HMRC's compliance yield — the additional tax recovered through enquiries, investigations and behavioural change campaigns — hit a record £34 billion in 2024/25. That figure is up 18% on the previous year and reflects a strategic shift: more data, faster risk assessment, and a willingness to open enquiries on relatively small returns where the data points to a likely error. If you run a small business, the probability of a compliance check is materially higher than it was three years ago.
How HMRC chooses who to investigate
The popular image of HMRC's risk system is a single algorithm called "Connect". The reality is more nuanced. Connect ingests data from over 30 sources — banks, PayPal and Stripe, Companies House, land registries, online platforms (Airbnb, eBay, Amazon, Etsy), DVLA, even social media in some cases — and flags outliers within an industry profile. A risk officer then reviews the flag and decides whether to escalate.
The common triggers we see in practice:
- Margins outside the industry norm. A restaurant declaring a 4% net margin when the sector average is 11% will be flagged.
- VAT-to-Corporation Tax mismatch. Sales declared for VAT that do not reconcile with turnover on the Corporation Tax return.
- Bank deposits exceeding declared income. Personal account deposits that look like business takings.
- Property portfolios with no rental income declared (cross-referenced against Land Registry and tenancy deposit schemes).
- Crypto activity. HMRC now receives data direct from major UK-facing exchanges under the Crypto-Asset Reporting Framework.
- Online sales platforms. The Reporting Rules for Digital Platforms (RRDP) mean Airbnb, Vinted, eBay and others now report sellers earning over a threshold direct to HMRC.
The different types of check
Not every brown envelope is the same. HMRC opens checks at varying levels of intensity:
- Aspect enquiry: focused on a single item, e.g. a deduction or a single transaction. Often resolved in one round of correspondence.
- Full enquiry: a complete review of the return. Lasts months and can involve site visits and director interviews.
- Code of Practice 8: enquiries into tax avoidance, typically planning schemes. Civil, but rigorous.
- Code of Practice 9 (Contractual Disclosure Facility): invitation to disclose suspected fraud, in exchange for civil treatment rather than prosecution.
- Criminal investigation: reserved for the most serious cases of evasion or organised fraud.
The first 14 days are critical
If you receive an enquiry notice, the most important step is the first one. You typically have 30 days to respond, but the way you respond shapes everything that follows. Common mistakes:
- Sending HMRC raw bank statements before classifying transactions. You give them a database to use against you.
- Answering questions outside the formal scope. HMRC can use any information you volunteer.
- Engaging without representation. Even articulate directors find that the language of "best practice" and "reasonable" in HMRC's framework hides specific legal meanings.
Engage your accountant immediately. If they are not experienced in HMRC enquiries, ask them to bring in a specialist. The cost of representation is almost always less than the cost of an unrepresented settlement, even on a small enquiry.
Penalty mitigation: behaviour matters more than amount
HMRC penalties for inaccurate returns are calculated as a percentage of the tax lost. The percentage range depends on the behaviour HMRC determines:
- Reasonable care taken: no penalty (though tax and interest still due).
- Careless: 0% to 30%.
- Deliberate: 20% to 70%.
- Deliberate and concealed: 30% to 100%.
Within each range, your final penalty is determined by the quality of disclosure: prompted vs unprompted, plus three behavioural factors — telling HMRC, helping HMRC, and giving HMRC access. Maximum cooperation can cut a deliberate penalty from 70% to 35%, halving the cost.
How to enquiry-proof your business
- Reconcile turnover sources monthly: VAT records, bank receipts, platform reports.
- Document expense claims contemporaneously: a receipt scanned at the time of purchase is worth ten reconstructed later.
- Keep personal and business banking strictly separate.
- Use our bookkeeping service for monthly reconciliation, or our business advisory team for an enquiry-readiness review.
If you have already received a check notice, do not delay. Contact us the same day or book an urgent enquiry call. Our experience is that the cases handled within 48 hours of the notice end with materially better outcomes than those left for two weeks.