By P Sesh Kumar
If the first part of Avlokan asks what the system measures, the second raises a harder question: who gets to examine what it does not? International taxation depends on confidentiality. APAs contain commercially sensitive arrangements, MAP negotiations involve protected government positions, and exchange-of-information agreements impose strict safeguards on foreign data. Yet confidentiality cannot become a blanket shield against accountability. The challenge is to create disciplined oversight that protects sensitive information while allowing Parliament and auditors to assess whether the system is timely, efficient, compliant and financially meaningful. The larger question is simple: what should be audited, and what must remain confidential?
WHAT THE CBDT ACTUALLY MONITORS, AND WHAT IT DOES NOT
It is worth being precise about the machinery that exists, because the deficiency is not one of design.
On paper the APA monitoring chain is complete. The agreement fixes critical assumptions. Rule 10-O obliges the taxpayer to file an Annual Compliance Report (ACR) in Form 3CEF in quadruplicate for each covered year, within thirty days of the return due date or ninety days of the agreement, whichever is later, to the Director General of Income-tax (International Taxation), who distributes copies to the competent authority, the jurisdictional Commissioner and the Transfer Pricing Officer (TPO). Rule 10P requires the TPO to conduct a compliance audit for each covered year, to submit findings within six months of receiving the ACR, and bars regular transfer pricing audit of the covered transactions unless the agreement is cancelled. Where non-compliance is found, the DGIT is to forward the matter to the CBDT for cancellation. Rule 10Q allows revision. The Income-tax Rules, 2026 renumber this apparatus but do not abolish it.
So the controls exist. What does not exist, on the evidence of the Division’s own report, is a management information system that aggregates them into a view of programme health. Nobody publishes–and one may reasonably doubt whether anybody computes–the proportion of due ACRs actually filed, the proportion of due compliance audits actually completed within the six-month limit, the number of agreements in which a critical assumption failed, the number revised, the number cancelled, or the number of covered years in which the compliance audit found a deviation. These are not taxpayer secrets. They are process statistics of the kind every regulator in the world publishes about itself.
As for give and take, there is no visible mechanism at all. No published negotiating framework, no ex post review of whether a concession made in a treaty protocol produced the reciprocal benefit for which it was traded, no post-implementation review of a revised DTAA against the revenue forecast that justified it, and no institutional memory function that tests today’s negotiating position against yesterday’s outcomes. The Division negotiates, signs, and moves to the next jurisdiction. Whether the Qatar protocol of February 2025 delivers what the brief promised will never be established, because no document exists whose function is to ask.
Also Read – Is India’s International Tax System Measuring Activity or Accountability?
THE OBJECTION, AT ITS STRONGEST
Now to the argument that will be made–courteously, and by serious people–the moment the Comptroller and Auditor General (CAG) proposes a thematic or performance audit of APAs, MAP and exchange of information.
It runs roughly as follows. Bilateral APAs and MAP resolutions are concluded under the Mutual Agreement Procedure (MAP) article of a treaty. They are, in form and substance, government-to-government understandings arrived at between designated competent authorities. The negotiating record contains the partner administration’s positions, reservations and internal reasoning, disclosed to India in confidence and often on the express footing that it goes no further. Information received under Article 26 or under the Multilateral Convention is subject to a treaty secrecy obligation that binds India as a matter of international law, and is separately protected in domestic law. India’s standing in the Global Forum rests on three successive Confidentiality and Data Safeguards assessments returning no issues identified, and on an AEOI confidentiality rating at the highest level. Widening access to a body outside the tax administration creates an incremental disclosure risk, and a single incident would be catastrophic–not merely embarrassing, but capable of causing partner administrations to slow or restrict the flow of information on which the entire offshore compliance programme depends. Beyond confidentiality there is a second-order concern: audit second-guessing of negotiated outcomes chills negotiation. If a competent authority officer knows that the margin she settles today may be criticised in a Parliament paper in three years, she will settle nothing, and the certainty programme that has taken fourteen years to build will die of caution.
This is not a frivolous argument. The last limb of it in particular deserves respect, because it is the reason mature systems separate compliance audit of process from second-guessing of judgement. But as a case for exclusion, it fails–and it fails on four independent grounds, any one of which would be sufficient.
WHY IT FAILS
First, the treaty itself contemplates the auditor. Article 26(2) of the OECD Model Tax Convention –and its counterpart in India’s treaty network–provides that information received shall be treated as secret in the same manner as information obtained under domestic law, and shall be disclosed only to persons or authorities, including courts and administrative bodies, concerned with the assessment or collection of, the enforcement or prosecution in respect of, the determination of appeals in relation to, the covered taxes, or the oversight of the above.17 That final clause is not decoration. It was inserted deliberately to accommodate bodies whose function is to supervise the tax administration, and a Supreme Audit Institution (SAI) auditing the receipts of the Union under a constitutional mandate is the paradigm case. Treaty confidentiality does not exclude the auditor; it enrols the auditor into the confidentiality regime. The obligation on the CAG is therefore to observe the secrecy standard, not to stay outside it.
Second, the profession’s own founding instrument settles it. Section 20 of the Lima Declaration, INTOSAI-P 1 –the Magna Carta of public audit, endorsed twice by the United Nations General Assembly–provides that Supreme Audit Institutions (SAI) shall be empowered to audit the collection of taxes as extensively as possible and, in doing so, to examine individual tax files; and that in auditing the application of tax laws they shall examine the system and efficiency of tax collection, the achievement of revenue targets, and where appropriate propose improvements to the legislature.18 Section 10 gives SAIs access to all records and documents relating to financial management. Section 19 addresses institutions established abroad, requiring due consideration of international-law constraints while insisting that where justified such limitations shall be overcome. The international profession considered the confidentiality of tax files half a century ago and decided the question against exclusion.
Third, Indian law already settles it, and Indian audit already does it. Section 16 of the Comptroller and Auditor General’s (Duties, Powers and Conditions of Service) Act, 1971 makes it the duty of the CAG to audit all receipts payable into the Consolidated Fund and to satisfy himself that the rules and procedures are designed to secure an effective check on the assessment, collection and proper allocation of revenue, and are being duly observed.19 The Regulations on Audit and Accounts confirm that receipt audit is comprehensive and encompasses financial, compliance and performance audit.20 Whatever else an APA is, it is a determination of the assessment of a receipt. And the practice is not hypothetical: Chapter V of CAG Report No. 3 of 2016 (Direct Taxes) is a transfer pricing chapter that examines individual Transfer Pricing Officer orders, names the errors, quantifies the short adjustment case by case, and records the Ministry’s acceptance and remedial action–all without identifying any assessee to the reader.21 The CAG has been auditing arm’s length price determinations on the same taxpayer files for a decade. To argue that the very same data becomes untouchable when the determination is reached by agreement rather than by order is to argue that the mode of decision, and not the sensitivity of the information, governs auditability. That proposition has no support in law and none in logic.
Fourth, the strongest form of the objection has already been tested and refuted in practice. The Sir Andrew Park exercise is the answer. The British Comptroller and Auditor General took five settlements at the outer edge of commercial and political sensitivity, obtained complete access, used an independent expert of unimpeachable standing to insulate the exercise from the charge of amateur second-guessing, reported publicly on the governance without disclosing the tax affairs, and produced the rarest of audit outcomes: a finding that the substantive judgements were sound and the process by which they were reached was not. It cost HMRC nothing in confidentiality and gained the settlements a legitimacy no departmental assertion could have produced. An audited APA programme is a more credible APA programme, in the eyes of a treaty partner as much as a taxpayer.
There remains a residual and legitimate carve-out, and it should be conceded openly rather than fought. Where a partner administration has supplied information or a negotiating position under an express confidentiality undertaking, the correct treatment is not to deny audit access but to apply the ordinary discipline that governs all sensitive audit material: access with a data-safeguards protocol, examination on the department’s premises where necessary, no extraction of partner-identifying negotiating detail into working papers, and reporting in aggregate. That is how defence and intelligence expenditure has been audited in this country for seventy-five years. Nobody has ever suggested that the secrecy of a weapons contract makes it unauditable. It makes it audited differently.
WHAT EXACTLY THE CAG SHOULD EXAMINE–AND WHAT IT MUST NOT TOUCH
An audit that is bounded in advance is an audit that gets done. What follows is a design in which every line of enquiry is answerable from departmental records, none requires the disclosure of a taxpayer’s identity in the published report, and none asks the auditor to substitute his judgement for the competent authority’s on the correct arm’s length price.
Let us begin with the system rather than the file. The first and most important finding available to audit is that the CBDT does not measure the outcomes of its own certainty programme. Audit does not need a single APA to establish that. It needs the management information architecture: what the APA Division and the DGIT (International Taxation) compute, what they report upward, what the CBDT reviews and at what periodicity, and whether any document in the chain states the revenue effect of the programme. An audit of the absence of a measurement system is a legitimate and, here, an overdue audit product.
Examine timeliness and inventory. Application-to-conclusion cycle time by type and by year; the pending inventory, its age profile, and its trend; applications withdrawn by taxpayers and the recorded reasons; applications rejected and on what grounds; the reconciliation between the more than two thousand applications filed and the 1,035 agreements concluded. Every figure is a count. None discloses anything about anybody.
Examine compliance-chain integrity, which is the single most productive vein available. Against the population of covered assessment years, how many Annual Compliance Reports (ACR) under Rule 10-O were due, how many were filed, and how many were filed late; how many Rule 10P compliance audits were due, how many were completed, and how many within the statutory six months; how many compliance audits recorded a deviation; how many agreements had a critical assumption fail; how many were revised under Rule 10Q; how many were cancelled under Rule 10R; and in how many cases the bar on regular transfer pricing audit of covered transactions operated in circumstances where the agreement should have been cancelled. If those numbers are good, the CBDT should want them published. If they are not, that is precisely the finding for which section 16 of CAG’s DPC Act exists.
Examine outcome differentials in the aggregate and anonymously. For a stratified sample of concluded APAs, compare the agreed margin or method against three benchmarks: the arm’s length price determined by the TPO for the same taxpayer in the immediately preceding open years; the applicable Safe Harbour margin for the same transaction category; and the distribution of comparables in the taxpayer’s own documentation. Report the distribution of the differentials by sector, not the individual cases. This tells Parliament whether APA outcomes systematically converge above, at, or below the department’s own contested position–which is the empirical content of the give-and-take question–without exposing one taxpayer.
Examine rollback consistency. Rollback converts an APA into a settlement of past years. Audit whether rollback was granted in accordance with the prescribed conditions, whether it was granted in cases where the same issue was under appeal or before the Dispute Resolution Panel, what demands were consequently deleted, and what the aggregate fiscal effect of rollback has been.
Examine reciprocity in MAP. Case outcomes classified as full elimination of double taxation, unilateral relief by India, unilateral relief by the partner, partial relief, withdrawal, and closure without agreement; the quantum of relief granted by India against relief obtained; the counterparty-wise distribution; and the ageing and disposal pattern. The OECD already requires jurisdictions to report on this framework; audit’s role is to verify that what India reports internationally is what its own records show, and to place the comparison before Parliament.
Examine the unexplained. The 241 cases that leave the MAP inventory between 2023 and 2024 are an audit query with a one-paragraph answer, and the department should be asked for it. So should the reconciliation between 219 and 220, and between 1,034 and 1,035.
Examine the exchange of information pipeline as a process. Outgoing requests made, incoming requests received, response times against the Global Forum’s ninety-day benchmark, and—critically–the conversion rate: of the information received, how much was used in an assessment, how much resulted in an addition, how much of that addition survived first appeal, and how much was recovered. This is the chain that the SAKSHAM NUDGE numbers gesture at and never complete.
Examine the enforcement tail. Black Money Act demands raised, deleted in appeal, stayed, written off and recovered, year by year and current to the audit date rather than to 2021; prosecutions launched, pending, convicted, acquitted and compounded. The one-in-eighty recovery ratio is either a collection failure, an assessment-quality failure, or a jurisdictional impossibility inherent to offshore demands against non-residents. Which of the three it is, is exactly the question audit exists to settle.
Examine the tax expenditure. Revenue foregone under Schedule V of the 2025 Act, formerly section 10(23FE), for each of the 41 notified sovereign wealth and pension funds in aggregate; the investment actually made against the exemption; and the additionality question. The Union Budget already publishes a statement of revenue foregone; the sovereign fund exemption belongs in it and audit should say so if it is not there.
Examine the Safe Harbour regime, whose uptake, revenue effect and interaction with the APA queue are entirely unmeasured, and the Income Tax Overseas Units, whose cost against output has never been placed before Parliament.
Now the boundaries, which matter as much as the scope. The published report must not name an assessee, and Indian receipt audit practice has honoured that convention for decades. It must not reproduce or paraphrase a treaty partner’s negotiating position, internal reasoning, or any material supplied under an express confidentiality undertaking; where such material must be examined to reach a conclusion, it should be examined on the department’s premises under an information-security protocol agreed with the Board and consistent with the Global Forum’s confidentiality and data safeguards standards, and the working paper should record the conclusion rather than the source text. It must not disclose information received under Article 26 or the Multilateral Convention to any person outside the audit chain, and the audit team should be brought formally within the CBDT’s confidentiality regime, with the same undertakings, clearances and system controls that apply to departmental officers. It must not opine on whether a particular arm’s length price was correct–that is a matter of expert judgement on which the auditor has no comparative advantage, and where the Park model applies: if a substantive judgement genuinely must be tested, engage an independent expert of standing to test it and report the expert’s conclusion, not the auditor’s.
The rule is simple. Audit the process, the compliance chain, the timeliness, the reconciliation, the aggregate distribution and the absence of measurement. Do not audit the negotiation. Everything in that first list is unobtainable to Parliament today, and nothing in it endangers a single treaty.
LESSONS
The first lesson is that a first annual report is a constitutional moment for an institution, and this one has been spent on introduction rather than on account. The Division has told the country who it is. It has not told the country what it achieved, and the frame it has chosen makes it harder, not easier, to do so next year.
The second is that measurement is not a communications problem but a governance one. The reason Avlokan has no APA cycle time, no pending inventory, no compliance-audit statistics and no revenue effect is almost certainly not that the Division wished to conceal them. It is that nobody computes them, because nobody is required to answer for them. Publication and computation are the same reform.
The third is that confidentiality has been allowed to do work it was never designed for. Taxpayer secrecy protects the taxpayer’s affairs from the world. It has been quietly extended, in practice if not in doctrine, to protect the administration’s performance from its own Parliament. Article 26(2) itself, by carving out oversight, shows that the drafters never intended the first to imply the second.
The fourth is that the unilateral APA is the largest unexamined fiscal instrument in Indian direct taxation. 751 agreements, each capable of binding the revenue for 9 assessment years, concluded without a counterparty, and reported to the public only as a component of a headline count. If a single audit theme had to be chosen, this would be it.
The fifth is that India’s international standing now depends on domestic accountability in a way it did not a decade ago. The Division is negotiating, at the United Nations Intergovernmental Negotiating Committee, for a framework convention built on fair allocation of taxing rights and the interests of the Global South. It is asking other states to accept commitments and to be measured against them. A country that leads that argument while publishing enforcement data from 2021 and a MAP table that does not reconcile is carrying an avoidable vulnerability into a negotiating room.
The sixth is that the professional relationship between the Board and the Comptroller and Auditor General on international tax has never been established, and both institutions are the poorer for it. There is no protocol, no data-safeguards memorandum, no agreed reporting convention, and consequently no practice. The absence is filled by an assumption of exclusion that neither the treaties nor the statute supports. The recently concluded MOU between CAG and CBDT could be a confidence building mechanism though CAG as a Constitutional authority does not need to invoke a MOU.
THE WAY FORWARD
The most consequential reform is also the cheapest, and it is legislative. India should enact, in the Income-tax Act, 2025 or in a Finance Act, a provision modelled on section 521(b) of the American statute of 1999: a mandatory annual public report on APAs and the MAP, prescribing the statistics to be disclosed–applications received, executed, pending, withdrawn, rejected, revised and cancelled; cycle times, disaggregated; renewal rates; counterparty distribution; aggregated methods, tested parties and margin ranges by transaction category; critical assumption failures; and compliance-audit completion–while expressly preserving the confidentiality of each individual agreement. The CBDT already publishes an Annual APA Report; making its content statutory, and making it comprehensive, converts a courtesy into an obligation and removes the question from the discretion of whoever holds the chair.
Second, the CBDT should compute and publish an Indian transfer pricing yield on the British model: a single composite figure, on a published and stable methodology, aggregating additional revenue from transfer pricing assessments, APAs, Safe Harbour and MAP. It will be contestable in year one. It will be indispensable by year five. Its absence is the reason no Finance Minister has ever been able to tell Parliament what India’s transfer pricing function is worth.
Third, the compliance chain should be instrumented and reported. Rule 10-O filing compliance, Rule 10P audit completion within the statutory period, critical assumption failures, revisions and cancellations should be tracked in a single system, reviewed by the CBDT quarterly, and disclosed annually. This costs nothing but attention.
Fourth, the CBDT should consider an internal assurance function on the Tax Assurance Commissioner model–a senior officer, outside the negotiating line, who signs off on the most significant agreements against published criteria and reports annually on how they were reached. It is the cheapest available insurance against the marginal March agreement.
Fifth, the CAG should undertake a thematic performance audit of India’s tax certainty and international cooperation architecture under section 16 of CAG’s DPC Act read with the Regulations on Audit and Accounts, structured exactly on the scope and boundaries set out above, preceded by a written information-security and access protocol agreed with the CBDT and consistent with the Global Forum’s confidentiality standards, and–where substantive judgement genuinely requires testing–supported by an independent expert engaged on the UK’s Park model. The audit should be announced, its terms of reference published, and the confidentiality architecture published with them, so that treaty partners can see for themselves that the exercise is disciplined.
Sixth, the PAC Accounts Committee should take Avlokan on its own terms. It is a public document making public claims. The Committee is entitled to ask the CBDT, on the record, where the 241 MAP cases went; why enforcement data in a 2026 report is dated 2021; what the average time to conclude an APA is; how many are pending; how many compliance audits under Rule 10P were completed last year; and what the APA programme is estimated to have been worth. Six questions. None of them threatens a treaty. All of them are unanswerable from the report.
Seventh and last, the Division should be told plainly that outcome reporting is not an admission of failure. The IRS publishes that its APA inventory rose to 622 and its median completion time lengthened. HMRC publishes that the average age of a settled transfer pricing enquiry rose from 33 to 41 months. These are administrations at the top of the world league table, disclosing deterioration about themselves, and their credibility is enhanced rather than damaged by it. The Indian revenue service is competent enough to survive the same honesty and, on the evidence of what it has built in fourteen years, would probably do rather well out of it.
A FINAL WORD
There is a small, unintentionally perfect detail in the report. The Division’s mission statement, printed on the cover beneath the title, reads: Facilitating global engagement. Safeguarding India’s interests. Every one of the 152 pages that follows is devoted, with real skill and evident effort, to the first proposition. The second is asserted throughout and demonstrated nowhere, because demonstrating it would require the very numbers the report does not contain.
Avlokan means observation. A great deal has been observed. What has not yet happened–and what a CAG a PAC, and in the end the CBDT itself must now bring about–is that anyone should be obliged to look back at what was observed a year later and say whether it worked.
The central lesson is not that Avlokan should have been harsher, but that its next edition must be more accountable. India can protect confidential taxpayer and treaty information while publishing aggregate data on applications, pending cases, timelines, compliance reviews, revenue outcomes, MAP settlements and information exchanges. The CAG can also examine sensitive records under appropriate safeguards without disclosing them publicly. The real reform is to ensure that someone ultimately answers for the numbers reported. Avlokan has made the Foreign Tax and Tax Research Division visible. The next step is to make its performance measurable, outcomes reviewable and claims independently verifiable—demonstrating what its work delivered for taxpayers, the exchequer and India’s interests.
About The Author– Mr. P Sesh Kumar is a retired 1982-batch officer of the Indian Audit and Accounts Service (IA&AS) who served as Director General of Audit at the Comptroller & Auditor General of India.
Disclaimer—(The views and opinions expressed in this article are solely those of the author and do not necessarily reflect the views of Indian Masterminds. For feedback or queries, please write to [email protected].)
Also Read – Children Need a Digital Safety Standard, Not Just a Screen-Time Rule
