An ATO audit is a formal review by the Australian Taxation Office of a taxpayer's financial records to verify that the tax amounts reported are correct. For most small business clients, the trigger is not intentional fraud — it's inconsistencies in the data: a GST refund that's unusually large, income that doesn't match TPAR data, a dramatic change in profit margin from one year to the next.
For bookkeepers, an audit of a client's activity statements is a direct test of the quality of the bookkeeping. Good records make audits survivable. Poor records make them expensive.
What triggers a BAS or GST audit
The ATO uses data-matching and risk algorithms to identify returns for review. Common triggers for activity statement audits:
Unusually high ITC rate: If a client claims input tax credits representing 15% of revenue in one quarter but 25% in the next, the system flags the anomaly. Large one-off ITC claims from capital purchases, or errors where personal expenses are miscoded as business expenses, are common causes.
GST refunds for registered businesses: Consistent GST refund positions (where ITCs exceed output GST every quarter) for a non-exporter are unusual and attract review. Most businesses in continuous refund position are exporters or businesses with significant capital investment phases.
Inconsistency with TPAR data: If TPAR lodgements from a client's customers show the client received $280,000 in contractor payments but the BAS shows $200,000 in reported income, the gap is visible to the ATO.
Benchmarking outliers: The ATO publishes small business benchmarks for gross margin, labour costs, and other ratios by industry. A café reporting a 30% gross profit margin in an industry where the ATO benchmark is 65–75% will attract attention.
STP mismatches: W1 (wages on BAS) figures inconsistent with STP-reported payroll data.
Random reviews: Some audits are selected randomly as part of the ATO's compliance monitoring program.
The three types of ATO review
Not all ATO contact is a full audit:
Desk review (data matching letter): The ATO sends a letter noting a discrepancy and asking the taxpayer (or their agent) to explain. This is a low-intensity review. Respond within the stated timeframe with a clear explanation and supporting documents.
Review: A deeper look, usually conducted by correspondence. The ATO requests specific records (invoices, bank statements, contracts) and may ask questions about specific transactions. Most BAS audits are conducted at this level.
Audit: A formal audit involves an ATO officer reviewing records in detail, possibly at the client's premises. Field audits are less common for small businesses but occur for clients with higher risk indicators.
What records the ATO will ask for
For a BAS audit, the ATO will typically request:
- Bank statements for the audit period (all accounts, including savings and loan accounts)
- Tax invoices for all transactions where ITC was claimed (including invoices over $82.50 where a valid tax invoice is legally required)
- Lease agreements, hire purchase agreements, and loan documents
- Payroll records (if W1/W2 figures are under review)
- Records of any cash sales
- Explanation of any unusual transactions
The five-year record retention rule: Australian businesses are required to keep records for five years from the date the record was prepared or obtained, or the date the transaction was completed — whichever is later. Records may be kept electronically, provided they are accessible and printable.
How to make audit preparation part of your standard practice
The most effective audit preparation happens before the audit is announced, not after.
Keep tax invoices for every ITC claim over $82.50
Under GST legislation, you cannot claim an ITC on a purchase of $82.50 or more (including GST) without a valid tax invoice. A valid tax invoice must include:
- The word "tax invoice" (clearly stated)
- The supplier's name and ABN
- The issue date
- A description of the goods or services
- The GST amount (either stated separately or a statement that the total includes GST)
- The buyer's identity (if the invoice is for $1,000 or more)
Instruct clients to photograph or scan every receipt. Shoebox receipts that have faded or been lost are the most common cause of disallowed ITC claims in audits.
Maintain a coding policy document
For practices that process a large volume of unusual transactions, document how certain recurring decisions are made:
- How mixed-use expenses (phone, vehicle) are apportioned
- How client entertainment vs staff entertainment is distinguished
- How assets below the write-off threshold are treated
When an ATO auditor asks "why did you claim 80% ITC on this phone plan?", a documented policy that the client uses the phone 80% for business (backed by a usage log) is a defensible answer. An undocumented assumption is not.
Reconcile BAS figures to the general ledger
Every BAS figure (G1, G2, G3, G10, G11, W1, W2) should be reconcilable to the general ledger. A BAS that can be traced to the accounts — "G10 capital acquisitions of $45,000 corresponds to the following three asset purchases" — is defensible. A BAS figure that differs from the GL with no explanation is a problem.
In Reconlink, the BAS worksheet is generated directly from coded transactions. This provides an inherent audit trail — every figure on the BAS has an underlying coded transaction that supports it.
Flag unusual transactions immediately, not at year-end
When a client has an unusual transaction during the year — a large asset sale, an insurance payout, a related party loan — document the explanation at the time. A note in the client file ("$120,000 insurance proceeds received 14 March — total loss of delivery vehicle, no GST as insurance is input-taxed") recorded in March is infinitely more useful than trying to remember the details in October.
How to respond to an ATO audit
If a client receives an ATO review or audit notice:
Step 1: Read the letter carefully. Identify what period is being reviewed, what figures are in question, what documents are requested, and the response deadline.
Step 2: Notify the client and the tax agent immediately. The tax agent manages the ATO relationship for income tax and complex matters. For BAS-related audits, the BAS agent leads, with the tax agent supporting.
Step 3: Pull the records. Gather every document the ATO has requested. Do not provide more than requested — additional documents may create new questions.
Step 4: Review the relevant period. Before responding, internally review the period under audit. Identify any errors or inconsistencies that the bookkeeper or client can explain. It is better to voluntarily disclose and correct an error upfront than to have the ATO identify it.
Step 5: Respond professionally and on time. Late responses without prior extension requests create a negative impression and may result in the ATO making assumptions unfavourable to the taxpayer.
What bookkeepers should not do during an audit
Do not ignore the notice. Unresponsive taxpayers face assessments based on ATO estimates, which are typically unfavourable. They also face additional penalties.
Do not destroy or alter records. This is a criminal offence under the Taxation Administration Act.
Do not guess. If a transaction cannot be explained, say so honestly. "I don't have the underlying invoice for this transaction — I'll obtain it from the client" is a reasonable response. An invented explanation that later unravels is much worse.
Do not panic. An ATO review of a bookkeeper's work is not a presumption of fraud. The majority of reviews result in no adjustment or minor adjustments. Clean records and professional responses resolve most reviews efficiently.
This article was last reviewed on 27 May 2026. ATO audit processes and rights are governed by the Tax Administration Act 1953. This is general guidance, not specific legal advice. For complex audits, engage a tax lawyer or experienced tax agent.