The Illomata International Journal of Management Ilomata International Journal of Tax & Accounting P-ISSN: 2714-9838; E-ISSN: 2714-9846 Volume 4, Issue 3 July 2023 Page No. 584-598 584 | Ilomata International Journal of Tax & Accounting https://www.ilomata.org/index.php/ijtc Maturity Level of Fraud Risk Management in Tax Institutions in Indonesia Ariyadi Teguh Wibawa1, Agustinus Nicholas L. Tobing2 12University of Indonesia, Indonesia Corresspondent : aryd.tw@gmail.com1 Received : May 13, 2023 Accepted : July 23, 2023 Published : July 31, 2023 Citation: Wibawa, A., & Tobing, A. (2023). Maturity Level of Fraud Risk Management in Tax Institutions in Indonesia. Ilomata International Journal of Tax and Accounting, 4(3), 584-598. https://doi.org/10.52728/ijtc.v4i3.765 ABSTRACT: This study aims to determine the maturity level of fraud risk management in the tax payer compliance supervision function at the head office level run by VW and the XYZ units. The Enterprise Anti-Fraud Maturity Assessment Model was implemented to provide a clear picture of conditions and effectiveness, as well as the existing gaps between the implementation and ideal conditions based on the principles of COSO Fraud Risk Management. The descriptive qualitative research uses a case study approach by collecting data from semi-structured interviews with 12 informants involved in risk management and fraud risks handling, then all documents are analyzed. As for the data analysis technique, content analysis is selected. The purpose of this study is to provide a tool for DGT (The Directorate General of Taxes) to determine the role and level of fraud risk management in the taxpayer compliance supervision function. The results which are at level 2 (initial) indicate that there is still a lot of room for improvement in order to achieve the desired maturity level target. DGT, especially the VW unit and XYZ unit, are suggested to immediately integrate fraud risk management with the existing anti-fraud programs and strengthen the role of the units involved in accordance with the COSO (Committee of Sponsoring Organizations) Fraud Risk Management principles. Keywords: Fraud Risk Management, Fraud Risk, Tax Compliance, Maturity Level This is an open access article under the CC-BY 4.0 license. INTRODUCTION The success of the Directorate General of Taxes (DGT) in supporting more than 82% of state revenue (Ministry of Finance, 2022) gives an impact on the smooth and efficient operations of the state functions. (Neog & Gaur, 2020), stated that one of the indicators of success is the achievement of the Sustainable Development Goals (SDGs) target of a 15% tax ratio(OECD, 2018). Regardless of the average tax ratio that has never reached 11% (Dihni, 2022), a problem faced by every country in increasing tax revenue is related to taxpayer compliance (Al-Karablieh et al., 2021; Vincent, 2023). Therefore, one of the important functions performed by the DGT is to supervise taxpayer compliance. On the other hand, there is another factor causing a decrease https://www.ilomata.org/index.php/ijtc mailto:aryd.tw@gmail.com1 https://doi.org/10.52728/ijtc.v4i3.765 Maturity Level of Fraud Risk Management in Tax Institutions in Indonesia Wibawa and Tobing 585 | Ilomata International Journal of Tax & Accounting https://www.ilomata.org/index.php/ijtc is the decline in taxpayer confidence (González Canché, 2022; Litina & Palivos, 2016; Rahmi et al., 2022) which is triggered by corruption cases (Aktaş Güzel et al., 2019), is part of occupational fraud (Wells, 2018). The tax administration sector is highly vulnerable to the risk, from policy making, human resources organization, service delivery, to procurement of goods and services (Jenkins, 2018). Fraud risk is a variety of potential fraud possibilities that may occur and which can and must be managed (Ait Novatiani et al., 2022; Power, 2013). Fraud is mostly intensified by pressure, opportunity, and rationalization (Cressey, 1953). The risk of fraud in DGT is still high, as seen from the number of mass media coverage of corruption cases. Employees involved in fraud range from staff such as objection reviewers to Echelon III (Aji & Febriyan, 2023; Amali, 2021), and Echelon II (Riana, 2021). Internally, an average of 100 employees were sentenced to severe disciplinary punishment from 2017 to 2021 (Directorate General of Taxes, 2022). One of the reasons why employees are sentenced to severe punishment is because they commit fraud such as receiving gratuities and abuse of authority as stipulated in the Government Regulation Number 94 of 2021 concerning Discipline of Civil Servants. Controlling the risk of fraud such as corruption is a crucial matter DGT should focus on, to implement its vision of organizing an efficient, effective, integrated, and fair tax administration. Fraud risk management (FRM) is one of the control efforts recommended to be carried out by an organization (Power, 2013). FRM can effectively control fraud and reduce the likelihood of fraud from occurring (Paulinus & Jones, 2017), prevent financial loss, and avoid the risk of damaged reputation of the organization (Power, 2013). A widely used FRM guide is the Fraud Risk Management Guide published in 2016 by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) together with the Association of Certified Fraud Examiners (ACFE), hereinafter referred to as COSO FRM. The COSO FRM complements other COSO frameworks (Internal Control-Integrated Framework and Enterprise Risk Management-Integrated Framework) and aims to serve as a framework for management in designing, implementing, running internal controls, and assessing the effectiveness of existing internal controls related to fraud risk (Cotton et al., 2016). There are 5 principles in COSO FRM, the first is fraud risk governance where COSO FRM recommends the division of roles and responsibilities in risk management, based on a three lines of defense approach in conducting risk management (Cotton et al., 2016). The Institute of Internal Auditors (IIA) has published the Three Lines Model in 2020 which is an update of the Three Lines of Defense (The Institute of Internal Auditors, 2020. The second is a comprehensive fraud risk assessment. The third is an implementation of preventive and detective activities in fraud control (fraud control activities). The fourth is the establishment of fraud investigation and corrective actions. Finally, the organization monitors the process (fraud monitoring activities) including reporting the results, and improving the fraud risk management. DGT has implemented risk management since 2008 (Directorate General of Taxes, 2022). However, the obligation to identify fraud risk is only emphasized in the Decree of the Minister of Finance Number 105/KMK.01/2022 and the Decree of the Director General of Taxes Number KEP-621/PJ/2022. In these regulations, each risk-owning unit is required to identify fraud risk https://www.ilomata.org/index.php/ijtc Maturity Level of Fraud Risk Management in Tax Institutions in Indonesia Wibawa and Tobing 586 | Ilomata International Journal of Tax & Accounting https://www.ilomata.org/index.php/ijtc categories. DGT has also implemented various anti-fraud programs such as the establishment of a gratification control unit, integrity pact, mandatory wealth reporting, whistle blowing system, knowing your employee (KYE), employee profiling, handling and investigating fraud cases, and so forth. Despite several regulations and programs made to prevent corruption or fraud, fraud will still exist (Biduri et al., 2022; Cui, 2015; Kasim et al., 2016). Based on the previous explanation, it is important for DGT to obtain a clear picture of fraud risk management carried out in its units, especially the one related to the taxpayer compliance supervision function. Former studies related to the measurement of the maturity level of risk management have been carried out by Praditya (2021) and Simanungkalit and Tobing (2022). Praditya (2021) conducted a research on medium and large companies in Indonesia based on ISO 31000: 2018, whereas Simanungkalit and Tobing (2022) investigated XYZ agency, a public sector, using the RIMS Risk Maturity Model. Nevertheless, none of the two studies focused on the maturity level of fraud risk management. Research that is specifically related to fraud risk management has been conducted by Chairunnisa and Ibrahim (2019). Both researchers used the 5 COSO FRM principles to evaluate the implementation of risk management at PT X, but the maturity level of fraud risk management based on these principles is not measured. Based on the background and previous discussion above, this research will examine the maturity level of fraud risk management conducted by the DGT unit in the function of supervising taxpayer compliance at the Head Office of the Directorate General of Taxes. The units at the Head Office of the Directorate General of Taxes that perform this function are in VW and XYZ units. The difference between this and previous studies is that the research focuses on evaluating fraud risk management based on the COSO FRM with a maturity level model based on the Enterprise Anti- Fraud Maturity Assessment Model©. ACFE recommends this model in the Anti-Fraud Playbook: The Best Defense Is A Good Offense, since it is specifically based on the five principles of COSO FRM (ACFE & Grant Thornton LLP, 2020). The relationship between the COSO FRM principles and the maturity level in the model can be seen in Figure 1. In addition, based on Yeni et al (2020) studies related to fraud with the object of research in the public sector such as government and DGT are rarely found. The evaluation to measure the maturity level of the fraud risk management program in the DGT unit will provide a clear picture of the condition and the effectiveness of fraud risk management being carried out and will identify areas that need improvement to achieve the desired level. https://www.ilomata.org/index.php/ijtc Maturity Level of Fraud Risk Management in Tax Institutions in Indonesia Wibawa and Tobing 587 | Ilomata International Journal of Tax & Accounting https://www.ilomata.org/index.php/ijtc Figure 1. Relationship between 5 COSO FRM Principles and Maturity Levels Source: ACFE & Grant Thornton LLP (2020) METHOD This is a qualitative descriptive approach study designed to understand a phenomenon from the perspective of participants, thus the results are descriptive. (Merriam & Grenier, 2019). The object of this research is the Directorate General of Taxes (DGT). The case study is conducted on the taxpayer compliance supervision function at the head office level carried out by 2 echelon II units in the DGT, namely the VW and the XYZ units. For the data collection, semi-structured interviews and document analysis were implemented. Interviews were conducted with 12 informants involved in the risk management process in both units, the risk management in DGT, the investigation unit, as well as the implementation of anti- fraud programs in DGT. The informant profile details for VW unit are 2 echelon IV level officials as business process owners and 1 echelon IV level official who handles risk management and Risk Management Compliance Unit (UKMR). Meanwhile in the XYZ unit, there are 1 echelon IV level official and 1 staff member as the owner of the business process, 1 staff member who handles risk management and 1 staff member who serves as UKMR. In addition, interviews were also conducted with the Directorate of Internal Compliance and Apparatus Resource Transformation (KITSDA) which is a unit that handles risk management, internal compliance and investigation units at the DGT level. Moreover, interviews at the Directorate of KITSDA were conducted with 1 echelon IV-level official related to risk management, 1 echelon IV-level official of internal compliance testing, 1 echelon IV-level official related to the internalization of anti-fraud programs in DGT, and 2 echelon IV-level officials in the internal investigation function in DGT. The interview results serve as the primary data in this study, whereas the secondary data is obtained https://www.ilomata.org/index.php/ijtc Maturity Level of Fraud Risk Management in Tax Institutions in Indonesia Wibawa and Tobing 588 | Ilomata International Journal of Tax & Accounting https://www.ilomata.org/index.php/ijtc from internal documents such as documents related to risk management structure, regulations related to risk management, socialization materials of anti-fraud programs and leadership commitment. The documents related to risk management are confidential and cannot be disclosed to public. Additionally, documents obtained externally include journals, publications, frameworks/theories, internet pages, and other supporting documents. Furthermore, content analysis is selected as the data analysis techniques. The analysis aims to draw conclusions from documents (transcripts of interview results, and documents) by conducting in- depth discussions (Maulid, 2021). In this study, the results of interviews with informants ware content analyses, with quotes and words used to answer the research questions and the interpretation of the selection of fraud risk management maturity levels. The results of the interview as evidence are then interpreted and conclusions are made by the author through an assessment based on the value score in accordance with the five principles of COSO Fraud Risk Management (FRM) and the level of maturity based on the level of maturity Enterprise Anti-Fraud Maturity Assessment Model©. The results will produce a maturity level for each COSO FRM principle and an overall level of fraud risk management. Furthermore, the value and maturity level of each principle are compared with the desired target. The author refers to the publication of the Internal Audit Service of UN Women which sets the condition of their anti-fraud program should be Level 4 (Managed) (UN Women, 2021). The conclusions drawn must also be validly replicable (Kurniasih & Tobing, 2022). The process of drawing conclusions related to measuring the maturity level of fraud risk management in this study can be traced and replicated validly. Table 1. Maturity Level Score Range Maturity Level Score Range Level One-Ad Hoc 1,0 ≤ Nilai > 2,0 Level Two-Initial 2,0 ≤ Nilai > 3,0 Level Three-Repeatable 3,0 ≤ Nilai > 4,0 Level Four-Managed 4,0 ≤ Nilai > 5,0 Level Five-Leadership Nilai ≥ 5,0 Source: Author's Processed Result (2023) RESULTS AND DISCUSSIONS In order to achieve its objectives, DGT conducts risk mitigation that has been carried out since 2008 (Directorate General of Taxes, 2022). Currently, the implementation of risk management is based on Minister of Finance Regulation Number 222/PMK.01/2021, the Minister of Finance Decree Number 105/KMK.01/2022, and the Director General of Taxes Decree Number KEP- 621/PJ/2022. In the last regulation, all Risk Owner Units are required to identify risks with fraud categories. The risk management structure at the Ministry of Finance consists of: Risk Management Committee, Risk Owner Unit (UPR), Risk Management Compliance Unit (UKMR), and Inspectorate General. The Risk Management Committee serves as the party that determines the policy, profile and mitigation, and effectiveness of risk management at the Ministry of Finance https://www.ilomata.org/index.php/ijtc Maturity Level of Fraud Risk Management in Tax Institutions in Indonesia Wibawa and Tobing 589 | Ilomata International Journal of Tax & Accounting https://www.ilomata.org/index.php/ijtc level. UPR is the unit that owns the strategy map and is responsible for implementing the Risk Management process for organizational goals according to the unit's duties and functions. UKMR is the Internal Compliance Unit (UKI) in charge of monitoring the implementation of risk management and following up on the results of risk management reviews and/or audits. The Inspectorate General serves to provide assurance and consultation on the implementation of risk management. The UPR structure is tiered based on the level of the organization. UPR-Wide is the risk owner unit at the Ministry of Finance level, UPR-One is the risk owner unit at Echelon I level, UPR-Two is the risk owner unit at Echelon II level, and UPR-Three is the risk owner unit at Echelon III level. The UPR structure for VW and XYZ units is a UPR-Two structure consisting of a Risk Manager, Risk Coordinator, and Risk Administrator as well as a PIC and Application Operator. The UPR structure has the responsibility to carry out risk management including the process of context formulation, risk identification, risk analysis, risk evaluation, risk mitigation, monitoring and review, as well as communication and consultation. Each UPR reports its activities to the higher UPR. The Results of Document Analysis Based on document analysis of the Decree of the Minister of Finance Number 105/KMK.01/2022, and internal documents of the VW unit and XYZ unit, there is a UPR structure determined by the head of the unit, the structure is as follows: Table 2. UPR structure in VW Unit and XYZ Unit Role Description Position Risk Manager UPR-Two Leader Echelon II Risk Coordinator Risk Administrator's superior officer Echelon III Risk Administrator Officials with Duties and Functions in Risk Management Echelon IV PIC and Operator Aplication Staff of the Risk Administrator Staff Source: Internal documents of VW Unit and XYZ Unit have been reprocessed UKMR at the UPR-Two level is played by a section, and led by an echelon IV official who acts as a Risk Administrator at the UPR. This UKMR task will be carried out by different staff who act as PIC and Application Operator. All Echelon III under the leadership of the UPR is the owner of the business process. The risk management structure for the VW and XYZ units has the same structure and there is a clear identification of the roles and responsibilities of each line function. Based on the Three Line Model approach (The Institute of Internal Auditors, 2020) the relationship between these lines is shown in the following figure: https://www.ilomata.org/index.php/ijtc Maturity Level of Fraud Risk Management in Tax Institutions in Indonesia Wibawa and Tobing 590 | Ilomata International Journal of Tax & Accounting https://www.ilomata.org/index.php/ijtc Figure 2. Risk Management Structure of VW Unit and XYZ Unit Source: Author's Processed Result (2023) The governing body in charge of providing oversight in the risk management process is the Risk Management Committee at the Ministry of Finance level. The business process owner is echelon III at VW unit and XYZ unit which is the first line. The structure at UPR-Two, namely the Risk Manager, Risk Coordinator, Risk Administrator and PIC and Application Operator, is included in the first line and can also be the second line, since it conducts the on-going monitoring in the risk management process. In addition, UKMR is in the second line. This is because for the UPR-Two level, the Subdivision of Administration performs 2 roles, being included in the UPR structure and acting as UKMR in connection with its function as an Internal Compliance Unit. The Inspectorate General acts as an internal audit. External Auditors for the government are the Supreme Audit Agency and the Financial and Development Supervisory Agency. DGT has standardized the implementation of risk management. Fraud risk is part of the risks that must be identified and managed in risk management. There is no specific risk management process related to fraud risk. The risk management process begins with the context formulation stage to determine the scope and period of Risk Management implementation, set organizational goals, identify stakeholders, and establish the UPR structure. Further on, they proceed with the identification of risks related to events, causes, and impacts on the achievement of predetermined goals. There are 2 risk classifications, namely organizational risk and State Budget (APBN), Contingency, and Balance Sheet (AKN) risk. Not all UPRs have IMR risk but definitely have organizational risk. Fraud risk is part of the organizational risk that must be identified. The next stage is to conduct a risk analysis with the aim of determining the amount of risk and risk level based on risk criteria by considering the reliability of internal control. Risk criteria include likelihood criteria and impact criteria. The determination of criteria, including those related to fraud risk, already has a choice of methods and standards. The result of this process is a 5x5 Risk Analysis Matrix that has described the risk level, which is then proceed to the risk evaluation stage to determine risk priorities, expected residual risk magnitude/level, determination of risk appetite, risk mitigation decisions, Key Risk Indicators (IRU) and risk maps creation. The risks in low and very low levels are the categories that enter the acceptance area, while for medium, high and very https://www.ilomata.org/index.php/ijtc Maturity Level of Fraud Risk Management in Tax Institutions in Indonesia Wibawa and Tobing 591 | Ilomata International Journal of Tax & Accounting https://www.ilomata.org/index.php/ijtc high levels are the main risks that must be mitigated and have IRU. This stage of identification to risk evaluation is submitted by the business process owner to the UPR structure. Figure 3. Risk Map and Risk Level Source: Decree of the Minister of Finance Number 105/KMK.01/2022 has been reprocessed (2023) The UPR structure together with the business process owner then discusses what risk mitigation should be done. The mitigation stages are carried out in the hope of reducing the likelihood of the risk occurring and/or reducing the occurring impact. UPR should develop a mitigation plan and document it. Furthermore, the monitoring and the review of risk management are carried out. The monitoring is carried out by the UPR structure through quarterly meetings of the Organizational Performance Dialogue (DKO) or other forums conducted by UPR itself. Moreover, the review of risk management implementation is carried out by UKMR and Inspectorate General. The last stage is communication and consultation which includes reporting on the risk management process, efforts to obtain risk awareness and feedback for the improvement of risk management carried out. The risk management process in DGT, compared to the risk assessment process and in accordance with the principles of Fraud Risk Assessment (FRA) in COSO FRM can be briefly described as follows: Table 3. Comparison of the FRA-COSO FRM with the DGT Risk Management Process FRA-COSO FRM DGT's Risk Management Process Establish a Fraud Risk Assessment team Context Formulation Identify fraud schemes and risks Risk Identification Estimated occurrence and impact of each scheme and risk Risk Identification Determine the personnel and departments potentially involved by considering the fraud triangle. Identify the existing controls Risk Analysis Assess and respond to residual risks that need to be mitigated. Risk Evaluation Risk assessment documentation Administration and Reporting Reassess periodically, considering changes Monitoring and Review Source: Author's Processed Result (2023) https://www.ilomata.org/index.php/ijtc Maturity Level of Fraud Risk Management in Tax Institutions in Indonesia Wibawa and Tobing 592 | Ilomata International Journal of Tax & Accounting https://www.ilomata.org/index.php/ijtc From table 3 above, a step that should be done in the FRA but does not appear in the risk management process carried out by DGT, is one related to determining personnel and departments that are potentially involved by considering the fraud triangle. In the provisions of risk management in DGT, there are no specific steps related to this matter. This is because the reference basis for risk identification in the DGT risk management process is the achievement of organizational goals related to a particular risk owner unit. Therefore, the fraud risk that will be identified is fraud risk generally not as detailed as the identification result in FRA. FRA aims to find out all fraud schemes and risks that occur in an organization. Interview Results Interviews were conducted with 12 informants from internal DGT. The selection of informants is based on their duties and functions as the structure of UPR, UKMR, business process owners, risk management in DGT, compliance testing, implementation of anti-fraud programs, and investigations in DGT. The interviews were conducted face-to-face in the period of late February to early April 2023 with a duration of 30 to 90 minutes. The interview technique was semi- structured. Previously, a structure of questions was made with sources from the areas, and factors or considerations in the five principles of COSO Fraud Risk Management described in the fraud risk management Scorecard (ACFE, 2022). The answers given by the informants were recorded using a voice recorder, then transcribed and interpreted using the author's expertise when observing the interviewees and through the process of listening to the recording again. The results of these interviews when grouped according to the principles in the COSO FRM are as follows: 1. Fraud Risk Governance a. There is a commitment from leadership to fraud risk management, and employees have understood the commitment but fraud risk is not among the main risks considered. b. There is a clear division of functions in risk management for each level of the organization, where fraud risk is one of the risk categories that must be identified. c. The Internal Compliance Unit has a tough task, given its position as UKMR which also plays a role in the UPR structure that carries out risk management. d. Fraud risk management is not yet comprehensive, where the anti-fraud programs carried out have not been well coordinated with the risk management and have not been able to identify fraud risks appropriately. e. There is documentation of a fraud risk management program reviewed regularly. f. Communication of fraud risk awareness to all levels of the organization has been conducted and can be tracked. 2. Fraud Risk Assessment a. There is a team that conducts risk assessment on risks in general, not specifically related to fraud risk. b. The team that conducts risk assessments has not identified fraud risks appropriately. c. There is a methodology in risk assessment in general including fraud risk categories that refer to the Decree of the Minister of Finance Number 105/KMK.01/2022. d. There is documentation of the general risk assessment process. 3. Fraud Control Activities a. Formalized fraud risk control activities are in place, but have not fully considered the results of the fraud risk assessment. https://www.ilomata.org/index.php/ijtc Maturity Level of Fraud Risk Management in Tax Institutions in Indonesia Wibawa and Tobing 593 | Ilomata International Journal of Tax & Accounting https://www.ilomata.org/index.php/ijtc b. Fraud risk control activities at VW and XYZ units have begun to consider the use of data analytics. c. Organizational processes and antifraud controls are established, understood, and consistently executed, and reporting mechanisms and documentation are in place. 4. Fraud Investigation and Corrective Action a. An investigation unit has been established with clearly defined roles. b. There is a reporting channel related to fraud committed by DGT employees and there are procedures for handling it. c. Corrective actions resulting from investigations are submitted and monitored for implementation. d. There is no evaluation related to the investigation activities carried out. e. There is no tiered training standard for employees assigned to the investigation unit. 5. Fraud Monitoring Activities a. Monitoring procedures are in place for general risk management processes and anti-fraud programs. However, performance is not consistent. b. There is a mechanism for reporting and documenting the results of monitoring risk management and anti-fraud programs to employees, as well as to leaders and higher levels. c. There is no data analytic used in monitoring risk management or anti-fraud programs. From the results of the document analysis and the interviews with informants, the level of maturity of fraud risk management based on the principles of COSO Fraud Risk Management (FRM) and with a level of maturity based on the Enterprise Anti-Fraud Maturity Assessment Model© at unit XYZ and unit VW related to the supervisory function, a total score of 2.4. was obtained. Table 4. shows a recapitulation of the assessment results from the level of fraud risk management for the two units. Table 4. Results of Fraud Risk Management Maturity Level Assessment COSO FRM Principle Current Level Target Level Level Score Level Score Fraud Risk Governance level 2 (Initial) 2 level 4 (Managed) 4 Fraud Risk Assessment level 2 (Initial) 2 level 4 (Managed) 4 Fraud Control Activites level 3 (Repeatable) 3 level 4 (Managed) 4 Fraud Investigation and Corrective Action level 3 (Repeatable) 3 level 4 (Managed) 4 Fraud Monitoring Activities level 2 (Initial) 2 level 4 (Managed) 4 Average level 2 (Initial) 2,4 level 4 (Managed) 4 Source: Author's Processed Result (2023) The information in table 4 indicates that the fraud risk management in the supervisory function carried out in both units is still at level 2 (Initial). The fraud risk management is part of the risk https://www.ilomata.org/index.php/ijtc Maturity Level of Fraud Risk Management in Tax Institutions in Indonesia Wibawa and Tobing 594 | Ilomata International Journal of Tax & Accounting https://www.ilomata.org/index.php/ijtc management carried out by the units in DGT. In general, at this level, VW and XYZ Units have actually realized the need for a formal fraud risk management approach, a continuous (recurring) fraud risk management process in DGT but the parts of the organization define it differently. This research is in line with the results shown in Simanungkalit and Tobing's study (2022) and indicated that the risk management maturity level of public sector institutions is still below the ideal level. About 3 principles are still at level 2 (Initial), namely fraud risk governance, fraud risk assessment, and fraud monitoring activities. Based on the results of the interviews with informants, fraud risk management is still not a major consideration, and is managed reactively. The Risk Owner Unit at the VW unit and XYZ unit have been unable to define fraud risk appropriately. The monitoring of anti-fraud programs is still considered a formality and is limited to the completeness of documents and the continuity of their contents. The monitoring by UKMR has not touched on the material, due to a lack of understanding of fraud risk, resulted in miscategorization of fraud risk escape. The principles of fraud investigation and corrective actions and fraud control activities are already at level 3 (Repeatable). The analysis of the gap between the overall level of maturity of fraud risk management in both the VW and the XYZ unit are related to the supervisory function with the current condition of level 2 (Initial) bearing the intended target for level 4 (Managed) in accordance with the target set by the author who refers to the publication of the Internal Audit Service from UN Women (UN Women, 2021) as depicted on the following graph: Figure 4. Radar Gap Analysis Chart Source: Author's Processed Result (2023) CONCLUSIONS The results of the fraud risk management maturity level assessment for the taxpayer compliance supervision function at the VW unit and XYZ unit are at level 2 (Initial). At this level, both units have realized the need for a formal fraud risk management approach. The fraud risk management process is ongoing (recurring) but parts of the organization define it differently, considering it is still not a primary consideration, thus it is managed reactively. VW and XYZ units as well as DGT need to immediately integrate fraud risk management program with their anti-fraud programs. In 0 1 2 3 4 Fraud Risk Governance Fraud Risk Assessment Fraud Control Activites Fraud Investigation and Corrective Action Fraud Monitoring Activities Gap Analysis Current Score Target Score https://www.ilomata.org/index.php/ijtc Maturity Level of Fraud Risk Management in Tax Institutions in Indonesia Wibawa and Tobing 595 | Ilomata International Journal of Tax & Accounting https://www.ilomata.org/index.php/ijtc improving its maturity level, DGT needs to conduct training and increase the competence of the Risk Owner Unit regarding fraud risks that can occur in its unit. At the policy-making level, DGT needs to strengthen the position and competence of risk management structures such as UKMR to be more independent and to function effectively and efficiently. In addition, the strengthening of the investigation unit needs improvement so as to intensify control in terms of fraud detection. Similarly,the evaluation of the COSO FRM principles implementation should also be standardized and carried out periodically by utilizing data analytic. This research has several limitations that should be taken into consideration when other researches with similar themes are conducted. This study however, raises the maturity level of fraud risk management in the taxpayer compliance monitoring function carried out at Head Office of the Directorate General of Taxes run by 2 units, namely the VW and the XYZ units. Moreover, the source of informants is still limited to the internal DGT, not the Ministry of Finance level such as the Inspectorate General. Therefore, future research can develop it by adding focus group discussion or questionnaire methods to deepen the analysis. Lastly, the future research can also use other fraud risk management maturity level models in addition to the Enterprise Anti-Fraud Maturity Assessment Model© based on COSO FRM principles. REFERENCES ACFE, & Grant Thornton LLP. (2020). The Anti-Fraud Playbook: The Best Defense Is a Good Offense. Association of Certified Fraud Examiner Inc. Ait Novatiani, R., Afiah, N. N., & Sumantri, R. (2022). RISK MANAGEMENT AND OTHER FACTORS PREVENTING FRAUDULENT FINANCIAL REPORTING BY STATE- OWNED ENTERPRISES IN INDONESIA. Asian Economic and Financial Review, 12(8), 686–711. https://doi.org/10.55493/5002.v12i8.4587 Aji, M. R., & Febriyan. (2023, May 2). KPK Panggil 3 Saksi di Kasus Rafael Alun Trisambodo. Tempo.Co. https://nasional.tempo.co/read/1720960/kpk-panggil-3-saksi-di-kasus-rafael- alun-trisambodo Aktaş Güzel, S., Özer, G., & Özcan, M. (2019). The effect of the variables of tax justice perception and trust in government on tax compliance: The case of Turkey. Journal of Behavioral and Experimental Economics , 78. https://doi.org/10.1016/j.socec.2018.12.006 Al-Karablieh, Y., Koumanakos, E., & Stantcheva, S. (2021). Clearing the bar: Improving tax compliance for small firms through target setting. Journal of International Economics, 130, 103452. https://doi.org/https://doi.org/10.1016/j.jinteco.2021.103452 Amali, Z. (2021, March 4). Kans Gayus Jilid II & Deretan Korupsi Pajak 10 Tahun Ini versi KPK. Tirto.Id. https://tirto.id/kans-gayus-jilid-ii-deretan-korupsi-pajak-10-tahun-ini-versi-kpk- gaPh Biduri, S., Fitriyah, H., & Febriana, P. (2022). Pencegahan Fraud dalam pengelolaan alokasi dana desa. Owner, 6(4). https://doi.org/10.33395/owner.v6i4.1085 https://www.ilomata.org/index.php/ijtc Maturity Level of Fraud Risk Management in Tax Institutions in Indonesia Wibawa and Tobing 596 | Ilomata International Journal of Tax & Accounting https://www.ilomata.org/index.php/ijtc Chairunnisa, & Ibrahim, M. (2019). Evaluasi Penerapan Strategi Antifraud Dalam Mengelola Risiko Kecurangan Pada Pt X. Jurnal Riset Akuntansi Dan Keuangan, 7(3), 465–476. https://doi.org/10.17509/jrak.v7i3.17542 Cotton, D. L., Johnigan, S., & Givarz, L. (2016). Fraud Risk Management Guide. COSO. https://www.coso.org/Documents/COSO-Fraud-Risk-Management-Guide-Executive- Summary.pdf Cressey, D. R. (1953). Other people’s money; a study of the social psychology of embezzlement. In Other people’s money; a study of the social psychology of embezzlement. Free Press. Cui, W. (2015). Administrative decentralization and tax compliance: A transactional cost perspective. University of Toronto Law Journal, 65(3), 186–238. https://doi.org/10.3138/UTLJ.2605 Dihni, V. A. (2022, August 5). Ini Tren Tax Ratio Indonesia dalam 5 Tahun Terakhir. https://databoks.katadata.co.id/datapublish/2022/08/05/ini-tren-tax-ratio-indonesia- dalam-5-tahun- terakhir#:~:text=Menurut%20laporan%20Kementerian%20Keuangan%20(Kemenkeu,9%2 C89%25%20terhadap%20PDB. Directorate General of Taxes. (2022). Annual Report 2021. https://pajak.go.id/sites/default/files/2022- 11/Laporan%20Tahunan%20DJP%202021%20-%20Bahasa.pdf González Canché, M. S. (2022). Post-purchase Federal Financial Aid: How (in)Effective is the IRS’s Student Loan Interest Deduction (SLID) in Reaching Lower-Income Taxpayers and Students? Research in Higher Education, 63(6), 933–986. https://doi.org/10.1007/s11162-021- 09672-6 Jenkins, M. (2018). Corruption risks in tax administration, external audits and national statistics. In Transparency International Anti-Corruption Helpdesk. https://knowledgehub.transparency.org/assets/uploads/helpdesk/Corruption-risks-in-tax- administration-external-audits-and-national-statistics-2018.pdf Kasim, R., Umar, M. A., & Martin, D. (2016). A reformation model of compliance to improve the property tax revenue generation in Malaysian local governments. Social Sciences (Pakistan), 11(11), 2885–2896. https://www.scopus.com/inward/record.uri?eid=2-s2.0- 84988316958&partnerID=40&md5=ec29a69a4e3775ed959f100a67e46b9a Kurniasih, F., & Tobing, A. N. L. (2022). Risk Analysis in The Business Process Management And Recording Electricity Costs (Case Study in an Oil and Gas Company in Indonesia). Budapest International Research and Critics Institute-Journal (BIRCI-Journal), 3, 21089–21104. https://doi.org/https://doi.org/10.33258/birci.v5i3.6128 Litina, A., & Palivos, T. (2016). Corruption, tax evasion and social values. Journal of Economic Behavior & Organization, 124, 164–177. https://doi.org/https://doi.org/10.1016/j.jebo.2015.09.017 Maulid, R. (2021, May 25). Mengenal Analisis Konten dalam Analisis Data Kualitatif. Dqlab.Id. https://dqlab.id/mengenal-analisis-konten-dalam-analisis-data-kualitatif https://www.ilomata.org/index.php/ijtc Maturity Level of Fraud Risk Management in Tax Institutions in Indonesia Wibawa and Tobing 597 | Ilomata International Journal of Tax & Accounting https://www.ilomata.org/index.php/ijtc Merriam, S. B., & Grenier, R. S. (2019). Qualitative Research in Practice : Examples for Discussion and Analysis. John Wiley & Sons, Incorporated. http://ebookcentral.proquest.com/lib/indonesiau-ebooks/detail.action?docID=5630257 Ministry of Finance. (2022, September 2). Pemerintah Rancang APBN 2023 Dengan Semangat Optimisme Namun Tetap Waspada. Kemenkeu.Go.Id. https://www.kemenkeu.go.id/informasi-publik/publikasi/berita-utama/Pemerintah- Rancang-APBN-2023-Dengan-Optimisme Neog, Y., & Gaur, A. K. (2020). Tax structure and economic growth: a study of selected Indian states. Journal of Economic Structures, 9(1). https://doi.org/10.1186/s40008-020-00215-3 OECD. (2018, February 14). Countries must strengthen tax systems to meet Sustainable Development Goals. OECD. https://www.oecd.org/ctp/countries-must-strengthen-tax-systems-to-meet- sustainable-development-goals.htm Paulinus, E. C., & Jones, A. S. (2017). Financial Risk Management And Corporate Performance Of Deposit Money Banks In Nigeria. Archives of Business Research, 5(12). Power, M. (2013). The apparatus of fraud risk. Accounting, Organizations and Society, 38(6–7). https://doi.org/10.1016/j.aos.2012.07.004 Praditya, T. A. (2021). Perancangan Risk Maturity Model Berdasarkan ISO 31000:2018 Pada Perusahaan di Indonesia [Universitas Islam Indonesia]. https://dspace.uii.ac.id/handle/123456789/34699 Rahmi, N., Selvi, S., & Purwaningtyas, A. S. (2022). Pentahelix Collaboration in Improving Taxpayer Compliance. Ilomata International Journal of Tax and Accounting, 3(4), 351–358. https://doi.org/10.52728/ijtc.v3i4.562 Riana, F. (2021, September 22). Angin Prayitno Aji Jalani Sidang Perdana, Berikut Fakta-fakta Kasus Suap Pajak. Tempo.Co. https://nasional.tempo.co/read/1508871/angin-prayitno-aji-jalani- sidang-perdana-berikut-fakta-fakta-kasus-suap-pajak Simanungkalit, D., & Tobing, A. N. L. (2022). A Study on the Maturity of Risk Management using the RIMS Risk Maturity Model ® Approach in Investigating Activities at Law Enforcement Agencies for Corruption. Budapest International Research and Critics Institute (BIRCI-Journal) Humanities and Social Sciences, 5, 9–23. https://doi.org/10.33258/birci.v5i2.5377 The Institute of Internal Auditors. (2020). The IIA’s Three Lines Model. The Institute of Internal Auditors. UN Women. (2021). THEMATIC AUDIT REVIEW OF ANTI‐FRAUD PROGRAMME AT UN WOMEN. https://www.unwomen.org/sites/default/files/2021-12/UN-Women- audit-report-2021-006-Review-of-anti-fraud-programme-at-UN-Women-en.pdf Vincent, R. C. (2023). Vertical taxing rights and tax compliance norms. Journal of Economic Behavior & Organization, 205, 443–467. https://doi.org/https://doi.org/10.1016/j.jebo.2022.11.003 Wells, J. T. (2018). International Fraud Handbook: Prevention and Detection (ACFE Ser.). John Wiley & Sons, Incorporated. http://ebookcentral.proquest.com/lib/indonesiau- ebooks/detail.action?docID=5399249 https://www.ilomata.org/index.php/ijtc Maturity Level of Fraud Risk Management in Tax Institutions in Indonesia Wibawa and Tobing 598 | Ilomata International Journal of Tax & Accounting https://www.ilomata.org/index.php/ijtc Yeni Priatnasari, Widagdo, A. K., & Gantyowati, E. (2020). A Review on Fraud Research : A Study of Vote Count. Ilomata International Journal of Tax and Accounting, 1(2). https://doi.org/10.52728/ijtc.v1i2.59 https://www.ilomata.org/index.php/ijtc