The ATO’s compliance activity for Australian businesses has never been more sophisticated. Between real-time Single Touch Payroll reporting, industry benchmarking, and data matching with over 30 external sources, the window for undetected bookkeeping errors — intentional or otherwise — is narrowing every year. This guide covers the most common ATO red flags that trigger audits and reviews for Australian small and medium businesses in 2026, what the ATO is looking for, and how correct bookkeeping and payroll compliance practices protect your business from scrutiny.
Why ATO Compliance Is More Important Than Ever in 2026
ATO compliance for Australian businesses in 2026 is not just about avoiding audits — it is about building a financially clean and credible business. The ATO has invested heavily in technology that cross-references your lodged figures against real-time data streams, industry averages, and third-party data matching. An honest bookkeeping error and deliberate tax avoidance look the same to an automated compliance system. The safest position is a business whose records are so clean and well-documented that any ATO inquiry becomes a non-event rather than a crisis. The ATO’s published compliance focus areas make it clear where their attention is directed in the current year.
How the ATO Monitors Australian Businesses
The ATO receives data from a wide range of sources and cross-references it against what Australian businesses report. Key data sources include: banks (via the Taxable Payments Reporting System), state revenue offices (payroll tax and stamp duty), ASIC (company and director records), sharing economy platforms (Airbnb, Uber, Airtasker), online marketplaces (eBay, Etsy, Amazon), share registries, and property title offices. All of this is matched against your ATO lodgements — your BAS, income tax return, and Single Touch Payroll data — to identify discrepancies. This is not a manual process: it is automated and runs continuously.
The Most Common ATO Red Flags for Small Businesses
Based on the ATO’s published guidance and the experience of our Chartered Accountants at Verus, these are the most common ATO red flags that trigger reviews and audits for Australian small businesses:
- Income inconsistent with industry benchmarks. If your reported revenue or expense ratios fall significantly outside the ATO’s published benchmarks for your industry, your return is more likely to be flagged for review.
- High cash income with minimal documentation. Businesses in cash-heavy industries (hospitality, building, cleaning) are a persistent ATO focus area. If a large proportion of your income is cash-based with no supporting records, you are at higher audit risk.
- BAS figures that don’t reconcile with the income tax return. If the revenue you report on your quarterly BAS does not match the revenue in your annual income tax return, the ATO’s systems will flag the discrepancy automatically.
- Late or inconsistent lodgements. Businesses that repeatedly lodge BAS or tax returns late are more likely to be selected for compliance activity. On-time lodgement is itself a compliance signal.
- Large or unusual deductions relative to income. Claiming motor vehicle expenses at 100%, large entertainment deductions, or home office costs well in excess of industry norms will attract scrutiny.
- Lifestyle indicators inconsistent with reported income. The ATO’s data matching includes property purchases, travel, and luxury goods. A director reporting a modest salary while living in a $3M home is a significant inconsistency.
- Unpaid or late superannuation. The ATO receives STP data in real time. Businesses whose STP data shows super obligations not being met will be identified quickly.
ATO Small Business Benchmarks: What They Are and Why They Matter
The ATO publishes Small Business Benchmarks — financial ratio ranges (cost of goods to sales, labour to sales, rent to sales) for over 100 industry types. These benchmarks represent the typical financial profile of businesses in each sector. If your business’s ratios fall significantly outside these ranges, you are flagged as a potential outlier. This does not automatically mean something is wrong — your business may have a legitimate reason — but it does increase your audit probability.
What to do
Before lodging your annual income tax return, ask your accountant to check your key expense ratios against the ATO’s benchmarks for your industry. If you are an outlier, document the reason clearly. An accountant who can explain the discrepancy with supporting records reduces audit risk significantly.
Single Touch Payroll (STP) Compliance
Single Touch Payroll (STP) Phase 2 is mandatory for all Australian employers and represents the ATO’s most significant bookkeeping compliance advance in a decade. Every time you run payroll, your software reports wages, PAYG withholding, and superannuation directly to the ATO in real time. The implications are significant:
- Unpaid or late super is visible to the ATO almost immediately.
- Incorrect PAYG withholding rates are identified at payroll time, not at EOFY.
- Employee income statements are pre-filled by the ATO from STP data — discrepancies between your records and ATO pre-fills generate compliance flags automatically.
- Phase 2 adds more granular reporting — disaggregated salary, allowances, and leave types must be reported separately. This added complexity is a common source of STP compliance errors for businesses that haven’t updated their payroll setup.
Our bookkeeping and payroll team manages STP compliance for clients across a range of industries — ensuring your payroll is set up correctly for Phase 2 and your super obligations are met on time every quarter.
BAS Lodgement: Deadlines and Common Errors
BAS lodgement is one of the highest-volume ATO compliance obligations for Australian businesses. Most small businesses lodge quarterly. Due dates are 28 days after the end of each quarter (25 November for the September quarter). Common BAS errors that create ATO red flags:
- Claiming GST credits on purchases that are not GST-inclusive (e.g. wages, PAYG withholding).
- Reporting gross sales including GST in the W1 (total wages) field rather than in the G1 (GST sales) field.
- Claiming input tax credits on private or non-business expenses.
- BAS revenue not matching the income in your Xero or MYOB profit and loss report.
- Lodging but not paying — an unpaid BAS with a confirmed debt is a fast-track to ATO enforcement activity.
Failure to lodge penalty
The base FTL penalty for a small business is $330 per 28-day period overdue, up to a maximum of $1,650. Interest charges also apply to outstanding amounts. Repeated late lodgement significantly increases your audit risk profile.
Division 7A: The Compliance Trap for Company Directors
Division 7A of the Income Tax Assessment Act 1936 is one of the most misunderstood compliance areas for Australian company directors. It prevents company profits from being distributed to shareholders or associates tax-free. Division 7A applies when a company:
- Pays personal expenses on behalf of a director or shareholder (e.g. private car, holiday, school fees).
- Provides an undocumented or non-compliant loan to a director, shareholder, or their associate.
- Forgives a debt owed by an associate.
When Division 7A applies, the amount is treated as an unfranked dividend — taxable at the recipient’s personal marginal rate with no franking credit offset. Correct bookkeeping that maintains a clear separation between personal and company finances is the most effective way to avoid Division 7A exposure. If you are unsure whether any of your company’s transactions have created Division 7A exposure, our taxation and accounting team can review and advise.
Record-Keeping Requirements: What You Must Keep and for How Long
The ATO requires most business records to be kept for a minimum of five years from the date of lodgement or the date of the transaction, whichever is later. Records that must be kept include: income records (all invoices, receipts, bank statements confirming income), expense records (all supplier invoices and receipts for claimed deductions), payroll records (payslips, timesheets, super contribution confirmations), BAS and tax return workings, and asset registers (purchase invoices, depreciation schedules for all depreciable assets).
Records can be kept electronically — the ATO accepts digital copies provided they are a true and complete representation of the original. Cloud accounting software like Xero or MYOB (see our Xero vs MYOB comparison) stores records automatically as transactions are entered. However, receipts for cash purchases must still be captured and attached.
How to Prevent ATO Problems Before They Start
The best ATO compliance strategy is prevention. Here are the practical steps that protect Australian businesses from compliance issues:
- Reconcile your bank accounts monthly. Every transaction in your bank statement should be matched to a transaction in your accounting software. Unreconciled accounts create gaps the ATO will notice.
- Lodge BAS on time, every time. If you can’t pay, lodge anyway and arrange a payment plan. Late lodgement with no payment is worse than late payment with an on-time lodgement.
- Keep personal and business finances completely separate. Separate bank accounts, separate credit cards, no personal expenses through the business, ever.
- Pay super on time. The ATO sees your STP data in real time. Late or missing super payments are visible immediately.
- Check your expense ratios against ATO benchmarks before lodging your annual return.
- Engage a registered tax agent or BAS agent to prepare and lodge your BAS and tax return. The professional obligation and knowledge base of a registered agent significantly reduces the probability of errors that trigger ATO flags.
Frequently Asked Questions: ATO Red Flags and Bookkeeping Compliance Australia
What triggers an ATO audit for a small business in Australia?
Common triggers: income inconsistent with industry benchmarks, high cash income with little documentation, BAS figures that don’t reconcile with tax return figures, patterns of late lodgement, large deductions relative to revenue, and discrepancies between reported income and lifestyle indicators.
What is Single Touch Payroll (STP) and is it mandatory in Australia?
STP is the ATO’s real-time payroll reporting system — employers report wages, PAYG withholding, and super to the ATO each time they run payroll. STP Phase 2 is mandatory for all employers. Non-compliance attracts penalties.
What records does the ATO require Australian businesses to keep?
Most records must be kept for a minimum of five years: income records, expense receipts, payroll records, BAS and tax return workings, and asset registers. Records must be in English and accessible if requested by the ATO.
How often should a business lodge BAS in Australia?
Most small businesses lodge quarterly — 28 days after the end of each quarter (25 November for the September quarter). Businesses with turnover above $20M lodge monthly. Businesses under the $75,000 GST threshold do not lodge BAS if not registered for GST.
What happens if I lodge my BAS late in Australia?
A failure-to-lodge (FTL) penalty applies: $330 per 28-day period overdue for small businesses, up to $1,650. Interest applies to unpaid amounts. Repeated late lodgement increases audit risk significantly.
What are the ATO’s benchmarks and how do they affect my business?
The ATO publishes Small Business Benchmarks — financial ratio ranges by industry. If your ratios fall significantly outside the benchmark range, you are more likely to be selected for a review. Your accountant can check your figures against the relevant benchmarks before you lodge.
Can I claim personal expenses through my business in Australia?
No. Personal expenses are not tax-deductible. Claiming them as business expenses is one of the most common audit triggers. In a company, personal expenses paid by the company may be treated as a Division 7A loan or unfranked dividend — both with significant tax consequences.
What is Division 7A and why does it matter for bookkeeping?
Division 7A prevents company profits from being distributed to shareholders or associates tax-free. If a company pays personal expenses for a director or provides an undocumented loan, Division 7A may deem this a taxable unfranked dividend. Correct bookkeeping that separates personal and company finances is the primary way to avoid exposure.
What is the ATO’s data matching program?
The ATO receives data from over 30 external sources — banks, state revenue offices, ASIC, Airbnb, Uber, eBay, property title offices — and matches it against your lodged returns and BAS to identify discrepancies. The program is automated and runs continuously.
How can a bookkeeper or accountant help me avoid ATO red flags?
A qualified bookkeeper or Chartered Accountant can ensure correct expense categorisation, reconcile BAS figures to accounting records before lodgement, check expense ratios against ATO benchmarks, ensure STP is set up correctly, and advise on record-keeping. Prevention is significantly cheaper than dealing with an ATO audit.
Worried your bookkeeping might not be ATO-ready?
Our Chartered Accountants and bookkeeping team review your records, fix compliance gaps, and ensure your BAS, payroll, and super obligations are met correctly every time.
Related Articles
© 2026 Verus Accountants and Advisors. This article is general in nature — please seek personalised advice for your situation.