How should your business control Coretax access and taxpayer representative authority under PMK 55/2026—without exposing corporate tax data?

PMK 55/2026 signals a step-change in how rigorously taxpayer representative authority (surat kuasa pajak) is validated, and that lands directly on your day-to-day Coretax operating model. For SME owners and finance leaders, the practical problem is not “understanding the regulation”—it is preventing the wrong person from acting in your name, accessing sensitive filings, or locking you out of Coretax at the worst possible time (audits, refunds, objections, payroll reconciliations, year-end). This guide gives a control framework you can implement now and run through 2027: how to verify and document representatives, design least-privilege access and segregation of duties in Coretax workflows, protect data pajak perusahaan, and set approvals, logging, periodic re-validation, and clean exit procedures when people change.

What business risks change when representative validation becomes stricter under PMK 55/2026?

The main shift for management is that “who is allowed to act for the taxpayer” becomes a governed control point, not an informal arrangement between your company and a consultant.

If PMK 55/2026 increases validation rigor (as widely expected in practice), your operational risks concentrate in four areas:

1) Authority risk (someone acts without valid scope)

• A representative submits, signs, or responds outside what you intended.
• Your internal team assumes a consultant’s access equals authority for every tax matter.
• The scope is ambiguous (e.g., “handle tax matters” without listing actions), creating disputes later.

2) Continuity risk (you lose control of your own Coretax account)

• Access is tied to an individual (vendor staff, ex-employee) and not offboarded.
• Credentials or delegated access remain active after engagement ends.
• Your team cannot proceed during deadlines because only the external party knows the process.

3) Data risk (data pajak perusahaan leakage or misuse)

• Coretax contains high-value corporate data: financial figures, tax positions, related-party information, and correspondence history.
• Over-broad access increases the blast radius if credentials are compromised.

4) Audit-readiness risk (you cannot evidence governance)

• During an audit or dispute, you cannot easily show: who was authorised, when, for what scope, and what controls were in place.

Management takeaway: treat surat kuasa pajak and Coretax delegation as part of internal control design. Your goal is not only “compliance”; it is operational resilience and controlled accountability.

Who in your organisation should own representative governance and Coretax access—so it doesn’t fall between Finance and Tax?

SMEs often fail here because “tax” is outsourced while Coretax access is treated as an IT detail. A workable model is to assign clear owners and backup owners.

A practical SME governance model (no heavy bureaucracy)

Control Owner (Accountable): Finance Director / Head of Finance

• Approves who may represent the taxpayer.
• Owns the approval matrix and periodic re-validation.

Process Owner (Responsible): Tax Manager / Finance Manager

• Maintains the representative due diligence pack.
• Runs the onboarding/offboarding checklist.

System Custodian (Responsible): Finance Ops / designated admin

• Executes access provisioning changes (where applicable).
• Maintains access logs and evidence folders.

Reviewer (Independent check): Director, CFO, or Controller (depending on size)

• Performs quarterly spot checks of representative list vs active access.

Minimum controls to implement immediately

• One named “Authority Register Owner” (person, not department).
• One named “Coretax Access Register Owner.”
• A rule that no one can both (i) prepare data and (ii) be the final internal approver/signatory for submissions, unless company size makes it unavoidable—in which case add compensating controls (review checklist + after-the-fact monitoring).

If you work with multiple advisors: adopt a “single front door” rule internally: all external representative requests go through the same internal owner, not through individual staff relationships.

How do you build a representative due diligence pack that stands up in 2027 operations and audits?

A due diligence pack is your evidence set. It should be easy to update, secure to store, and clear enough that a new finance manager can understand it in 30 minutes.

What the pack should contain (practical version)

1) Identity and status verification

• Identity details of the representative (and, where relevant, the firm).
• Evidence of role/position if the representative acts as an employee/officer.
• Contact details and a verified email/phone used for Coretax-related communication.

2) Scope of authority (surat kuasa pajak) mapped to actions Translate broad language into concrete allowed actions. Example mapping table:

• Filing/Submission: allowed / not allowed
• Drafting returns: allowed / not allowed
• Viewing taxpayer data: allowed / not allowed
• Responding to DJP correspondence: allowed / not allowed
• Attending meetings: allowed / not allowed
• Signing/approval in Coretax: allowed / not allowed

3) Validity period and renewal approach

• Start date and end date.
• Renewal conditions (e.g., annual renewal or project-based).
• “Auto-expiry” preference: where possible, avoid open-ended authority.

4) Revocation triggers (write them down) Typical triggers SMEs can adopt:

• Contract ends or engagement scope changes.
• Named individual leaves the advisory firm.
• Internal role change (Finance Manager replaced).
• Security incident (credential compromise suspected).
• Performance or governance breach (submissions made without internal approval).

5) Evidence storage and access control

• Store in a restricted folder (not a shared drive open to all staff).
• Limit to: Control Owner, Process Owner, backup.
• Keep a simple index and version history.

Make it operational: a one-page “Representative Profile”

For each representative, create a one-page summary:

• Who they are
• What they can do
• When authority expires
• Who internally approves their work
• Where evidence documents are stored

This summary becomes your working tool—and prevents misunderstandings during busy filing periods.

Where PHP can help (optional): Paul Hype Page & Co. can review existing surat kuasa pajak wording for operational clarity (scope, duration, revocation triggers) and help you structure the evidence pack so it’s audit-friendly without being overly legalistic.

How should you design least-privilege Coretax access so representatives can work without becoming a single point of failure?

The control principle is simple: give each person the minimum access needed for their task, and design the workflow so your company retains the ability to proceed even if an external party is unavailable.

Step 1: Categorise the work into roles (not people)

Use role categories such as:

• Preparer: drafts calculations, prepares data, assembles documents.
• Reviewer: checks technical and numerical accuracy; validates attachments.
• Approver/Signatory: final internal decision-maker who authorises submission.
• Administrator (limited): manages access changes and evidence folders.

Even if one person wears multiple hats, writing roles down forces clarity.

Step 2: Define least-privilege permissions by role

Your target is to avoid “everyone can do everything.” Practical permission choices (adapt to the capabilities of Coretax and your internal policies):

• Preparers can upload drafts/support but cannot submit final.
• Reviewers can view all relevant data and comment/return for changes.
• Approver/signatory can submit final and respond to critical correspondence.
• Administrator can manage access but cannot approve tax positions.

Step 3: Build redundancy without over-granting access

SMEs often over-grant access “for backup.” Better options:

• Maintain two internal approvers (primary + backup) rather than giving broad approval rights to an external representative.
• Use time-bound access for external representatives where possible.
• Keep process documentation (submission steps, data sources, timelines) so knowledge is not trapped with one person.

Step 4: Separate “doing the work” from “sending the work”

A common control failure is letting the same external party:

1. prepare the numbers,
2. upload the documents,
3. submit/sign,
4. store the evidence.

That creates accountability gaps. A workable SME compromise:

• External party prepares + uploads.
• Internal team reviews + submits.
• If internal submission is not feasible, implement compensating controls (see next section).

Design goal: your company can always answer, “Who internally approved this position and why?”—even if the work was outsourced.

What segregation-of-duties controls are realistic for SMEs using Coretax and external tax consultants?

Many SMEs cannot fully separate duties due to headcount. The goal is not perfection; it’s reducing the chance of unreviewed submissions and creating evidence that review happened.

A practical SME segregation model (three lines)

Line A — External consultant (execution):

• Drafts filings, prepares reconciliations, drafts responses.

Line B — Internal finance (control):

• Confirms numbers tie to accounting records.
• Confirms the submission matches approved scope.
• Confirms attachments are correct and complete.

Line C — Management sign-off (accountability):

• Approves material tax positions, elections, dispute responses, and anything with business impact.

Compensating controls when the consultant must submit

Sometimes the external representative will submit due to timing, system constraints, or internal capacity. If so, adopt compensating controls:

• Pre-submission approval: a short approval form (email is acceptable if controlled) confirming:
• period covered
• key figures
• attachments list
• confirmation that submission is within scope
• Evidence capture: screenshot/PDF of the submission summary and time stamp.
• Post-submission internal check: within 48–72 hours, internal reviewer confirms what was filed matches what was approved.
• Exception log: any deviation must be recorded, explained, and signed off.

Define “material items” that always require management approval

SMEs should predefine triggers. Examples:

• significant adjustments vs accounting profit
• unusual transactions (asset sale, restructuring, cross-border items)
• responses to DJP queries that include new facts or positions
• requests affecting cash flow (e.g., refunds) or dispute strategy

This turns ad-hoc stress into a predictable workflow.

How do you control and evidence surat kuasa pajak scope so it’s not misused across years or tax types?

Most misuse happens quietly: the scope is broad, the validity is open-ended, and nobody checks it until there is a problem.

Control 1: Scope matrix linked to tax calendar

Create a simple matrix:

• Rows: tax types/activities your business deals with (e.g., monthly filings, annual corporate filings, responses to letters).
• Columns: representatives (internal staff, external advisors).
• Cells: allowed actions (view / prepare / submit / correspond).

Tie the matrix to your tax calendar so each cycle starts with “who is authorised for this cycle.”

Control 2: Authority validity management (expiry is a feature)

Prefer time-bound authority:

• Annual validity for recurring compliance.
• Project-based validity for one-off matters.

When authority expires, renewal should require:

• confirmation the individual is still the assigned person
• confirmation scope is unchanged
• confirmation no incidents occurred

Control 3: Revocation and substitution process

Write a one-page internal procedure:

1. trigger identified (role change, contract end, incident)
2. Control Owner approves revocation
3. System Custodian removes access/delegation
4. Process Owner updates authority register
5. Evidence saved (revocation instruction + confirmation)

Control 4: Document hygiene to avoid “multiple truths”

• One master copy location.
• Version naming convention (e.g., RepName_SuratKuasa_2027_v1).
• Do not allow staff to circulate scanned copies in messaging apps as the “working document.” Use links to controlled storage.

Your objective is simple: at any time, you can produce one current, validated authority set and show how it is controlled.

What logging and monitoring should SMEs implement to protect Coretax and data pajak perusahaan without enterprise tooling?

You do not need a full security operations centre. You need basic logging discipline, routine checks, and clear accountability.

Minimum viable logging (what to keep)

1) Representative Register (business log)

• name / firm
• scope summary
• start/end date
• internal owner
• date last re-validated

2) Access Register (system log)

• who has Coretax access (internal and external)
• role/permission level
• date granted
• date removed
• reason for change

3) Submission & Correspondence Log (operational log)

• filing period
• what was submitted/responded
• who prepared
• who reviewed
• who approved
• evidence link (PDF/screenshot)

Even if Coretax provides system logs, SMEs still benefit from a human-readable register that ties actions to approvals.

Routine monitoring cadence (lightweight but consistent)

• Monthly: match “who submitted” to approvals and scope.
• Quarterly: revalidate active representatives and access list; check for leavers and vendor staff changes.
• Annually (pre-year-end / pre-annual filing): refresh authority documents, update scope matrix, confirm backups.

Simple red flags to investigate

• submissions made outside normal timelines
• new correspondence handled without internal visibility
• repeated access requests “because someone forgot a password”
• representative email/phone changes mid-cycle
• approvals consistently happening after submission

Evidence pack for audit readiness

For each period or major interaction, keep:

• approval record
• final submission summary
• key attachments list
• correspondence exchanged
• representative identity/scope reference

This is not about storing everything; it’s about storing the items that prove controlled decision-making.

How should you handle credential hygiene and incident response if a representative’s authority or access is misused?

SMEs often delay action because they are unsure whether something is “serious enough.” Your policy should prioritise containment and continuity.

Credential hygiene rules that work in SMEs

• No shared accounts for Coretax-related access.
• No storing passwords in spreadsheets or chat.
• Use a controlled password manager if feasible.
• Enforce a “two-person knowledge” rule for critical accounts: at least two internal people know how to regain access, update emails/phones, and retrieve evidence.

A practical incident response playbook (non-technical)

When you suspect misuse (wrong submission, unauthorised access, credential leak):

Step 1 — Contain (same day)

• freeze or remove representative access where possible
• change relevant credentials / recovery options
• suspend further submissions until scope is confirmed

Step 2 — Preserve evidence (same day)

• capture screenshots/PDFs of suspicious activity
• export relevant logs/confirmations
• save communications in a controlled folder

Step 3 — Assess impact (24–72 hours)

• identify what data may have been accessed (data pajak perusahaan exposure)
• identify what filings/correspondence were affected
• identify whether the issue is a process failure (approval missing) or a security failure (credentials compromised)

Step 4 — Correct and prevent recurrence

• correct internal registers (authority/access)
• update approval matrix
• retrain staff on “no submission without approval”

Where you need specialist help, engage your tax advisor and internal IT to coordinate actions. If you work with Paul Hype Page & Co., we can assist with (i) representative authority review, (ii) evidence pack reconstruction, and (iii) implementing an updated delegation and approval workflow—so the fix is operational, not just administrative.

What should your internal approval matrix look like for granting and changing representative authority?

An approval matrix is a control that prevents informal authority creep. It also reduces negotiation friction with external advisors because your team can point to a clear policy.

Build the matrix around “risk of action,” not job titles

Define action categories:

• Category 1 — Low risk: data collection, draft preparation, non-substantive follow-ups.
• Category 2 — Medium risk: routine submissions after internal review, standard correspondence.
• Category 3 — High risk: signatory actions, disputes/objections, matters affecting cash flow or tax positions.

Then assign required approvals:

• Category 1: Process Owner approval.
• Category 2: Control Owner approval + reviewer sign-off.
• Category 3: Director/CFO approval + documented rationale.

Change control for access rights

Every access change should have:

• requestor
• business reason
• scope requested
• start/end date
• approver
• confirmation of implementation

Keep it usable: one page, reviewed quarterly

If it becomes a 12-page policy, staff will bypass it. One page plus checklists usually performs better in SMEs.

Align the matrix to your outsourced model

If an external representative asks for broader authority “to make the process faster,” your internal response should be structured:

• Is the request tied to a specific cycle?
• Can we meet the deadline using internal submission with external preparation?
• If not, what compensating controls will we implement?

The approval matrix turns access decisions into documented risk decisions.

How do you operationalise periodic re-validation so PMK 55/2026 doesn’t create last-minute chaos?

Periodic re-validation is where most SMEs struggle, because it competes with closing, payroll, and sales priorities. The fix is to attach it to existing business rhythms.

Pick a cadence you will actually keep

Common patterns that work:

• Quarterly re-validation: best for SMEs with frequent filings and multiple reps.
• Semi-annual re-validation: workable if representative list is stable.
• Annual re-validation + event-driven updates: only if changes are rare and controls are strong.

What re-validation means (keep it simple)

For each representative:

• still the correct individual?
• still within scope?
• still within validity period?
• any incidents or exceptions?
• still needed (or can be removed)?

Embed it into a 30-minute quarterly routine

Agenda:

1. Review Representative Register (add/remove)
2. Review Access Register (compare to HR leavers and vendor contacts)
3. Review last quarter’s exceptions
4. Confirm next quarter’s key filings and who owns what

Output:

• updated registers
• action list with owners and dates

Measure it (so it doesn’t drift)

Track two metrics:

• % representatives re-validated on schedule
• # of active accesses not linked to a current representative scope

These are simple but powerful indicators of governance health.

Conclusion

PMK 55/2026 should be treated as a governance upgrade: stricter validation of taxpayer representatives means your business needs a controlled way to grant, evidence, monitor, and revoke authority—especially as Coretax becomes the operational centre for filings and DJP interactions. For 2027 readiness, focus on four deliverables: (1) a representative due diligence pack per person, (2) least-privilege role design and workable segregation of duties, (3) simple registers and periodic re-validation routines, and (4) an incident response and offboarding process that protects data pajak perusahaan and preserves continuity. If you want an external check, Paul Hype Page & Co. can help you review surat kuasa pajak scope, build the evidence pack, and implement an approval and access-control workflow that your team can actually run—not just file away.