Operating model & quality framework
AI at the edges. A deterministic core. People at the gates.
الذكاء الاصطناعي يقترح، والقواعد تحسب، والمختصون يقررون
Non-negotiable
Seven design principles
P1
AI proposes, rules compute, professionals conclude
A model never produces a tax figure. It proposes a category, extracts a field or drafts a sentence. Arithmetic runs in a deterministic engine over a versioned rulebook. A named person owns every conclusion.
In the sample: The classifier returns a proposal; the engine computes; the workpaper records the reviewer.
P2
Substance over form
The GL account and the invoice title are what the review is testing, so they cannot be the answer. Contract text outweighs the invoice, the invoice outweighs the PO, and the GL is a weak prior.
In the sample: A SaaS line booked to "consulting" is reclassified as a royalty.
P3
Three outcomes, never two
Every check is PASS, FAIL or INDETERMINATE. Missing evidence is never a FAIL, and it is never quietly a PASS either.
In the sample: One line awaits a reviewer decision: no WHT figure is computed for it, and none is guessed.
P4
Reproducible to the cent
The same data, rulebook version and as-of date give byte-identical output on any day, in any input order.
In the sample: The shuffle test; the as-of date is fixed at G0; workpaper tie-outs are 0.00.
P5
Every number is traceable
Source line → engine → workpaper → report, with a reference at each hop. A report figure that cannot be walked back to a source row is a defect.
In the sample: The report generator refuses to build if the findings do not add back to the lead schedule.
P6
Findings are priced and ranked
Each exception carries tax, fines accrued to the as-of date, a reason code, a risk rating and an owner. Over-withholding is reported separately and never netted against exposure.
In the sample: 1,501,895.84 of exposure and 104,068.99 of opportunity are reported as two separate figures.
P7
Completeness before accuracy
Test that the population is whole before testing whether it is right. A perfect review of an incomplete population is a false assurance.
In the sample: The TB tie-out finds 1.5M of management fee paid outside AP.
Engagement lifecycle
Eight gates. None is passed by the tool.
G0
Acceptance & scoping
Independence, engagement letter, DPA, as-of date
G1
Data received
Row counts and totals agreed
G2
Data fit for use
Population ties to the TB
G3
Rulebook & model approved
Rulebook signed; golden set at target
G4
Preparer complete
Tie-outs 0.00; every AI proposal dispositioned
G5
Manager review
100% of High re-performed; 10% sample of auto-accepts
G6
Partner / EQR
Conclusions signed; EQR where triggered
G7
Release & archive
Issued, locked, retained 10 years
| Gate | Name | Exit criteria (all required) | Owner | Blocks if |
|---|---|---|---|---|
| G0 | Acceptance & scoping | Client acceptance and conflict check cleared; independence confirmed; engagement letter and DPA signed; scope, entities, period, as-of date and materiality set; AI use disclosed to the client. | Partner | Any independence threat without a safeguard; no DPA |
| G1 | Data received | Every PBC item received or formally waived; row counts and control totals agreed with the client in writing; file hashes recorded. | Senior | Unexplained difference between the client's control total and the rows received |
| G2 | Data fit for use | Population ties to the TB, or every difference is logged as a finding; mandatory-field failures logged with their downstream effect; duplicates flagged. | Senior | A population difference with no explanation and no finding |
| G3 | Rulebook & model approved | Rulebook version approved by Tax Technical with citations; golden-set accuracy at or above target per category; auto-accept threshold set; regression suite green. | Tax Technical Director | Any category below target recall; an unapproved rulebook change |
| G4 | Preparer complete | Every AI proposal dispositioned; every INDETERMINATE line has an open PBC request or a reviewer note; tie-outs = 0.00; exception register complete with owners. | Senior (preparer) | A non-zero tie-out; a line UNRESOLVED without an action |
| G5 | Manager review | 100% of High exceptions re-performed; a 10% random sample of auto-accepted AI lines re-performed; review notes raised and cleared; findings drafted in 5C form. | Manager | Any open review note; a sample error rate above 2% (triggers a full re-review of that category) |
| G6 | Partner / EQR | Conclusions, ratings and report wording approved; contested positions shown with a range; engagement quality review completed where triggered. | Engagement Partner (+ EQR partner) | Partner not satisfied; EQR open |
| G7 | Release & archive | Report issued through the controlled channel; file locked; archived within 60 days; retention set to 10 years; lessons-learned note sent to the rulebook owner. | Manager | Unlocked file after 60 days |
Timing on a mid-size WHT Health Check (2,000 to 5,000 lines, 3 years): G0 to G1 in week 1, G2 in week 2, G4 in week 3, G5 to G6 in week 4, G7 on issue. The AI and the engine remove the re-keying and the arithmetic. They do not remove manager and partner review, and our pricing does not assume they do.
Who signs what
Four review levels, a RACI, and segregation of duties
LEVEL 1
Preparer self-review
Tie-outs = 0.00; no UNRESOLVED line without an action; every reason code has a condition.
LEVEL 2
Senior / reviewer
Every overridden AI proposal: is the rationale sufficient for a stranger?
LEVEL 3
Manager
100% of High items re-performed from source; a 10% random sample of auto-accepted lines; 5C wording.
LEVEL 4
Partner
Ratings, contested positions, the one-page summary, anything that goes to you in writing.
| Activity | Partner | Manager | Senior | Tax Tech | AI Eng | QRM | Client |
|---|---|---|---|---|---|---|---|
| G0 acceptance, EL, DPA | A | R | I | C | C | C | |
| PBC issue and chase (S1) | I | A | R | C | R | ||
| Completeness & DQ (S2) | I | A | R | C | C | ||
| Rulebook change | I | C | I | A/R | C | C | |
| Golden set & model validation (G3) | I | C | C | A | R | R | |
| AI proposal disposition (S4) | A | R | C | ||||
| Treaty / PE judgement (S5) | C | A | R | C | C | ||
| Recalc, timeliness, recon (S6-S8) | A | R | C | ||||
| Manager review (G5) | I | A/R | C | C | |||
| Partner review / EQR (G6) | A/R | R | I | C | C | ||
| Report issue (S10/G7) | A | R | C | I | |||
| Remediation tracking | I | A | R | C | R |
Engagement quality review triggers (any one is sufficient)
- Total exposure above 1,000,000, or more than 5% of annual tax paid
- Any permanent-establishment, residency or treaty-abuse finding
- A contested technical position relied on for a finding (e.g. SaaS as a royalty)
- The first engagement on which a new AI use case or model version is used
- Findings that may lead to voluntary disclosure or a ZATCA dispute
The WHT sample meets four of the five, so it goes to EQR.
Segregation of duties
The person who dispositions an AI proposal cannot be the only reviewer of that line at G5. The engineer who changes a prompt or model cannot approve its validation at G3. Review notes move from raised to responded to cleared, or escalated; an open note blocks the next gate, and notes are never deleted.
AI governance
Every AI component is risk-tiered before it is built.
T1
Transcribe
Converts pixels to text or fields; output is checked by arithmetic
Examples: Invoice OCR, TRC field extraction
Field-level confidence; cross-check against a second source or arithmetic; human review of low-confidence fields
T2
Propose
A judgement that feeds a number
Examples: WHT category, GL-to-zakat mapping, VAT recoverability
Golden set per category; auto-accept threshold; mandatory review on conflict or low confidence; 10% sample of auto-accepts; evidence quoting
T3
Draft
Text that may reach a client
Examples: Findings narrative, research memo, notice response
Grounded only in engagement workpapers or a curated corpus; every claim cited and verified mechanically; Partner sign-off; AI-use disclosure
T4
Act
Files, pays, emails or posts without a human
Examples: Filing Form Q, posting ERP journals
Prohibited. A person performs every external action.
When an AI proposal is accepted without a person
Only if all three hold:
- 1Confidence at or above the engagement threshold (0.85 in the sample)
- 2The proposal agrees with the GL mapping
- 3The category is not MIXED or UNCLASSIFIED
Everything else needs a named reviewer, a disposition (confirmed AI, overrode AI, or decided where the AI abstained) and a rationale a stranger could follow. In the sample: 30 lines auto-accepted, 6 decided by a reviewer, 1 awaiting a document.
Grounding and hallucination controls
- No arithmetic in the model, ever. It returns a category, not a rate or an amount.
- Quote, then verify: the model quotes the words it relied on, and the pipeline checks those strings exist in the source. An unmatched quote rejects the proposal.
- Closed category list: output is schema-constrained to the rulebook categories plus MIXED and UNCLASSIFIED.
- Refusals and truncations route to a person; an empty answer is never treated as "no category".
- Drafted text may only cite engagement workpapers or the curated corpus; a citation that cannot be resolved mechanically removes the sentence.
- Minimised input: only descriptions, GL, country and service location go to a model. No bank details, amounts or personal names. No training on client data.
| Metric | Target | Why |
|---|---|---|
| Recall per category on the golden set | ≥ 95% for categories at ≥ 15% rate; ≥ 90% others | A missed royalty is exposure. Recall matters more than precision. |
| Precision of auto-accepted proposals | ≥ 99% | Auto-accept is the only path with no human in it |
| Abstention on genuinely ambiguous cases | ≥ 80% | The model must know when it does not know |
| Evidence-quote fidelity | 100% found verbatim in the source | Mechanical hallucination check |
| Order / shuffle invariance | Identical output | Reproducible to the cent (P4) |
Change control in practice. Any change to the model, prompt, keyword list, threshold or rulebook is a release: it re-runs the golden set and the regression suite and produces a diff report. Building the sample, the keyword “commission” was matching “commissioning” and dragging engineering lines out of auto-accept. The regression run caught it, the fix was a word boundary, and the diff showed two lines moving back. That is the process working.
Rulebook governance
The rulebook is content, not code.
| Element | Standard |
|---|---|
| Every rule | An effective-from and effective-to date, a citation, and a named approver |
| Change process | Proposal → peer review by a second tax professional → regression suite → diff report → Tax Technical approval → release note → version bump |
| Horizon scanning | Monthly review of ZATCA publications, circulars, the DTA list and draft-law consultations. The 15 Sep 2023 amendment is the model case: an engine without effective dating gets 2023 wrong in both directions. |
| Illustrative content | Anything not verified against primary text is labelled ILLUSTRATIVE in the file and on the workpaper |
| Firm positions | Contested interpretations (for example software right-to-use as a royalty) are written down, approved, and quoted in reviewer rationales, so the same question gets the same answer across engagements |
| Standard | Rule |
|---|---|
| Index | Every file opens with an index, legend and engagement parameters (rulebook version, as-of date, classifier version) |
| Referencing | Every figure on a lead schedule is a formula into a supporting workpaper. Nothing is typed on the lead. |
| Re-performability | Arithmetic columns are live formulas so a reviewer can re-perform them |
| Tie-out | Workbook formula totals are compared to engine totals; both must be 0.00 before G4 |
| Client data untouched | The as-received extract is never edited; corrections happen downstream with a reason |
| Assembly & retention | Assembled and locked within 60 days of report issue; retained 10 years |
Findings standard
Every finding in 5C form, priced to the as-of date, never netted.
| Element | Content | Sample (finding F2) |
|---|---|---|
| Condition | What we found, in numbers, generated from the data | Machinery Supplier, ROYALTY payment 468,000.00. Applied 10.0% (46,800.00); expected 15.0% (70,200.00). Treaty: TRC expired. |
| Criteria | The rule, with its citation | Royalties 15%; China DTA 10% only with a TRC covering the payment date. |
| Cause | Why it happened: a process or control failure, not a person | Treaty code not linked to certificate expiry. |
| Effect | Tax + fines to the as-of date, and the lines affected | 23,400 tax + 3,510 fines = 26,910. |
| Recommendation | A fix for this instance and the control that prevents a recurrence | Obtain the 2025 TRC; introduce a TRC register with expiry alerts. |
Materiality set first
Clearly trivial is 1.00 per line (rounding). Every non-trivial variance is reportable. Materiality is set at G0, not after the results are in.
Never net
Over-withholding is reported apart from exposure. Netting would hide exposure behind a refund that may belong to the vendor.
Show the range
On contested positions we report the conservative view and quantify the alternative (67,500 for SaaS in the sample).
Standards alignment
Built on the standards your auditors, regulators and procurement teams already recognise.
ISQM 1 (IAASB)
Firm-level quality management
A risk-based quality system with objectives, risks, responses, monitoring and an annual evaluation that covers AI tools.
ISQM 2
Engagement quality review
Objective second-partner review on engagements that meet defined triggers (G6).
IESBA Code
Ethics, tax planning, NOCLAR
Independence, conflicts and a credible basis for tax positions; contested positions disclosed with a range.
ISA 230 / 500 / 530
Borrowed discipline (not an audit)
Documentation an experienced reviewer can follow; evidence hierarchy; defensible sampling.
IIA Global Internal Audit Standards
5C findings
Every finding states Criteria, Condition, Cause, Effect and Recommendation.
COSO Internal Control (2013)
Control design
Remediation expressed as a control: preventive or detective, owner, frequency.
ZATCA law, regulations & guidance
Substantive rules
An effective-dated, cited rulebook.
SOCPA / ZATCA tax-agent rules
Who may sign
Licensing and professional conduct for the signing professional at G0 and G6.
ISO/IEC 42001:2023
AI management system
AI policy, risk and impact assessment, lifecycle controls, supplier management for model providers.
NIST AI RMF 1.0 + GenAI Profile
AI risk vocabulary
Govern, Map, Measure, Manage; GenAI-specific risks such as confabulation and data leakage.
SDAIA AI Ethics Principles
KSA AI ethics
Fairness, privacy, reliability, transparency, accountability; an AI-use statement in every report.
PDPL
Personal data protection
Lawful basis, minimisation, processor agreements and cross-border transfer conditions.
NCA ECC-2:2024 / CCC
Cybersecurity
Baseline cybersecurity controls and cloud controls for KSA-hosted services.
ISO/IEC 27001:2022, SOC 2
Assurance for procurement
Information security management and service-organisation assurance on the platform roadmap.
Who signs at G6 depends on whether the engagement runs through a registered tax agent, a SOCPA-licensed practice, or a practice licensing FlowCount as its platform. The framework holds in all three cases.
Measured monthly
Quality KPIs, reviewed at the annual evaluation
| KPI | Target | Signal |
|---|---|---|
| Engagements passing every gate first time | ≥ 85% | Planning and PBC quality |
| Tie-out failures at G4 | 0 | Engine and workpaper integrity |
| G5 sample error rate on auto-accepted lines | ≤ 1% | AI quality in the field |
| Reviewer override rate per category | Stable ±50% month on month | Drift |
| Findings later reversed on client evidence | ≤ 5% | Over-calling |
| Findings later raised by ZATCA that we missed | 0 | The one that matters |
| Cycle time, G1 → G6 | ≤ 15 working days (WHT, mid-size) | Delivery efficiency |
Exposure identified per fee is tracked, never targeted, so nobody is rewarded for over-calling.
Definition of done
A module is not ready because it answers well in a demo.
| Part | What it fixes in writing |
|---|---|
| A. Business definition | Purpose and buyer; the process it replaces; trigger and frequency; success metric |
| B. Inputs | Required datasets and mandatory columns; optional documents; formats; data-quality checks |
| C. Deterministic rules | Calculations; thresholds and materiality; reconciliation keys; effective dates; exception taxonomy |
| D. AI tasks | Description classification; document extraction; explanation; reviewer-note drafting |
| E. Confidence & escalation | Confidence and materiality scores; auto-clear rules; human-review rules |
| F. Outputs | Structured exception table; working paper; dashboard and KPIs; narrative |
| G. Audit trail | Source evidence; rule version; prompt and model version; reviewer action and time stamp; override reason |
| H. Acceptance tests | Known-pass and known-fail cases; edge cases; reconciliation totals; a false-positive ceiling |
The design rule behind it: AI interprets descriptions and documents and explains exceptions. Arithmetic, reconciliations, thresholds, duplicate tests, tax rates and filing logic stay in deterministic rules wherever possible.
See the method on your own data.
A four-week VAT pilot runs the full gate model on one upload, with a partner signature on every conclusion.