What Triggers an ATO Audit? Red Flags for Small Business Owners

Most small business owners don’t expect to hear from the ATO — until they do.

An email requesting clarification. A letter asking for documents. A notification about a review of your BAS or income reporting. It’s rarely dramatic, but it immediately raises one question: what triggers an ATO audit?

The reality is that most ATO audits begin quietly. They are driven by data matching, reporting inconsistencies and risk patterns — not random selection. In many cases, the issue is not fraud or misconduct, but gaps in record keeping, mismatched BAS and GST reporting, or claims that fall outside industry norms.

Understanding how the ATO identifies risk puts you back in control.

In this guide, we explain what typically triggers an ATO audit, how far back the ATO can review your affairs, and what practical steps small business owners can take to reduce audit risk. At Grow Advisory Group, we help clients stay audit-ready year-round through strong tax compliance systems and proactive oversight.

Table of Contents

What an “ATO Audit” Actually Means (Audit vs Review)

When people refer to an ATO audit, they often imagine a formal investigation. In practice, many interactions with the ATO begin as an ATO review.

A review is typically an initial compliance check. It may involve:

An information request asking for clarification or supporting documents
A request to reconcile figures between your tax return and BAS
Questions about specific deductions, GST claims or reported income
A request for substantiation such as invoices, contracts or logbooks

The review process is usually part of the ATO’s broader risk assessment approach. It allows the ATO to verify that reported figures align with available data and industry benchmarks.

An audit is more formal and may occur where risks remain unresolved or significant discrepancies are identified. In some cases, the ATO may move directly to audit where risk indicators are higher.

Importantly, an ATO review or audit is not automatically an accusation. It is often a verification exercise. Clear records, timely responses and accurate reconciliation of figures significantly influence how smoothly the process progresses.

How the ATO Picks Who to Audit

If you are wondering, how does the ATO pick who to audit, the answer lies in data — not randomness.

The ATO uses risk-based selection processes supported by automated checks, analytics and extensive third-party data. Income reported in your tax return is compared against information provided by banks, employers, online platforms, merchant facilities and other reporting entities. The ATO also analyses industry benchmarks and reporting patterns to identify anomalies that fall outside expected ranges.

For small business owners, common risk indicators can include:

Income levels that do not align with industry benchmarks
Large or unusual fluctuations in deductions
BAS figures that do not reconcile with annual tax returns
Repeated reporting inconsistencies across periods

This does not mean that every variation triggers an ATO audit. The goal of these systems is to reduce anomalies and identify areas requiring verification — not to target compliant businesses at random.

You can review how the ATO conducts third-party data checks and risk assessment processes in its official guidance on ATO third-party data checks.

The practical takeaway is simple: consistency, accurate reporting and strong documentation significantly reduce audit risk.

ATO Focus Areas Right Now (What They’re Watching)

If you’re wondering what is the ATO looking at this year, the ATO regularly publishes its current compliance priorities for small business. These focus areas signal where review and ATO audit activity is likely to concentrate.

You can view the latest priorities on the official ATO small business focus areas page.

In practical terms, current small business focus areas commonly include:

Accurate income reporting – ensuring all business income is declared and matches available data.
GST reporting integrity – reviewing BAS figures, input tax credit claims and reconciliation processes.
Non-commercial losses – confirming that loss claims meet the required eligibility tests.
Small business CGT concessions – verifying that basic conditions and active asset requirements are satisfied.
Income separation arrangements – examining whether income is being diverted incorrectly.
Record keeping standards – checking that deductions and GST claims can be substantiated.

These focus areas matter because they guide the ATO’s risk assessment models, education campaigns and targeted review programs. If your business operates in an area receiving heightened attention, the solution is preparation—not panic.

Strengthening record keeping, ensuring GST and income reporting are internally consistent, and reviewing eligibility for concessions before lodging returns significantly reduces exposure to review or audit activity.

The Most Common ATO Audit Triggers for Small Business

Triggers aren’t always wrongdoing — often they’re mismatches, patterns or reporting inconsistencies that fall outside what the ATO expects to see. Understanding what triggers an ATO audit allows you to correct risk areas before they escalate.

1) Income Doesn’t Match ATO Data or Your BAS

One of the most common ATO audit triggers is a mismatch between your reported income and third-party data. The ATO uses data matching from banks, merchant facilities, and online platforms to compare your lodged tax returns and BAS against the data. If total bank deposits don’t reconcile to declared income, or if BAS figures differ significantly from your annual return, it may prompt contact.

The practical fix is consistent reconciliation. Monthly comparisons of bank deposits, accounting software reports, and BAS figures reduce risk. Where one-off transactions occur, document them clearly so they can be explained quickly if reviewed.

2) Claims That Don’t Fit Your Industry Profile

Large or unusual deductions compared to industry norms can raise red flags for the ATO. The ATO applies benchmark-style ratio testing to identify anomalies in expense claims, gross profit margins and business expense categories.

This does not mean benchmarks are absolute — but significant deviations can trigger a review. The practical response is not to avoid legitimate claims, but to maintain written rationale and clear evidence supporting them. If your numbers differ for a genuine reason, you should be able to explain why.

3) GST/BAS Errors and Inconsistencies

Errors in BAS and GST reporting are another frequent audit trigger. Inconsistent GST coding, incorrect input tax credit claims, adjustment events that are not processed properly, or discrepancies between BAS and financial statements can prompt scrutiny.

The ATO uses analytical tools and governance testing to identify GST red flags. Implementing a structured BAS review process, including periodic transaction testing and reconciliation checks, significantly reduces risk. Even small coding errors repeated over time can attract attention.

Implementing a structured BAS review process, including periodic transaction testing and reconciliation checks, significantly reduces risk. We outline a practical framework for doing this properly in our guide to Simplify Your Business Finances: Expert BAS & IAS Preparation and Lodgement.

4) Repeated Late Lodgements or Non-Lodgement

A pattern of late lodgements signals compliance risk. Overdue tax returns, BAS statements or superannuation obligations increase the likelihood of escalation.

The ATO monitors compliance history. Businesses that regularly miss deadlines may be subject to firmer action or targeted review activity. If you are already experiencing overdue obligations, this links directly to the debt escalation pathway discussed in our article, What Happens If You Owe the ATO Money?

Unpaid or incorrectly reported superannuation guarantee obligations are a common compliance risk area. We explain the reporting requirements and employer responsibilities in our guide to Superannuation Contributions & Compliance.

5) Personal vs Business Spending Mixed Together

Blurring personal and business expenses is a recurring compliance issue for small businesses. Where private use adjustments are unclear, director loans are not properly recorded, or shareholder benefits are not documented correctly, this can become a tax audit trigger.

Clear separation of business and personal accounts is essential. Owner drawings should be processed consistently, and private use adjustments documented. Good bookkeeping discipline prevents avoidable scrutiny.

6) Weak Record Keeping and Poor Substantiation

Strong documentation underpins every tax position. The ATO requires written evidence for most deductions and generally expects records to be retained for at least five years (with some records required longer under specific circumstances). You can review the official ATO record-keeping rules for detailed guidance.

Poor substantiation — missing receipts, incomplete invoices, absent logbooks — is one of the easiest triggers for review.

A practical solution is to adopt an “audit pack” approach: maintain organised digital records of invoices, contracts, logbooks, loan agreements, and reconciliations. When documentation is structured and accessible, ATO reviews become administrative rather than stressful.

How Does the ATO Notify You of an Audit or Review?

If you’re wondering how does the ATO notify of audit, the process is usually formal and documented — not unexpected or informal.

In most cases, the ATO will issue:

An official letter outlining the review or audit scope
A notification through myGov (for individuals)
A message via Online services for business (for companies and sole traders)
A written request for information, specifying documents required and a timeframe to respond

The communication will clearly state what is being reviewed, the relevant tax periods, and the response deadline. It may also include the name and contact details of the ATO officer managing the matter.

If you receive a notification, verify its authenticity through official ATO channels before responding. Do not ignore it — missed deadlines can unnecessarily escalate matters.

You are entitled to appoint an authorised representative, such as your tax accountant or registered tax agent, to manage communication on your behalf. In many cases, having professional oversight ensures responses are structured, complete and aligned with your lodged reporting.

How Far Back Can the ATO Audit?

If you’re asking how far back can the ATO audit, the answer depends on what’s known as the “period of review”.

In most standard cases, the ATO has a limited amendment timeframe starting from the date your notice of assessment is issued. For many individuals and small businesses, this period is generally two years, while for more complex taxpayers it may extend to four years. You can review the official guidance on the ATO period of review page.

However, there is an important exception. If the ATO believes there has been fraud or evasion, there is no time limit on amendments.

It’s also important to distinguish between amendment timeframes and record retention rules. Even if your review window has passed, record-keeping obligations still apply. The ATO generally requires business records to be retained for at least five years under its ATO record-keeping rules, and certain documents may need to be kept longer depending on the circumstances.

Because audit time limits can vary based on structure, complexity and conduct, tailored advice is always preferable to assumptions.

What Happens If the ATO Finds a Problem? (Penalties, Interest, Outcomes)

If an ATO audit identifies an issue, the outcome depends on the circumstances.

In many cases, the result is simply an adjustment to your return. You may need to repay a shortfall amount, along with interest. In more serious cases, penalties can apply.

The ATO penalty for false or misleading statements is generally based on two factors: the size of the shortfall and the behaviour that led to it — for example, whether reasonable care was taken. You can review how the ATO applies these penalties in its guidance on ATO penalty for false or misleading statements.

Where an amendment results in additional tax payable, the ATO may apply a Shortfall Interest Charge (SIC). If tax remains unpaid past the due date, the General Interest Charge (GIC) may apply and compounds daily.

Importantly, voluntary disclosure can significantly reduce penalties. If an error is identified before or during a review, making a voluntary disclosure may limit exposure — but outcomes always depend on the facts.

In practice, most audit adjustments we see are avoidable with proper documentation and reconciliation. When issues do arise, structured responses, accurate recalculations and early engagement with the ATO often lead to more measured outcomes than ignoring the situation.

The key is preparation and proactive management — not panic.

Should I Be Worried If I Get Audited?

If you’re asking should I be worried if I get audited, the honest answer is this: it’s serious — but it’s manageable.

An ATO audit doesn’t automatically mean you’ve done something wrong. It means the ATO wants clarification or verification. The outcome often depends less on the trigger, and more on how the response is handled.

If you receive an audit notice, here’s what to do immediately:

Gather all relevant documentation before responding
Reconcile the figures in question against your lodged returns
Avoid guessing or providing incomplete explanations
Do not amend returns blindly without understanding the implications
Appoint your accountant or registered tax agent to manage communication

Audit readiness comes down to documentation, cooperation and structured response strategy. When timelines are controlled and information is presented clearly, most reviews progress far more smoothly than business owners initially expect.

Calm, organised engagement always produces better outcomes than reactive responses.

How Grow Advisory Group Helps Reduce Audit Risk and Handle ATO Reviews

ATO audits are rarely caused by one dramatic mistake. More often, they stem from patterns — inconsistent BAS reporting, poor substantiation, late lodgements, or structural issues that were never properly reviewed.

We focus on tightening the fundamentals.

From a prevention perspective, our work around tax compliance ensures clean lodgements, accurate BAS reconciliation, and substantiation systems that hold up under review. That means aligning tax returns with financial statements, maintaining proper record retention processes, and ensuring GST and income reporting are internally consistent.

We also identify patterns that can attract attention — volatile margins, inconsistent GST coding, overlap between personal and business spending, or deduction ratios that don’t align with industry norms. Early correction significantly reduces audit risk.

If the ATO initiates a review, we manage the process end-to-end. That includes preparing an organised evidence pack, drafting structured responses, managing ATO correspondence, and maintaining control of the timeline. Where strategy is required — including voluntary disclosures or dispute pathways — our tax advice support ensures decisions are made with full awareness of risk and opportunity.

The objective is simple: reduce exposure before issues arise, and protect your position if they do.

FAQs

What triggers an ATO audit is usually not a random selection, but a data mismatch or reporting anomaly. The ATO compares tax returns and BAS lodgements against third-party data, industry benchmarks and prior-year patterns. Common triggers include income that doesn’t align with bank deposits, unusual deduction ratios, or GST/BAS inconsistencies. These reviews are typically risk-based rather than accusation-driven. Strong reconciliation processes, consistent reporting and clear substantiation significantly reduce the likelihood of escalation beyond an initial review.

How does ATO pick who to audit? The ATO uses a risk-based selection system supported by automated data matching and analytics. Income reported on tax returns is compared with third-party reporting from banks, employers, and payment platforms. The ATO also assesses anomalies against industry patterns. When discrepancies or unusual fluctuations are detected, a review may be initiated. The objective is to address inconsistencies — not to randomly target compliant taxpayers.

How does ATO notify of audit? The ATO typically contacts taxpayers through an official letter and/or secure online portals such as myGov or Online services for business. The notification outlines the review scope, relevant periods and response timeframe. It may request documents or explanations to substantiate claims. It is important to verify authenticity, respond by the due date and avoid ignoring correspondence. You can appoint your accountant or tax agent to manage communication on your behalf.

How far back can the ATO audit depends on the “period of review” linked to your notice of assessment. In most cases, this is two or four years from the assessment date, depending on the taxpayer type. However, if fraud or evasion is involved, there is no time limit. This review timeframe is separate from record retention obligations, which typically require business records to be retained for at least 5 years. The exact window varies depending on circumstances.

ATO audit penalties depend on both the shortfall amount and the behaviour that caused it. The ATO distinguishes between failing to take reasonable care, recklessness and intentional disregard. Interest charges such as the General Interest Charge (GIC) or Shortfall Interest Charge (SIC) may also apply. Importantly, making a voluntary disclosure before or during a review can reduce penalties in certain circumstances. Outcomes vary based on facts, documentation and the timing of engagement.

What the ATO is looking at this year typically includes small business focus areas such as income reporting accuracy, GST compliance, non-commercial losses, small business CGT concessions and record keeping standards. These focus areas guide education campaigns and targeted review activity. Businesses operating in areas under active scrutiny should ensure their BAS, tax returns and financial records are internally consistent and well-documented to minimise risk.

Conclusion

Understanding what triggers an ATO audit helps remove uncertainty. The ATO’s approach is largely data-driven, and most reviews arise from mismatches, inconsistent reporting or weak record keeping — not dramatic misconduct.

Strong tax compliance systems, accurate BAS reporting and consistent reconciliation significantly reduce audit exposure. Audit readiness is not about perfection; it is about documentation, alignment and proactive review.

With the right structure in place, ATO engagement becomes manageable rather than stressful.

If you are a business owner on the Gold Coast or in Tweed Heads and would like a proactive compliance review, our team can assess your reporting systems, strengthen your tax compliance processes and ensure you remain audit-ready year-round.

Speak with our experienced business tax accountants today to ensure your business stays compliant, audit-ready and positioned for long-term financial stability.