Select committee: Public Accounts Committee
Conclusion 31
23rd Report - The cost of the tax system
Published 30 Apr 2025
Addressed to HM Treasury
Public Accounts Committee The cost of the tax system All items in this report Report on parliament.uk ↗ Inquiry on parliament.uk ↗
Conclusion (the committee's words)
We asked HMRC whether there were potential security concerns that could be posed by the third–party MTD software taxpayers use to submit their tax returns, including whether there were risks to HMRC’s own systems.63 In written evidence provided after our evidence session, HMRC told us it takes security very seriously. It said all data sent to HMRC systems is monitored for fraud prevention, and to ensure that customer data is safe. It also said that it sets out strict specifications for third–party MTD software products in terms of cyber–security and the security, storage, management and processing of customer data.64
From: Public Accounts Committee, 23rd Report - The cost of the tax system (HC 645), 30 April 2025
Government response
The government responded to the whole report on 18 September 2025.
Summary written by Accountability Index from the government's response. It is not the government's own words.The government states that it "agrees with the Committee's recommendation" on each of the report's recommendations, and reports that several are already implemented while others carry target dates.
- On simplification, the government will publish HMRC's Transformation Roadmap in summer 2025, which "will include the metrics HMRC will use to report progress".
- On trust, the government agrees with both recommendations and describes them as "Recommendation implemented", citing annual customer surveys, complaints data and focus groups.
- On compliance productivity, it says HMRC "will recruit an additional 5,500 compliance staff by March 2030", alongside other measures to close the tax gap.
- On legacy IT, HMRC "will write to the Committee" on its remediation plans, forecast cost and expected savings, with a target implementation date of September 2025.