Templates and records · UNE 19602
UNE 19602 tax incidents register template
Every tax error, Spanish Tax Agency request or channel report with tax content, with what was done and what changed afterwards.
In one sentence
The tax incidents register documents every tax error or breach detected —by a control, by the Spanish Tax Agency or through a channel report—, its cause, how it was regularised and the corrective action, and feeds back into the risk map; it is the evidence with which UNE 19602 shows that the system reacts and improves after each incident.
- Type of information
- Mandatory record Handling of nonconformities and improvement under UNE 19602
- Who fills it in
- Tax compliance body With finance and the tax adviser for the regularisation
- When
- When the incident is detected Effectiveness is verified after the next affected period
- How long it is kept
- At least 6 years UNE 19602 sets no period. Accounting records are kept for six years (art. 30 of the Spanish Commercial Code), the tax authority can audit for four years (art. 66 of the General Tax Act) and unused tax losses for up to ten (art. 66 bis).
What the standard requires
What UNE 19602 demands and what it leaves to your judgement
Like any management system, UNE 19602 requires the organisation to react to breaches, analyse their cause, apply corrective actions, verify their effectiveness and keep evidence of all of it. In tax matters the reaction also includes regularisation: a supplementary return, a correction or a payment.
Incidents arrive by three routes that are best recorded the same way: internal controls, actions by the tax authority and reports through the whistleblowing channel. In that last case, the file also follows the rules of Law 2/2023.
Regularising voluntarily before any request from the authority affects surcharges and penalties; documenting when the issue was detected and when it was regularised is part of the evidence of diligence.
Structure
Fields the template should include
- Number, detection date and route: control, tax authority, channel
- Tax, period and description
- Amount involved
- Regularisation: type, date and reference
- Root cause
- Corrective action, owner and deadline
- Effectiveness check
- Update to the risk map
Example
Example: withholdings not applied to a freelance professional
Company, people and figures are fictitious: the example only shows what a properly completed record looks like.
| Field | Content |
|---|---|
| Number and route | IF-2026-004 · quarterly control CT-09 · 14 April 2026 |
| Description | Invoices from a consultant (fictitious) paid without withholding in the first quarter |
| Amount | €1,350 of withholdings not paid in |
| Regularisation | Supplementary Form 111 return, filed on 28 April before any request from the authority |
| Root cause | Supplier onboarding did not distinguish professionals subject to withholding |
| Action | Mandatory “subject to withholding” field in supplier onboarding · accounts · 15 May |
| Effectiveness | Second quarter with no incidents · effective |
| Risk map | The withholding risk on purchased services is reassessed |
At the audit
Mistakes auditors commonly flag
- The position is regularised but neither the incident nor its cause is recorded.
- Spanish Tax Agency requests are handled by the adviser without the system knowing.
- Channel reports with tax content that never reach the tax compliance body.
- The risk map stays the same after repeated incidents.
In Kimobox
How this record is kept in Kimobox
- 1Each tax incident is recorded with its root cause and associated action.
- 2Whistleblowing channel reports are linked to the tax risk concerned and to the corrective action they trigger.
- 3After each significant incident, the tax risk map is updated.
Frequently asked questions
What people ask us before getting started
Is a request for information an incident?
Not necessarily. It is worth recording to keep a history of the authority’s actions, but it is only an incident if it reveals an error or a breach.
Is it the same as the channel’s logbook?
No. The logbook required by Law 2/2023 records the reports received and their investigations; this register records every tax incident, wherever it comes from. A report with tax content appears in both, linked.
Keep your UNE 19602 records without loose templates
We'll show you the module running with data similar to yours.
Keep exploring
Related pages
A whistleblowing channel that protects the people who speak up
Whistleblowing channel for employers with 50+ workers: restricted receipt, acknowledgement in seven days, a…
Whistleblowing register: ISO 37301 and Law 2/2023
What the register of reports received through the whistleblowing channel must hold under Law 2/2023 and ISO…
Improvement and responding to a tax audit
The final section closes the system: what happens after a tax incident, and how to arrive prepared for a tax…
UNE 19602 tax risk map template
How to build the UNE 19602 tax risk map: process, tax, cause, likelihood, financial and penalty impact…
Sources
Where each figure comes from
References to the official text in force. If a standard is revised, this page is updated and the review date says so.
- UNE 19602:2019 — Sistemas de gestión de compliance tributario. Requisitos con orientación para su uso (Tax compliance management systems. Requirements with guidance for use) UNE, Spanish Association for Standardisation · February 2019
- Ley 58/2003, General Tributaria (Spanish General Tax Act), arts. 66, 66 bis and 179.2.d BOE-A-2003-23186 · Consolidated text
- Ley 2/2023, reguladora de la protección de las personas que informen sobre infracciones normativas (Spanish whistleblower protection law) BOE-A-2023-4513 · 21 February 2023