Templates and records · UNE 19602 · Clause 8.3

UNE 19602 tax controls register template

Proof, control by control, that what the risk map says is checked really has been checked, when and by whom.

In one sentence

The tax controls register describes each financial or non-financial control that covers a tax risk —what is checked, by whom and how often— and keeps evidence of each performance and its result; UNE 19602 requires those controls to be put in place (8.3), and without a record of their performance there is no way to show a tax inspector that they worked.

Content reviewed on 17 October 2026

Where the standard requires it: UNE 19602 · Clause 8.3 The UNE 19602:2019 section is cited where it has been checked; otherwise each template points to the relevant part of the Academy.
Type of information: Mandatory record Controls required in section 8.3; evidence of performance is retained
Who fills it in: Owner of each control Usually finance or accounts; the tax compliance body supervises
When: At each control’s frequency Before each return, monthly, quarterly or annually depending on the risk
How long it is kept: At least 6 years UNE 19602 sets no period. Accounting records are kept for six years (art. 30 of the Spanish Commercial Code), the tax authority can audit for four years (art. 66 of the General Tax Act) and unused tax losses for up to ten (art. 66 bis).

What the standard requires

What UNE 19602 demands and what it leaves to your judgement

UNE 19602 requires financial and non-financial controls, proportionate to the tax risks identified, over the organisation’s processes. The standard leaves their design open; what it does not accept is a control with no evidence that it is carried out.

Every control must link to the risk in the map that it covers. A control that covers no risk is superfluous; a high risk with no control is a nonconformity.

Evidence is what turns a control into proof of diligence: the date, the sample reviewed, the result and who did it.

Read it in context: Tax controls and whistleblowing channel, in the UNE 19602 Academy

Structure

Fields the template should include

Control identifier and description
Risk in the map that it covers
Type: financial or non-financial; preventive or detective
Person responsible for performing it
Frequency
Performance: date, sample reviewed and result
Issues found and how they were dealt with
Evidence attached

Example

Example: control before the quarterly VAT return

Company, people and figures are fictitious: the example only shows what a properly completed record looks like.

Field	Content
Control	CT-04 · Check of invoice requirements and business use before deducting VAT
Risk	Improper deduction of input VAT
Type	Financial · preventive
Owner	Head of accounts
Frequency	Quarterly, before Form 303
Performance	8 July 2026 · 60 invoices reviewed by sampling · 2 issues
Issues	Two invoices without the recipient’s tax ID: a corrected invoice is requested before deducting
Evidence	Sampling sheet and request emails attached

At the audit

Mistakes auditors commonly flag

Controls described in a manual with no record of when they were performed.
Controls not linked to any risk in the map.
The person performing the control is the same one who prepares what is being controlled, with no review.
Issues found by the control that are neither corrected nor recorded.

In Kimobox

How this record is kept in Kimobox

1Tax controls are documented directly on the process map.
2Each performance is recorded with its evidence, ready for a tax inspection.
3Indicators of controls performed are calculated from the system’s records.

Frequently asked questions

What people ask us before getting started

What is a non-financial control?

One that acts not on figures but on behaviour or decisions: prior approval of risky transactions, segregation of duties or training for exposed staff.

Is the statutory audit enough?

No. The statutory audit gives an opinion on the financial statements; tax controls prevent errors in each return. The two complement each other.

Keep your UNE 19602 records without loose templates

We'll show you the module running with data similar to yours.

Request a demo

Keep exploring

Sources

Where each figure comes from

References to the official text in force. If a standard is revised, this page is updated and the review date says so.

UNE 19602:2019 — Sistemas de gestión de compliance tributario. Requisitos con orientación para su uso (Tax compliance management systems. Requirements with guidance for use) UNE, Spanish Association for Standardisation · February 2019
Código de Comercio (Spanish Commercial Code), art. 30 (retention of books and records) BOE-A-1885-6627 · Consolidated text