“IRD RISK REVIEW” VS IRD “REQUEST FOR MORE INFORMATION”

IRD risk review vs IRD request for more information: are they the same thing? Either way, it can be a scary thing. You might have read about audits and risk reviews here. So naturally, the next question is “what does the process look like?” It can start with a seemingly simple request for “more information.” If IRD are not happy, they might go to a Risk Review or even a full Audit. Sometimes they skip the request for more info and go straight to one of those instead, depending on how dodgy things look. But first:

30-second summary

• A request for more information is usually the first, lowest-key step — IRD wants documents or an explanation on something specific.
• If they’re not satisfied, it can escalate to a Risk Review, and beyond that, a full Audit.
• IRD doesn’t always follow this order — depending on how serious the concern looks, they can skip straight to a Risk Review or Audit.
• Whatever stage it’s at, the first move is the same: contact your accountant.
• The 10 steps below walk through how to handle the process properly, from reading the notice through to keeping good records afterwards.

Here is what a Risk Review letter looks like:

What to Do at Each Stage (10 Key Steps):

First, contact your accountant — at every stage, this is the single most important thing you can do. Beyond that, what matters changes depending on where you are in the process.

If you’ve received a request for more information:

1. Read exactly what’s being asked. IRD’s data-matching often flags a specific line item or discrepancy — respond to that specific question, rather than volunteering broader information you haven’t been asked for.
2. Check the response deadline immediately. IRD generally gives a set window to reply. If you can’t meet it, request an extension before the deadline passes, not after.
3. Loop in your tax agent before you respond, not after. If we’re your registered agent, we should generally be aware of any IRD correspondence regarding your return. Sometimes though, IRD might contact you directly and not copy us in.

If it escalates to a Risk Review:

4. Understand this is still a preliminary check, not a formal audit. IRD is asking, in effect, “does this look right?” It can close this check without escalating further if your records hold up.
5. Expect to provide documentation across multiple tax years, not just the one originally queried. Bank statements, financial statements, and lease or loan agreements are common requests.
6. Reconcile your filed returns against your actual records yourself, first. Catching your own discrepancy before IRD does puts you in a materially better position.
7. If you find a genuine error, consider a voluntary disclosure. Made proactively – before IRD identifies the issue themselves – can significantly reduce any penalty, in some cases by up to 100%.
8. Check whether you have audit insurance in place. If you do, this is exactly the point to make a claim, so your accounting and legal costs for responding aren’t an added cost on top of the stress. (Note though that if you make a voluntary disclosure, audit insurance will not cover you).

If it escalates to a full Audit:

9. Be aware IRD can expand the scope beyond the original tax year if the information you provide suggests a broader issue. A request confined to one year doesn’t guarantee the review stays confined to it.
10. If you disagree with the final outcome, you have formal rights under the disputes process.  This includes responding to a Notice of Proposed Adjustment(opens in new tab) before any assessment is finalised. Don’t let a deadline on this lapse without getting advice.

In summary

A request for more information, a Risk Review, and a full Audit sit on the same spectrum. Each one differs in how deep IRD is looking and how serious their concerns are. None of them mean you’ve done something wrong, but all of them deserve a careful, organised response rather than a panicked one. The single best thing you can do at any stage is loop in your accountant early, before you’ve replied to IRD yourself.

Further reading

• IRD: Audits and tax governance(opens in new tab) — IRD’s overview of how audits work.
• IRD: Audits (IR297 guide)(opens in new tab) — the official Inland Revenue audits guide, covering the risk review vs audit distinction directly.
• IRD: How the Commissioner-initiated disputes process works(opens in new tab) — relevant if you disagree with a final report or notice of proposed adjustment (see Step 8 above).
• IRD: Make a voluntary disclosure(opens in new tab) — relevant if addressing an issue proactively (see Step 7 above) turns into a formal disclosure.

Facing a risk review or audit?

If you’ve received a letter from IRD and aren’t sure what it means or how to respond, get in touch before you reply to them. Contact us and we’ll walk you through what’s being asked and how to handle it — and if you have audit insurance in place, we can help you make a claim too.