Written by Stefan Trouw, MaxProf Audit Manager
Why Process Drift — Not Technical Complexity — Is the Real Corporate VAT Risk
Most corporate VAT exposure does not arise from complex interpretation. It arises from unchallenged process.
Whether a business manages VAT compliance internally through a financial manager or bookkeeper, or outsources it to an external accounting firm, the structure of how that compliance work is performed matters far more than most business owners realise.
In both environments, a pattern emerges. The same person, or the same team, prepares the VAT return month after month. A review happens – internal sign-off, or a manager at the accounting firm reviewing the output before submission. The VAT201 goes out on time. The relationship is trusted. Nobody questions the underlying methodology because there has never been an obvious reason to.
This is not negligence. It is simply how compliance operates when it runs without independent challenge.
The problem is that repetition normalises error. Mechanical inconsistencies do not appear dramatic when they first arise. They become embedded in the process, replicated across periods, and invisible to anyone who has never looked at the architecture from the outside.
The Most Common VAT Weakness
In VAT health checks across industries, the largest adjustments have not stemmed from aggressive tax positions or legislative misinterpretation. They have stemmed from process drift that nobody caught because nobody was looking for it.
The patterns that emerge most frequently are VAT control accounts not properly reconciled to VAT201 submissions, refunds carried forward inconsistently across periods, adjustments processed outside the VAT control environment, discounts or credit notes not aligned to output VAT reporting, and input VAT captured in the ledger but never flowing into the VAT return.
None of these require reinterpretation of legislation. They require reconciliation discipline.
Where reconciliation architecture is weak, errors repeat unnoticed. If the error results in overpaid VAT, the business suffers silent cash leakage. If the error results in underpaid VAT, the exposure compounds into penalty risk.
Both outcomes originate from the same weakness: unchecked process.
The False Comfort of Familiar Oversight
For businesses that manage VAT internally, the challenge is rarely about competence, it is about proximity. A financial manager or bookkeeper who has handled VAT for years will naturally develop a settled methodology, and there is usually good reason for the confidence placed in them. But even a well-run process benefits from being tested by someone who did not build it. When the same person both designs and reviews an approach, certain assumptions become part of the architecture without ever being examined afresh. An independent review is not a question mark over anyone’s ability. It is simply a mechanism that no internal process, however capable the person behind it, can replicate on its own.
For businesses that outsource to an external accounting firm, a different but equally significant assumption applies. Professional outsourcing creates an expectation of professional scrutiny. But the reality of most small to medium practices is that VAT returns are prepared and reviewed within the same workflow, often by capable people following a methodology they inherited rather than one they were asked to rebuild. The review layer confirms the output looks reasonable. It does not typically re-examine whether the underlying process remains sound. This is not a failing of the firm. It is the natural consequence of any compliance function where preparation and oversight sit within the same structure.
In both cases, the structure that produces the VAT return is the same structure that reviews it. That is the gap.
Outsourcing the compliance function does not outsource the risk. The VAT exposure sits with the business regardless of who prepares the return. And when the same process runs unchallenged across multiple periods, what appears to be a well-managed compliance function can carry significant structural exposure that nobody has ever been positioned to see.
What a Pre-Audit VAT Review Actually Tests
A proper VAT stress test does not begin with legislation. It begins with architecture. The review works through five layers, each designed to surface a different category of exposure.
- VAT201 to General Ledger reconciliation — matching every period to VAT control accounts, trial balance movements, prior period carry forwards, and refund logic consistency, with trend analysis across multiple years rather than period-by-period review.
- VAT control roll-forward integrity: whether refunds flow correctly into subsequent periods, whether adjustments are processed consistently, and whether manual journals are bypassing VAT logic. Mechanical distortions here are often the largest single exposure point.
- Input VAT capture flow — whether tax invoices meet Section 20 requirements, whether VAT amounts align with ledger allocations, and whether adjustments are correctly reflected in VAT201 returns. In many cases, valid input VAT never reaches the return because of allocation errors that repeat silently across periods.
- Output VAT adjustment discipline. Credit notes, discounts, rebates, and consideration reductions must align with output VAT reporting. Where the accounting system processes commercial adjustments but the VAT treatment is not mirrored, distortions compound over time.
- The documentation control environment. Audit readiness requires structured zero-rating files, adjustment registers, tax invoice repositories, and technical memoranda supporting interpretive positions. Without documentation, even technically correct positions become vulnerable under scrutiny.
The Governance Dimension
VAT risk is not purely operational. It carries governance implications that business owners and boards are increasingly being held accountable for.
Demonstrable internal controls, evidence of independent VAT review, and reconciliation sign-off protocols are no longer considerations reserved for large corporates. When an audit letter arrives, the question SARS is effectively asking is not whether the VAT return balances. It is whether the organisation can demonstrate that it maintained meaningful control over its VAT process.
A business that relies entirely on an internal preparer without independent verification, or on an external firm without any separate review layer, cannot easily answer that question.
The Cost of Inaction
Where reconciliation architecture is weak and process drift has gone unchallenged, the consequences follow a consistent pattern. Understatements trigger penalties under the Tax Administration Act. Interest compounds from original due dates. Historic periods are reopened. Cash flow shocks occur at the worst possible time.
What appears as a minor mechanical inconsistency can escalate into a multi-period exposure that is far more costly than any review would have been.
The Imperative
Audit preparedness is not reactive. It requires independent stress testing before scrutiny arrives, not in response to it.
For businesses managing VAT internally, this means introducing a review function that operates separately from the preparation function. For businesses relying on external firms, this means commissioning an independent assessment that sits outside the existing compliance relationship entirely.
In neither case is the implication that something is wrong. In both cases, the point is that without an independent layer, there is no reliable mechanism to know.
The most significant VAT findings in practice typically originate from process failure, not legislative misinterpretation. The return was prepared. It was reviewed by the same system that produced it. It was submitted on time.
And nobody asked whether the process itself was right.
