VAT is a governance responsibility, not a compliance task

By Chetan Vanmali, Partner at Webber Wentzel

If VAT is not on your risk register, it should be. This is not simply because SARS is modernising VAT administration, audits are increasing or technology is changing. VAT belongs on the risk register because it is one of the few taxes that touches almost every transaction a business processes, every day, across every division and operating model. For CFOs, this means VAT is more than a tax department responsibility; it is an enterprise-wide governance issue.

A business collects VAT on the government's behalf, and every sale, procurement transaction, import, export, intercompany recharge and major business transformation can carry a VAT implication. Unlike many other taxes, VAT is woven into the operational fabric of the business, which also means that a single error is rarely isolated. An incorrect tax treatment, system configuration or process can replicate itself across thousands of transactions before anyone identifies the problem. That is why VAT belongs permanently on the CFO's risk agenda, not simply because of what is happening in 2026, but because of what VAT has always been: a transaction tax with enterprise-wide exposure.

VAT is a business risk, not just a tax issue

One of the most common misconceptions is that VAT is primarily a tax department issue. In reality, VAT sits at the intersection of finance, operations, procurement, sales, treasury, technology, supply chain, legal and human resources and when something goes wrong, the root cause often sits outside the tax function. It may begin with incorrect ERP configuration, poor master data, weak procurement controls, incorrect vendor onboarding, poor contract drafting, inadequate document retention, mergers and acquisitions activity or changes to the business model. The tax team may only identify the issue months later, SARS may discover it years later and ultimately the CFO may be left to explain it. That sequence alone should prompt a rethink of how VAT is managed: if VAT is treated purely as a compliance process, responsibility tends to sit with the tax team, but if it is treated as a business risk, ownership becomes broader, controls become more visible and accountability becomes clearer.

What should CFOs be asking?

There is one practical step every CFO can take: establish clear executive ownership of VAT risk. This starts with asking who owns VAT risk, which is different from asking who owns VAT compliance. Who is ultimately accountable for ensuring that VAT risks are identified, assessed, monitored and reported across the business? If the answer is simply "the tax department", there may be a gap in the organisation's broader risk framework.

The next question is where VAT risk is reported. CFOs should consider whether VAT features appropriately in executive risk committee reporting, audit committee reporting, internal audit plans and control monitoring programmes; if it does not, the organisation may be managing VAT as a filing obligation rather than as a business risk.

Finally, CFOs should ask who monitors the controls. Every significant VAT risk should have a documented control owner: responsibility for incorrect tax coding could sit with the finance systems lead, invalid vendor claims may fall within the procurement head's remit, export documentation may be owned by the supply chain leader, VAT return accuracy by the group tax manager and ERP tax engine configuration by the CIO or technology lead. The precise allocation will differ between organisations, but the principle is the same: once ownership becomes visible, accountability follows.

SARS modernisation changes the visibility of VAT risk

The case for stronger VAT governance becomes even more relevant as SARS moves towards a more digital and data-driven VAT administration environment. The proposed VAT Modernisation programme envisages structured e-invoicing, electronic reporting, inter-operability frameworks and increasingly automated VAT compliance processes and SARS has also indicated a future vision involving greater transaction-level visibility, pre-populated VAT returns and increased use of digital data for compliance and risk analysis.

For CFOs, the significance of this shift is not simply the technology but the transparency it brings. Historically, VAT errors could remain hidden for months after the transaction that caused them; in a more digital VAT environment, those errors can become visible much closer to the point at which the transaction occurs. That represents a fundamental shift in the way VAT risk needs to be managed, moving the focus from retrospective correction towards proactive prevention. For CFOs, that means paying closer attention to data quality, process integrity, ERP governance, transaction accuracy and control effectiveness. Organisations that wait for mandatory implementation may find themselves responding under pressure, while those that start preparing now can use the transition as an opportunity to strengthen VAT governance and embed it more effectively into their broader control environment.

The enduring lesson for CFOs

The fundamentals of good VAT governance do not depend on a particular legislative change, economic cycle or technology programme. The core question remains whether the organisation understands where its VAT risks arise, who owns those risks and whether effective controls are in place to manage them. The strongest organisations are therefore not simply those that submit VAT returns on time; they are those that have built an operating environment in which VAT risk is understood, owned, monitored and continuously managed. Good VAT governance is not an annual project. It is an ongoing business discipline.

Moving from compliance to governance

For CFOs, the objective should be to move VAT from a reactive compliance exercise towards a structured governance framework, whether through VAT risk assessments, VAT governance framework design, tax control framework implementation, SARS audit readiness, VAT health checks, modernisation readiness assessments or e-invoicing and digital VAT strategy. The objective is straightforward: to give CFOs confidence that VAT risks are identified early, managed effectively and governed appropriately, before they become financial, operational or reputational problems.

The question every CFO should be asking is not simply "Have we submitted our VAT return?" The more important question is "Do we have visibility over our VAT risk profile across the business, and can we demonstrate effective control over it?" That is ultimately what good VAT governance achieves: it puts VAT where it belongs, not at the end of the compliance process but within the organisation's broader risk and governance framework.

Founded in 1868, Webber Wentzel is a leading full-service law firm providing clients with innovative solutions to their most complex legal and tax issues across Sub-Saharan Africa. With over 450 lawyers, their multi-disciplinary expertise is consistently ranked top tier in leading directories and awards, both in South Africa and on the African continent. Their collaborative alliance with Linklaters and their deep relationships with outstanding law firms across Africa provide clients with market-leading support wherever they do business.