Templates and records · UNE 19602

UNE 19602 tax risk map template

Where the company’s tax compliance could break down, what it would cost and what prevents it today, process by process.

In one sentence

The tax risk map identifies, by process and by tax, the risks of failing to meet tax obligations, rates them by likelihood and impact —tax due, surcharges, interest, penalties and, above €120,000 per period, a criminal tax offence— and links them to the controls that cover them; it is the core element UNE 19602 requires the organisation to identify, analyse and assess.

Content reviewed on 17 October 2026

Type of information: Mandatory document Tax risk assessment required by UNE 19602, kept up to date
Who fills it in: Tax compliance body Together with finance and the tax adviser, who know how each tax is handled
When: At least once a year And after regulatory changes, new transactions, reorganisations or incidents
How long it is kept: At least 6 years UNE 19602 sets no period. Accounting records are kept for six years (art. 30 of the Spanish Commercial Code), the tax authority can audit for four years (art. 66 of the General Tax Act) and unused tax losses for up to ten (art. 66 bis).

What the standard requires

What UNE 19602 demands and what it leaves to your judgement

UNE 19602 requires the organisation to identify, analyse and assess its tax risks and to review them periodically and whenever circumstances change. The map is how that is documented, and how you show the assessment existed before a tax inspection, not after it.

The standard imposes no scale. The sensible approach is to rate impact in money —tax due, interest, surcharges, penalty— and to flag separately any risk that could reach the threshold of the tax offence in art. 305 of the Spanish Criminal Code, given its consequences for the legal person.

Compared with the ISO 37301 risk matrix, this map goes down to the level of each tax and process: invoicing and VAT, withholdings, related-party transactions, deductions, excise duties.

Read it in context: Tax risk map, in the UNE 19602 Academy

Structure

Fields the template should include

Process and responsible area
Tax or obligation concerned
Description of the risk and its causes
Likelihood
Impact: estimated tax due, surcharges, interest and penalty
Whether it could reach the tax offence threshold
Existing controls and how effective they are
Residual risk, priority and actions
Assessment date and next review

Example

Example: VAT deduction risk at a distributor

Company, people and figures are fictitious: the example only shows what a properly completed record looks like.

Field	Content
Organisation	Comercial Duero (fictitious) · wholesale distribution · 140 staff
Process	Purchasing and booking of supplier invoices
Tax	VAT · deduction of input VAT
Risk	Deducting VAT on invoices that lack formal requirements or on expenses unrelated to the business
Rating	Medium likelihood · estimated impact €35,000 in tax, interest and penalty
Tax offence	Below the threshold
Controls	Check of invoice requirements before booking (control CT-04)
Residual risk	Low · annual review
Date	10 March 2026

At the audit

Mistakes auditors commonly flag

A generic map copied from another company, with none of its own processes.
Impact rated as “high, medium, low” with no figure to back it up.
Not reviewed after regulatory changes or after a request from the Spanish Tax Agency.
Risks with no controls attached, or controls with no evidence that they are performed.

In Kimobox

How this record is kept in Kimobox

1The tax risk map is recorded with each risk’s likelihood and impact.
2Every tax risk is linked to the process that gives rise to it.
3Map reviews are scheduled for whenever tax legislation changes.

Frequently asked questions

What people ask us before getting started

How does it differ from the ISO 37301 risk matrix?

The ISO 37301 matrix covers any compliance obligation; the UNE 19602 map deals only with tax, in more detail by tax and with impact expressed in money. They can coexist: the tax map is a detailed chapter of the general matrix.

Should local taxes be included?

If they fall within the scope of the system, yes. The business activities tax or the property tax are rarely high risk, but they should still be assessed.

Keep your UNE 19602 records without loose templates

We'll show you the module running with data similar to yours.

Request a demo

Keep exploring

Sources

Where each figure comes from

References to the official text in force. If a standard is revised, this page is updated and the review date says so.

UNE 19602:2019 — Sistemas de gestión de compliance tributario. Requisitos con orientación para su uso (Tax compliance management systems. Requirements with guidance for use) UNE, Spanish Association for Standardisation · February 2019
Ley Orgánica 10/1995, Código Penal (Spanish Criminal Code), arts. 31 bis and 305 BOE-A-1995-25444 · Consolidated text