Business Tax & Control Exposure Radar 2025

A1. How does your company monitor tax compliance during the month?

Continuous monitoring (weekly or more) with accountable owner and evidence Monthly review with checklist and evidence Occasional review (every 2–3 months) or “when possible” Only reviewed when there is an issue / request / audit

A2. How often do you reconcile CFDI (issued/received) against the ledger?

Monthly, documented, with accountable owner Monthly, but inconsistent evidence / depends on one person Quarterly or sporadically No formal reconciliation

A3. How do you handle recurring differences (cancellations, substitutions, complements, etc.)?

Documented process + log + validation before close Fixed, but without a formal process/log Fixed “when it appears”, no root-cause control Usually not detected or detected too late

A4. How early do you detect risks that lead to penalties (omissions, discrepancies, etc.)?

Before month-end close (alerts / preventive review) During month-end close After close (after filing/payment) Only when a notice / audit / request arrives

B1. Do your closes follow a fixed calendar with owners and deliverables?

Yes: calendar, roles, checklist and change control Yes, but depends on one/two key people (not fully formalized) Variable closes; it gets “figured out” each month No formal close

B2. How reliable is information for decision-making (margin, costs, taxes, cash flow)?

Reliable and timely; validated and variances explained Mostly reliable, but frequent last-minute adjustments Limited reliability; corrected with delays Not reliable; decisions rely on partial data

B3. Do you have basic authorization and segregation controls (payments, vendor setup, journal entries)?

Yes: segregation + formal approvals (at least 2 levels) Partial; some duties mixed due to staffing Informal; trust-based, inconsistent controls No controls; one person can do the full cycle

B4. How do you control journal adjustments and reclassifications?

Policy + evidence + approval + log Sometimes documented; approvals inconsistent Adjustments without consistent evidence Frequent adjustments without traceability

C1. How dependent is the operation on a single person?

Low dependency (backup roles / documentation / continuity) Moderate (key person reviews everything) High (without them, close stalls) Critical (no one else can operate; no documentation)

C2. What controls exist over systems/ERP/accounting (roles, logs, access)?

Defined roles reviewed periodically; change logging Defined roles but not reviewed periodically Broad access; permissions for convenience No real access/change control

C3. How do you manage backups and continuity (accounting & tax data)?

Automated backups + periodic restore testing Automated backups, no regular restore tests Occasional manual backups No reliable backup

C4. How do you document critical processes (close, invoicing, payments, reconciliations)?

Documented and updated processes; easy onboarding Partial documentation; relies on team experience Minimal documentation; learned by shadowing No documentation