What Happens in an ATO Review or Audit: Process, Triggers and How to Respond

Updated 26 July 2026

The ATO already has the data

Modern ATO compliance is data matching first, questions second. Before any letter arrives, the ATO has typically matched your return against third-party data:

• Platform income. Under the sharing economy reporting regime, digital platforms report seller and creator income directly to the ATO. Ride-sourcing and short-stay accommodation platforms have reported since 1 July 2023, and the regime extended to the rest, including content platforms and marketplaces, from 1 July 2024.
• Payment processors. PayPal, Stripe and merchant facilities report transaction data.
• Crypto. The ATO's crypto data-matching program covers exchange records from 2014-15 onwards; see our crypto tax guide for how disposals are matched.
• Banks, employers, health funds, share registries and property transactions, all feeding pre-fill and the risk engines.

When your lodged return disagrees with that dataset, the discrepancy is flagged by machine. A human then decides whether it becomes a letter.

Review vs audit: they are different things

A review is the ATO checking whether there is a problem. It is usually a letter or phone call identifying a specific issue (undeclared platform income, a large deduction, a GST mismatch) with a request for information and a due date. Reviews are the ATO's preferred tool; most compliance activity stops here. Cooperate, explain, correct if needed, and the file typically closes.

An audit is a formal examination after the ATO believes something is wrong. Notification is in writing, the scope is broader, information requests are formal, and the ATO can use its access and information-gathering powers. Audits routinely expand: an income year becomes several, one entity becomes the group. A review escalates to an audit when responses are incomplete, inconsistent or ignored.

What triggers attention

• Income on the ATO's data feeds that is missing from your return, the single most common trigger
• Deductions out of line with your occupation and income benchmarks
• Business performance well outside small business industry benchmarks, especially cash-heavy industries
• Repeated losses in a business that keeps operating
• Lifestyle and asset data inconsistent with reported income
• GST refunds that spike, or BAS figures that never reconcile to the income tax return
• Late lodgment history; non-lodgers get default assessments, not sympathy
• Tip-offs, which the ATO receives in volume and does act on

The timeline of a typical review

1. The letter. Identifies the issue and the years, requests information, sets a due date, usually 28 days.
2. Your response. Documents, explanations, and if something was wrong, a voluntary disclosure (below). This is the point to involve your accountant, before anything is sent.
3. ATO position. The reviewer either accepts the explanation, proposes an adjustment, or escalates. You will get the proposed adjustment in writing and a chance to respond.
4. Amended assessment. If an adjustment proceeds, an amended assessment issues with the extra tax, shortfall interest charge, and any penalty. Payment is due 21 days after the notice.
5. Your appeal rights. You can object to an amended assessment under the formal objection process, with time limits that depend on your amendment period. Objections are a genuine remedy, not a formality; well-argued objections succeed regularly.

The common review types

Most letters fall into a handful of programs, each with its own rhythm:

• Income matching letters. Platform, bank interest, dividend or crypto data missing from a return. Usually resolved by amendment; the fastest and most automated category.
• Work-related expense reviews. Deductions out of line with occupation benchmarks. Substantiation decides these; see our work expenses guide for what the records need to show.
• Rental property reviews. Interest apportionment after refinancing, repairs versus capital improvements, and holiday home availability are the recurring targets.
• CGT reviews. Property and crypto disposals matched from transfer and exchange data against returns showing no CGT event.
• Employer obligation audits. Super guarantee, PAYG withholding and contractor-versus-employee classification, now sharper under payday super's per-cycle visibility.
• GST integrity checks. Refund verification before payment, and BAS-to-income-tax reconciliation gaps.

What the ATO can formally require

In a review, information requests are technically voluntary, though refusing them is how audits start. In an audit, the ATO holds formal powers: statutory notices compelling you to provide information, attend interviews and produce documents, and access powers to enter premises and inspect records without a warrant. Two protections matter and are routinely under-used: communications with your lawyer can attract legal professional privilege, and certain advice papers prepared by your external accountant are covered by the ATO's accountants' concession, meaning the ATO will generally not compel them except in exceptional circumstances. Which documents fall where is a decision to make with your adviser before producing anything, not after.

Penalties: the actual numbers

Shortfall interest charge applies on top from the original due date, and neither SIC nor GIC incurred from 1 July 2025 is deductible. One more shield worth knowing: safe harbour. Where you gave your registered tax agent complete and accurate information and the error was the agent's, the false-or-misleading-statement penalty can be removed entirely. It is another reason the ATO treats agent-lodged returns differently, and another reason to answer your accountant's questions properly at preparation time.

Voluntary disclosure: the 80% lever

Voluntary disclosure changes the penalty numbers dramatically. Disclose before the ATO notifies you of an examination and the base penalty is generally reduced by 80%. Disclose after notification but early in the process and reductions around 20% are typical. The interest keeps running either way, but the penalty difference on a meaningful shortfall is thousands of dollars, and disclosure heavily influences whether the ATO treats you as careless or as a risk.

How far back can the ATO go?

• Two years for most individuals and small businesses with simple affairs
• Four years for more complex affairs, trusts and larger entities
• Unlimited where the ATO forms the view there was fraud or evasion

Those same periods generally bound your ability to object and amend in your favour, which is why old errors are worth fixing inside the window.

How to respond if the letter arrives

• Do not ignore it. Silence converts reviews into audits and default assessments.
• Do not ring the ATO and improvise. Verbal explanations are recorded and inconsistencies are held against you later.
• Send it to your accountant the day it arrives. Scope, tone and completeness of the first response shape everything after it.
• Gather records before responding: bank statements, platform statements, invoices, logbooks. Gaps are better addressed up front with reasonable reconstructions than discovered mid-audit.
• Ask for more time if you need it. Extensions on review deadlines are routinely granted when requested early.
• If an adjustment is proposed and you disagree, use the objection process. If you agree, negotiate the penalty; remission arguments grounded in conduct and history work.

Your position is stronger than you think

The ATO's own process gives you structured rights at every stage: to respond before adjustment, to object after assessment, to seek penalty and interest remission, and to escalate to the Administrative Review Tribunal or the Federal Court. Most matters never get near that; they close at the review stage because the response was complete, prompt and professional. That is the outcome to engineer.

This article provides general information only, current at the date of publication, and does not constitute personal tax, legal or financial advice. Consider your circumstances or speak with us before acting. Liability limited by a scheme approved under Professional Standards Legislation.