For decades, Pakistan’s tax audits asked the wrong question. They asked who is in front of us, rather than who should be. Case selection ran on a mixture of parametric criteria, computerized balloting, tax collector discretion, and the path of least resistance — which often meant returning to the same taxpayers who were easiest to assess on paper and least likely to disappear. The result was a tax administration that audited a great deal and recovered comparatively little, while the structural nonfilers and high-risk sectors that drove the country’s tax gap remained largely undisturbed.
A Compliance Risk Management (CRM) system developed for the Federal Board of Revenue (FBR), with technical assistance from the U.K.-funded Revenue Mobilization, Investment and Trade (REMIT) program, is an attempt to change the question.1 The CRM system is built on the OECD’s 2004 CRM Framework — the same blueprint that underpins risk-based compliance work at HM Revenue & Customs, the Australian Taxation Office, and most modern revenue administrations.2 The CRM system for corporate taxpayers went live on January 1, 2025,3 and the noncorporate rollout followed on June 30, 2025. The system now covers all FBR taxpayers across both income tax and sales tax, segmenting them into high-, medium-, and low-risk categories. It will not, on its own, solve Pakistan’s revenue problem. But it is one of the few reforms in recent memory that targets the logic of enforcement rather than its volume — and that distinction matters more than the public conversation has so far recognized.
Why the OECD Framework, and Why Now
Pakistan’s tax-to-GDP ratio has hovered uncomfortably below regional peers for most of the last decade.4 Successive IMF programs5 have pressed for higher revenue mobilization, and successive governments have responded primarily through policy levers — new withholding lines, super taxes, ad hoc surcharges — rather than through administrative ones. The administrative story has been harder to tell because its failures are diffuse: a thin audit coverage rate, weak third-party data integration, a litigation backlog stretching back a decade or more, and an audit function whose case selection criteria were rarely defensible to the taxpayers it touched.
The OECD’s 2004 guidance note offers a different starting point. Rather than treating compliance as a binary — taxpayers either obey the law or they do not — it treats compliance as a behavioral problem distributed across a population, to be managed through a cyclical process: identify the risks, assess and prioritize them, analyze the compliance behavior driving each, choose the right treatment, implement, and evaluate.6 Crucially, audit is just one treatment in a much larger toolkit that also includes taxpayer education, simplification, service improvements, targeted communication, and cooperative compliance arrangements. The right treatment depends on the risk and the behavior driving it, not on departmental habit. Two decades in, that framework remains the international reference standard, cited by the IMF, the Asian Development Bank, and the OECD’s own annual tax administration series as the blueprint for modern compliance work.7
The FBR took the first institutional step toward adopting it in November 2022 by establishing a CRM directorate at headquarter level.8 That created an organizational home for the function. What it did not yet have was a working system — the data infrastructure, the risk-scoring models, the governance rules, and the workflow integration that would turn the directorate from a policy unit into an operational one. That is the gap REMIT9 was asked to close.
What REMIT Built, and How
REMIT’s contribution sat in four places, each mapped to a stage of the OECD process. We developed the risk-scoring engine that powers the identify and prioritize stages of the cycle, calibrated against the structure of Pakistani taxpayer data rather than imported wholesale from another jurisdiction. We piloted that engine on anonymized data before any live case selection took place, which allowed us to test indicator validity and false-positive rates without putting real taxpayers in front of an unproven system. We supported the FBR in designing and implementing the governance framework that determines who can override the system, how those overrides are recorded, and how the CRM wing maintains analytical control over a process that field formations will inevitably try to bend. We developed and delivered training to 723 tax officers in all field formations across the country — because a risk-scoring engine without a parallel investment in auditor capability produces a backlog of high-quality leads that no one knows how to close.
Two design choices are worth flagging because they will shape how the system performs over the next several years. The first is the balance between rules-based logic and more advanced analytics. Rules-based scoring is explainable and defensible at appellate tribunal, which matters enormously in Pakistan’s litigation-heavy enforcement environment. More sophisticated models can pick up patterns that rules miss, but they raise harder questions about transparency and challenge. We leaned deliberately toward explainability — the right call, in my view, for a tax administration still building taxpayer trust.
The second choice is governance — specifically, who is allowed to override the system’s recommendations, and under what circumstances. A risk-based audit pipeline only delivers its value if it is the binding input to case selection, not an advisory one. This is less of a technical question than an institutional one, and it is where reforms of this kind often falter.
Early Signals From the Field
The first corporate audit cycle under CRM flagged 950 high-risk cases with a projected revenue yield of PKR 34 billion (about $122 million). In the most recent Memorandum of Economic and Financial Policies agreed with the IMF, the FBR has projected PKR 92 billion in collections for fiscal 2027 from risk-based audits using the CRM system — a figure that now sits alongside projections of PKR 46 billion from digital invoicing and PKR 48 billion from production monitoring as one of the three administrative revenue pillars of the next fiscal year.10
Those numbers should be read with both interest and caution. A flagged case is not an audited case; an audited case is not a recovered case; and a recovered case, in Pakistan’s appellate environment, may take years to convert into actual revenue. The PKR 92 billion projection is achievable if the system is used as designed. It will not be achieved if CRM-selected cases are sidelined for easier wins.
Early field evidence supports both the promise and the caution. A post-training knowledge assessment administered to 161 officers across eight field formations returned a mean score of 69 percent, with roughly half scoring above 70 percent and one in five above 80 percent. Performance varied meaningfully by office type: Large tax offices clustered around 72 percent, while corporate and medium offices in Karachi averaged closer to 63 percent. The remaining trained officers did not sit a comparable assessment, which is itself a gap worth naming — the evaluation stage of the OECD cycle will need a more systematic investment in measuring not just revenue outturns, but auditor readiness across the full network. A separate user-experience survey at the Large Taxpayer Office Karachi — the highest-scoring formation on the knowledge assessment — found a roughly 50 percent reduction in case-selection time and a near doubling of monthly case volumes opened under CRM, but rated the engine’s accuracy at 51 percent and recorded usage frequency and overall satisfaction at 3 out of 5. Taken together, the two readings suggest that the binding constraint is shifting from understanding the system to confident operational use of the harder cases it surfaces — consistent with a reform in its first operational year, and exactly the gap that continued capability investment and ongoing model calibration are meant to close.
The frictions are also worth naming. Field formations have reportedly expressed reservations about CRM-selected cases. Some of that is the predictable resistance of an administration losing discretion. But some of it is substantive: The cases the system draws out are often harder to work, requiring analytical skills that auditors trained for which traditional desk audits do not always possess. The 723 officers we trained are a start; embedding CRM-style working across more than 11,000 Inland Revenue staff will be a multiyear effort.
The IMF’s most recent conditions — requiring the FBR to centralize audit case selection,11 adopt a standardized audit manual, publish an audit policy, and mandate follow-up of all high-risk cases identified through the risk management system — are designed precisely to close the gap between flagged and pursued. They are unusually well-targeted, and they reflect a maturing understanding within the IMF that the integrity of the process matters more, in this reform, than the headline revenue number attached to it.
What CRM Gets Right, and What It Can’t Fix Alone
The reform’s most important contribution is institutional rather than technical. By making case selection traceable, auditable, and defensible, the CRM system narrows the space for both informal capture and well-intentioned discretion. It also creates the architecture for the rest of the OECD cycle to operate — the analysis of compliance behavior, the selection of nonaudit treatments, the evaluation of what works. Pakistan is at the beginning of that journey, not the end. The current system does the identify and prioritize work well; the treat and evaluate stages will need their own investment over the years ahead.
What the CRM system cannot fix is the rest of the system around it. The litigation backlog will continue to swallow recoveries until judicial capacity is addressed. The FBR’s organizational structure — built around tax instruments12 rather than functions — limits how fully a risk-based approach can be implemented across the life cycle of a taxpayer. The deeper question of whether Pakistan’s compliance problem is primarily about enforcement or about the legitimacy of the fiscal contract sits well outside the scope of any audit reform. The CRM system is necessary; it is not sufficient.
Lessons for the Wider Tax Administration Community
Three observations from this work may be useful to readers working on similar reforms elsewhere.
First, structural benchmarks under IMF programs can lock in technical reforms that domestic political economy would otherwise stall — but benchmark design matters more than benchmark existence. The IMF’s recent shift toward process conditions13 (centralized selection, mandatory follow-up of high-risk cases, a published audit policy) protects the reform’s integrity better than pure revenue-outturn targets would.
Second, donor technical assistance works best when anchored to a domestic institutional home and to an internationally recognized framework. The sequencing here — the FBR’s CRM wing first, the OECD 2004 framework as the design reference, REMIT’s technical support layered on top — gave the reform a defensibility that ad hoc implementation rarely achieves.
Third, a risk-based system is only as useful as the data feeding it and the auditors acting on it. Investing in the algorithm without investing in third-party data integration and auditor capability produces a polished pipeline that no one can run. The 950 corporate cases are the easy part. The conclusion of the next 57,000 will test whether the reform has taken root.
The CRM system will not feature in many headlines. It does not announce itself the way a new tax slab or a high-profile recovery does. But it changes who gets audited and why — and for a tax administration that has spent decades managing perception rather than process, that is the more durable reform.