for example
- Annual report
- HOTSA
- Heartbeat
INTELLIGENCE FOCUS
23FRAMEWORKS INTELLIGENCE AND RISK LIFECYCLE
- Risk management informs the planning of
intelligence. - Intelligence informs risk identification
(discovery of threats) and risk monitoring
(detection of known threats). Both are needed.
Plan
Review
Collect / create
Risk context
Risk monitoring Detection of risk and issues
Risk identificationDiscovery of threats and
issues
Use / disseminate
Evaluate
Risk mitigation
Risk assessment
Organise and store
Analyse
24Tax Office Strategies for determining riskThe
Tax Office Environmental Scan and Health of the
System Assessment (HOTSA) process are key
mechanisms for surfacing and considering
strategic risks at an executive management level
25STRATEGIES ENVIRONMENTAL SCAN
We have a Corporate Environmental Scan process
for identifying external threats and opportunities
Social
Technological
Economical
Political
Clusters of interest identified
Cluster 2007 Rating Impact 2009 Rating
Size of impact Economic growth Low Almost
certain Medium Almost certain Rising oil
prices Low Almost certain High Almost
certain Generational and work life
shifts Low Probable Medium Almost
certain Electronic integrity attacks Low-Med Almo
st certain Medium Almost certain Anytime,
anywhere computing Low Almost certain Medium
Almost certain Global commercial
practices Low Almost certain Medium
Almost certain Regulatory inter-Govt
Reform Medium Almost certain Medium Almost
certain Skill shortages and migration Medium Proba
ble Medium Probable Almost certain
Estimated 93 probability of occurrence Probable
Estimated 75 probability of
occurrence Based on CIA Sherman Kent words of
estimative probability
26STRATEGIES TAX OFFICE HOTSA
Our Health of the System Assessment (HOTSA)
process is used to confirm overall risks and
inform downstream processes
Stakeholder Conversation
Strategic Context
New Insights Actions
Corporate Environmental Scan
Final iterationsto plans
Sub-plan HOTSAs
Next Years Budget/Plans
Stronger Emphasis
Corporate HOTSA
3-Year Forecast
Mid-year Review
Change Assumptions
Strategic Shifts
Plans Resourcing
Completed by Febeach year
5-year Strategic Statement
New Direction
Stakeholder Data
Final iterationsto plans
Capabilities Data
Intelligence Task Plan
Key Threats Unknowns
New Risks Mitigation
Illustrative Inputs
Key Outputs
Key DownstreamActivities
Feedback asNew Inputs
27STRATEGIES - TAX OFFICE HEALTH OF THE SYSTEM
ASSESSMENT
NOTE Sample text only
28STRATEGIES ULTIMATELY DOWN TO A VIEW THAT LINKS
TO THE CLIENTS ACTIVITIES
29STRATEGIES INITIAL RISK MODELLING
Comprehensive risk score modelling for change
program to enable better case selection and
targeting of treatment plans
Initial modelling has focussed on the Income Tax
and GST product obligations This will be extended
over time to cover all product and obligation
types
Initial modelling target areas
Lodge
Register
Report/Advise
Account
Fully Compliant
Obligation -gt
Propensity to Lodge On-time
Propensity to Register Correctly
Propensity for Correct information
Propensity to Pay On-time In full
Propensity to Meet All Obligations
Administrative Product ?
(weighted scores)
Risk Score
Risk Score
Risk Score
Risk Score
Risk Score
Risk Score
- Income Tax
- GST
- Excise
- Super
- (other FBT etc)
- All Products(weighted scores)
Risk Score
Risk Score
Risk Score
Risk Score
Risk Score
Risk Score
Risk Score
Risk Score
Risk Score
Risk Score
Risk Score
Risk Score
Risk Score
Risk Score
Risk Score
Risk Score
Risk Score
Risk Score
Risk Score
Risk Score
Risk Score
Risk Score
Risk Score
Risk Score
Risk Score
- Risk Attributes
- Assessment History
- Label Analysis
- Ratio Analysis
- Refunds/Liabilities
- Risk Attributes
- Registration History
- Proof of Identity
- Risk Attributes
- Lodgment History
- Timeliness
- Ageing
- Predicted revenue
- Risk Attributes
- Payment History
- Debt Level
- Timeliness/ Ageing
- Capacity to pay
Whole of Client Score
NOTE Client Scores can be further aggregated
to support Industry, Occupation and Product Risk
Scores for the whole client population. .
30Tax Office identification of threats (emerging
risks)The discovery and detection processes
31IDENTIFYING THREATS DISCOVERY AND DETECTION
Detection of known risks Know what to look for
and having the means
What we know we know
What we know we dont know
- Categorisation approaches (segmentation analysis,
value chain analysis etc) - Impact/sensitivity analysis
- SWOT/SPOT analysis
- Directed scanning
- Issue analysis
- Market and competitive analysis
Discovery of threats weaknesses Discovery
begins with the awareness of a relevant
abnormality
What we dont know we know
What we dont know we dont know
- Knowledge discovery processes eg data and text
mining
- Undirected scanning
- Scenario analysis / gaming
- Blind spot analysis
- Delphi approaches
NOTE Surprises should only occur in this quarter
NOTE Key reputation risk of not seeing what you
know
32IDENTIFYING THREATS DISCOVERY AND DETECTION
THE THREAT-RISK-ISSUE CAUSAL CHAIN
Using a causal chain of risks and threats helps
us with our approach to compliance
Derived from 'Strategic thinking in Criminal
Intelligence' The Federation Press 2004, p. 123.
33IDENTIFYING THREATS- DISCOVERY AND DETECTION
3
Future
1. Current Intelligence Where are we? What is
hitting us at what cost. What are people
seeing/saying/sensing 2. Priority Intelligence
Damage control -Pressing threat/risk 3. Future
Intelligence What is ahead Allow course
changes/positioning Set-up monitoring of those
things that might hit us Debriefing What hit us
Why - learnings
2
Priority
1
Current
34Tax Office levels of intelligence
riskStrategic, operational tactical
35LEVELS HAVE COMMON VIEW OF LEVELS OF
INTELLIGENCE
STRATEGIC INTELLIGENCE Provides senior decision
makers with insight or understanding, and aims to
make a contribution to broad strategies and
policy OPERATIONAL INTELLIGENCE Supports decision
makers at all levels in planning, resource
deployment and case selection activities TACTICAL
INTELLIGENCE Supports decision makers in taking
case specific action
Tactical (Occurrence/case level) Supports case
specific activity
Observation
EVENTS (Observed Occurrences) What you see
What happened/ is happening? The tip of the
iceberg
World views as to the underlying events What are
our paradigms?
Operational (Targeting/case selection level do
more or less. The local picture of what is
happening against plan) Supports business line,
segment, product or regional activity
What has been happening, where, when and to whom
and what might happen?
PATTERNS TRENDS (Contributing
Factors) Relational, Temporal, Spatial, etc
Understanding
Strategic (System policy level change treatment
to address the root causal factors in a systemic
and sustainable manner. Set priorities. Forward
focus.) Supports Tax Office wide
activity Identifies potential threats to the Tax
Office mission
What forces are at play and what are the drivers
of this issue/ behaviour?
STRUCTURAL DRIVERS (Causes/Attractors/Repellers)
Insights
NOTE The names are interchanged in some
organisations. The important thing is to have
one organisational view.
Reference Derived from page 102, Strategic
thinking in criminal intelligence, Jerry H
Ratcliffe Editor, Federation Press
36LEVELS KEY INTELLIGENCE NEEDS EXIST AT ALL
LEVELS STRATEGIC, OPERATIONAL AND TACTICAL
- Patch - Base revenue, assessed/collected
- - Patterns/Trends/Drivers for Patch how are
things moving - - Estimated Revenue, Contribution to budgeted
revenue - - Key success outcome measures linked back
to the patch mission (What are we here for) -
- Participants - Significant categories of
clients in patch (Top down segmentation are
these appropriate and meaningful) - - Significant clusters of clients in patch
(Bottom up segmentation what do these tell us
about client behaviours) - - Significant clients, influencers, leverage
points - Problems (strategic intel) - Thematic issues,
risks, threats in patch (are these reflected in
client clusters) - (what matters) - Intent Capability ltgt
Vulnerability Threat - know what to look for - Likelihood/Probability
of occurrence Consequence of occurrence Risk
- - Frequency of occurrence Consequence of
occurrence Issue - - Control effectiveness (Preventative/Deterrent/
Corrective) -gt Residual risk - - Selection effectiveness
- - Treatment effectiveness
- Player Pareto - 80/20 rule for patch. Those
clients who matter the most - (who matters) - Relative size (Base maintenance
monitoring)
Strategic aspects
Issue Profile
Operational aspects
Client Profile
Tactical aspects Top down detection
Bottom up discoveries
37LEVELS BROAD CLUSTERING ARRANGEMENTS FOR TAX
OFFICE INTELLIGENCE RELATED WORK
38LEVELS LINKING THE INTELLIGENCE AND RISK
CAPABILITY MANAGEMENT CORPORATELY
For strategic intelligence to work certain
aspects of intelligence need to flow upwards and
be synthesised into a corporate picture of the
tax system environment. While tactical and
operational intelligence security concerns may
require the implementation of the need to know
principle, this must not be permitted to detract
from or override strategic intelligence needs
The need to share. Equally the training and
skilling aspects of a corporate intelligence
capability require a sharing of learning and
experience across organisational units. One
mechanism for progressing this is via formal
community of practice approaches built around the
intelligence capability and its sub specialties.
In creating these communities of practice care
should be taken to ensure that intelligence flows
across the market, product and focus area views.
CORPORATE INTELLIGENCE UNIT
BSL INTELLIGENCE UNITS
Strategic Intelligence
Market Intelligence (Large, SME, Micro, INB,
NFP/Govt)
Product Intelligence (Inc T, GST, Excise, SPR)
ATP Intelligence (Avoidance activities/ Schemes)
COMMUNTIES OF PRACTICE
Serious Non Compliance (Fraud Evasion
activities)
Analytic Intelligence (Data Mining etc)
Business Intelligence
KNOWLEDGE CAPTURE SKILLING
39Tax Office intelligence risk toolsQualitative
quantitative approaches need to be brought
together to have the greatest effect
40TOOLS EXPLORATORY DATA ANALYSIS AND DESCRIPTIVE
DATA MINING
Good analysis is at the heart of understanding
the skill set is not widely available Averages
are not good enough (which mean, median or
mode?!). Data analysis must go beyond simplistic
aggregate summations Tools SAS
JMP Exploratory Data Analysis SAS Insight Large
scale Data Analysis SAS Ent Miner Data mining
(industrial) NCR WH Miner Large scale data
mining Rattle (free) Datamining (easy to use)
41TOOLS RISK ENGINE VIEWS OF RISK
Example International dealings / Foreign
ownership
The two chart shows the difference in the risk
profile of foreign owned and Australian owned
companies in the large market. What is
immediately clear it the fatter risk profile for
foreign owned highlighting the higher incidence
of risk factors per foreign owned company. The
Australian owned pyramid also has a much larger
base which represents all companies with no
identified risk 46 compared to 9 for foreign
owned. Risk assessed using ratios, tax to
turnover, norms, assets, event analysis etc.
42Simple decision tree modelnow grow 500 have
them vote together to select a case
TOOLS SIMPLE DECISION TREE MODEL
- Case selection models can be relatively simple
conceptually or complex approaches such as - Logistic Regression
- Random Forest approaches
- Support Vector Machines
- Neural Networks
- Even where a complex method is used it is useful
to have a simple decision tree for - explanatory purposes
- Why was this client selected over that
- Productionise into work and case management.
Letter X
Letter Y
Call
Treatment Review
Treatment Audit
43TOOLS RISK SCORING
Risk scoring gives revenue lift over methods
that dont prioritise clients
Diagrams such as risk charts allow management to
see the revenue caseload trade-off that a
analytic model provides. Often 40 to 50 of the
caseload will provide 90 to 95 of the revenue
when an analytic model is deployed.
44TOOLS CHAMPION / CHALLENGER TREATMENT EVALUATION
- Champion treatment assigned to majority (80) of
target segment (similar clients) - Challenger(s) treatment(s) assigned to minority
(2x10) of target segment (similar clients) - gtgt Identify treatment that gives best long term
outcome make champion - gtgt Invent new challenger treatments to test
- Nb Champion/challenger control groups give you
the information needed to evaluated effectiveness
of treatment strategies...
Champion
Today
Potential actions
Challenger 1
RETURN ON INVESTMENT
Break even
Current ROI trajectory
Challenger 2
KEY
Champion treatment Challenger Treatment
1 Challenger Treatment 2
TIME
45Tax Office Risk assessment and client treatment
strategyReview advise, Audit penalise,
Investigate prosecute
46CLIENT SPECIFIC TREATMENTS
Have decided not to comply
Use full force of the law
Deter by detection
Dont want to comply
Assist to comply
Try to, but dont always succeed
Make it easy
Willing to do the right thing
Leverage
Attitude to Compliance
Compliance Strategy
Targeted Investigate prosecute civil /
criminal Targeted Audit penalise
administrative detect deterrence Targeted/specif
ic Review advise assist to
comply Specific/general Market educate
assist to comply / make it easy General/specific
System legislative changes/simplification
Persona presented
47CLIENT SPECIFIC TREATMENTS INTELLIGENCE AND RISK
PROCESS
Strategic Intelligence Operational
Intelligence Tactical Intelligence
What to treat
Who to treat with what
What is needed to do the treatment
Discover Detect
Analyse Assess
Deal with Deter Discourage
Monitor Review
48Sharing of informationSocial security, Child
support, Medical expenses
49SHARING INFORMATION
- Whole of government approach strong future
direction - Matching of data between Social security Tax
- Child support Tax
- But why play the gotcha game when you can use
the same information to pre-populate - Experience of Nordic countries. Denmark, Sweden
etc - Moving towards pre-population approaches makes it
easier and keeps the client in the system - Some incorporated into e-Tax now.
50Questions
answers