In the language of cooperative compliance, asking “what documentation is required” is only natural. But it is worth clarifying one point straight away: in a Tax Control Framework (TCF), documentation is not a downstream formality. It is what makes the system demonstrable—and therefore credible, maintainable, and, where required, certifiable.

This point is even more relevant today, because the cooperative compliance regime is set to apply to a broader group of taxpayers: the size threshold is set at €750 million from 2024, €500 million from 2026, and €100 million from 2028.

Scope: What TCF Documentation Must “Demonstrate”

In practical terms, TCF documentation must make it possible to reconstruct—without any logical gaps—three steps:

• where the tax risk arises (processes, transactions, events, accounting judgments);
• how it is managed (roles, key controls, escalation);
• with what evidence its effectiveness is demonstrated (operational records, testing, issue management).

If this chain is coherent, the TCF hols up. If it breaks, adding more documents rarely solves the problem: governance, controls, and evidence need to be realigned.

1. Tax Compliance Model (TCM): the System’s “Control Room”

The Tax Compliance Model (TCM) is the system document: it describes the architecture of the tax control environment, clarifying responsibilities, information flows, and how tax risk is managed. The guidelines on the TCM and certification were approved by a measure dated 10 January 2025 (with operational annexes). (Agenzia Entrate)

A robust TCM, from a professional standpoint, clearly sets out:

• governance (who decides, who oversees, who reports);
• governance (who decides, who oversees, who reports);
• integration with internal control and business functions (Tax–Finance & Accounting–Legal–Operations);
• maintenance (updates, versioning, and the management of organisational and regulatory changes).

2. Risk–Control Map: Where the TCF Becomes Operational

If the TCM is the control room, the Tax Risks and Controls Map is the operational tool: it links risks, controls, and the related evidence, using a structure standardised by the guidelines approved in 2025 (with the annexes also including a specific focus on how to complete the map for the industrial sector). (Agenzia Entrate)

The quality criterion is not the number of rows, but traceability:

• a risk linked to a specific process (not an abstract category);
• a key control (owner, frequency, and how it is performed);
• evidence that is identifiable and reproducible.

3. Evidence: The Difference Between “Design” and “Operating Effectiveness”

The most delicate—and often underestimated—area concerns evidence. The point is not only to show that a control “exists”, but that it has operated effectively over time.

Here, a distinction typical of control systems is useful:

• design: the control is appropriately designed in relation to the risk;
• operating effectiveness: the control has been performed correctly and consistently, and exceptions have been managed.

This is also the level that most directly supports a certification pathway. MEF Decree of 12 November 2024, No. 212 sets out the requirements, duties, and obligations of professionals authorised to certify the integrated tax risk control system. (Gazzetta Ufficiale)

4. Testing and Remediation: How to Keep the TCF “Alive”

A TCF is not a one-off project: it is a system that requires ongoing maintenance, reviews, and corrective actions. From a regulatory standpoint, strengthening the model also stems from the introduction of system certification (as part of the cooperative compliance framework) and its linkage to guidelines that can be updated over time.

In practice, this means having an orderly cycle in place:

• a testing plan (criteria, samples, frequencies);
• results and corrective actions (remediation with clear accountability and deadlines);
• reporting to senior management (alignment between stated governance and actual management).

2025 Focus: Tax Risks Arising from Accounting Standards

In 2025, the Revenue Agency added a very practical building block: with the measure of 7 August 2025 (Prot. 321934/2025), it approved specific instructions for mapping and managing tax risks arising from the accounting standards applied. (Agenzia Entrate)

For many companies, this translates into a structural strengthening of the Tax–Finance & Accounting interface, especially in areas involving greater accounting judgment and in non-recurring transactions.

In Summary

Talking about “required documentation” does not mean producing more paperwork. It means building a logical, verifiable chain: TCM → risk/control map → evidence → testing/remediation. This consistency is what makes the TCF a management tool (even before it is a “requirement”) and what prepares the company for more robust, preventive interactions. (Agenzia Entrate)

Daniele Di Teodoro
managing partner