ATO audit: What triggers it and how to prepare your business

Published Saturday 26 September 2026

Table of contents

• What is an ATO audit?
• ATO review vs audit: What's the difference?
• What triggers an ATO audit for a small business?
• How far back can the ATO audit?
• What happens during an ATO audit?
• How to prepare for an ATO audit
• Ways to reduce your risk of an ATO audit
• Simplify small business compliance with Xero
• FAQs on ATO audits for small business

Key takeaways

• An ATO audit is a detailed check that you've reported your income, deductions, GST, and super correctly under tax law.
• Audits are usually risk-based, not random. The ATO selects businesses mainly through data matching, comparing your figures against information it already holds.
• Common triggers include income that doesn't match ATO data, figures out of line with industry benchmarks, and unusual or oversized deductions.
• Accurate, complete records are your best protection, and they make responding to any ATO request far quicker and less stressful.

What is an ATO audit?

An ATO (Australian Taxation Office) audit is a detailed check that your business has reported its income and claimed its deductions correctly under tax law. For a small business, an ATO audit can cover income tax, goods and services tax (GST), super, or a single transaction that caught the ATO's attention.

The word audit worries a lot of owners, but it doesn't automatically mean you've done something wrong. Many businesses first experience a lighter review rather than a full audit, and plenty of these are resolved with a few documents.

An audit is simply the ATO's way of confirming the figures on your return line up with the information it already holds about your business.

ATO review vs audit: What's the difference?

The quickest way to understand an ATO review vs audit is this: a review is a lighter fact-finding check, while an audit is a deeper examination when the ATO has real concerns. Knowing which one you're facing helps you respond calmly and appropriately.

Here's how the two compare:

• A review is preliminary. The ATO asks a few questions or requests specific documents to check if something looks right.
• A review is often quick to resolve. You supply the records, the ATO is satisfied, and the matter closes.
• An audit is more thorough. The ATO examines your records in depth across one or more tax types or periods.
• An audit follows a concern. It usually starts when a review or data matching flags a discrepancy worth investigating.

What triggers an ATO audit for a small business?

The ATO mostly selects businesses using data matching, not at random. It compares your tax returns, business activity statements (BAS), Single Touch Payroll reports, and banking data against industry benchmarks, then looks closely at anything that stands out. You can read the ATO's own explanation of its approach for small business.

This focus is partly explained by the small business income tax gap. According to the ATO’s latest update, the gap for 2022 – 23 was $27.2 billion, or 17.4% of the total theoretical tax, which means about 83% was paid voluntarily. The ATO shares more detail in its small business income tax gap estimate.Understanding the common ATO audit red flags helps you spot and fix problems before the ATO does.

Common ATO audit red flags

Running through this quick self-check list is a practical way to see where your reporting might draw attention. None of these guarantees an audit, but each one raises your risk.

• Income doesn't match ATO data. Your reported income sits below what bank data, Single Touch Payroll, or third-party reports suggest.
• Figures fall outside industry benchmarks. Your margins or expenses look unusual for a business of your size and type.
• BAS and income tax returns disagree. The GST and income figures you lodge don't reconcile with each other.
• Deductions look large or unusual. You claim oversized expenses or high business-use percentages on assets that also have personal use.
• Super is unpaid or incorrect. You've missed super payments for employees or paid the wrong amount.
• Lodgments are consistently late. A pattern of late or cash-heavy reporting can attract closer scrutiny.

How far back can the ATO audit?

For a small business, the ATO can generally review your affairs going back two years. This period of review stretches to four years for more complex affairs, and there's no time limit where the ATO suspects fraud or evasion.

This window is called the period of review, and it sets how long the ATO has to amend an assessment. The ATO explains the timeframes in its guidance on how to request an amendment to a business tax return.

Because the clock can run for years, keeping tidy record keeping habits well beyond the current year is worth the effort.

What happens during an ATO audit?

An ATO audit follows a fairly predictable path, so knowing the steps ahead of time takes away a lot of the uncertainty. The ATO tells you it's happening, asks for information, reviews it, and then explains the outcome.

Here's the typical flow:

• You receive notification. The ATO contacts you to confirm what it's examining and which periods are involved.
• The ATO requests information. You're asked to supply records such as invoices, receipts, bank statements, and BAS working papers.
• The ATO reviews your records. An officer checks your documents against the figures you reported and the data it holds.
• The ATO explains the outcome. You'll be told whether there's no change, or whether an adjustment applies.

If the ATO finds a mistake, it can issue an amended assessment, which may include extra tax, penalties, and interest. The size of any penalty usually depends on whether the error was careless or deliberate, so honest, well-documented reporting works in your favour.

If you don't agree with the ATO's position and your turnover is under $10 million, you can ask for a small business independent review. An officer not involved in the original audit takes a fresh look at your case.

How to prepare for an ATO audit

The best way to prepare for an ATO audit is to keep accurate, complete records and respond to the ATO promptly. If you're notified of an audit, working through the steps below in order keeps you organised and calm.

Follow these steps once you know an audit is underway:

1. Gather and organise your records for the periods under review, including invoices, receipts, bank statements, and payroll reports.
2. Reconcile your figures so your BAS, income tax, and super records agree with your bank transactions.
3. Check that every deduction you claimed has supporting evidence, such as a receipt or logbook.
4. Respond to the ATO's requests on time, and ask for an extension early if you need one.
5. Get help from a registered tax agent who can review your position and deal with the ATO on your behalf.

Ways to reduce your risk of an ATO audit

Strong ATO compliance for a small business comes down to accurate reporting and good habits kept up all year, not just at tax time. When your numbers are right and your records are ready, you lower your risk and cut the stress if the ATO ever does get in touch.

Building these habits into your routine makes a real difference:

• Report all your income. Include cash sales and every income stream so your figures match the data the ATO holds.
• Keep digital records.Store invoices, receipts, and statements in one place so nothing goes missing.
• Lodge and pay on time. Meet your BAS, super, and income tax deadlines consistently.
• Pay super correctly. Calculate and pay the right super for every employee by the due date.
• Separate business and personal money. Keep dedicated accounts so your bank reconciliation stays clean and your claims are easy to justify.

Simplify small business compliance with Xero

Staying audit-ready is far easier when your records are accurate, digital, and reconciled as you go. Xero brings your invoices, bank transactions, GST, and payroll together in one place, helping your figures line up so your evidence is ready if the ATO asks.

That means less scrambling at tax time and more confidence that what you've lodged matches your actual activity.

Ready to see how organised, up-to-date books make compliance easier? Get one month free and one less thing to worry about.

FAQs on ATO audits for small business

These quick answers cover the questions small business owners ask us regularly about ATO audits.

Does the ATO audit small businesses at random?

No, the ATO mainly uses data matching and benchmarks to select businesses, so audits are risk-based rather than random. Its random enquiry program found 54% of small businesses reported correctly and a further 35% tried to, which helps the ATO focus its attention.

How long does an ATO audit take?

It depends on how complex your affairs are and how quickly you supply records. Responding promptly with organised documents is the single best way to keep an audit short.

What happens if the ATO finds a mistake?

The ATO can issue an amended assessment with extra tax, plus penalties and interest depending on whether the error was careless or deliberate. Honest reporting and clear records usually reduce any penalty.

Can you dispute an ATO audit decision?

Yes, if your turnover is under $10 million you can request a small business independent review, where an officer not involved in the audit reviews the decision. You can also use the ATO's standard objection process.