ATO Audit Record-Keeping: What Melbourne Businesses Must Have Ready

An ATO audit letter arriving at your Collingwood studio or Docklands office is enough to make any business owner's stomach drop. The good news: audits are rarely about catching you out. They're about verifying that what you've claimed matches what actually happened. If your records are organised, an audit is a paperwork exercise. If they're not, it's a stressful, expensive one.

Why Melbourne Businesses Get Reviewed

The ATO runs a data-matching program that cross-references your BAS and tax return figures against banks, Single Touch Payroll (STP) reports, rental bond authorities, and platforms like Uber, Airbnb and Deliveroo. Common review triggers we see across Melbourne clients include:

• Cash-heavy trades and hospitality in the CBD, Fitzroy and South Yarra reporting turnover below industry benchmarks
• GST credit claims that spike relative to reported sales
• Repeated late or amended BAS lodgements, which flag your file for closer attention
• Work-related expense claims that sit well above ATO benchmarks for your industry
• Superannuation guarantee (SG) shortfalls picked up through STP and SG charge data

None of these automatically mean you've done something wrong. But if your records can't back up the numbers, the ATO will assume the worst and adjust your assessment accordingly.

The Legal Retention Period

Section 262A of the Income Tax Assessment Act 1936 (ITAA 1936), along with related provisions in the ITAA 1997 and the GST Act 1999, sets the baseline: keep records for five years from the date you prepared or obtained them, or five years from when you lodged the return they relate to — whichever is later. There are important exceptions:

• Depreciating assets and capital gains: keep records for five years after you dispose of the asset, not five years from purchase
• Superannuation guarantee records: five years, and the ATO can request them at any point during that window without warning
• Employee records under the Fair Work Act 2009: a separate seven-year requirement applies for time and wages records — see fairwork.gov.au for details

If your Melbourne business is under review for a prior year, "we didn't keep that" is not a defence the ATO accepts.

The Core Audit Record Checklist

For a typical income tax or GST review, the ATO expects to see:

• Tax invoices for every purchase over $82.50 (GST-inclusive) where a GST credit was claimed
• Bank and credit card statements covering the full period under review
• BAS lodgement records and the reconciliation working papers behind each figure
• Motor vehicle logbooks if you've claimed vehicle expenses using the logbook method
• Contracts and invoices for major income and expense items, including trade contracts common in Melbourne's construction and fit-out sector
• Stocktake records for businesses carrying inventory, such as retailers in Chapel Street or Bridge Road
• Loan agreements and details of any related-party or director loan accounts

A missing invoice here or there is manageable. A pattern of missing substantiation across a whole expense category is what turns a routine review into a full audit with penalties attached.

Payroll and Super Records

Payroll is one of the most heavily scrutinised areas because Single Touch Payroll gives the ATO real-time visibility into what you report versus what you pay. Records you must retain include:

• Employment contracts and Fair Work Information Statements for every employee
• Time and wages records — hours worked, pay rates, leave accrued and taken, kept for seven years under the Fair Work Regulations 2009
• Superannuation guarantee contribution records proving payments were made by the quarterly due dates under the Superannuation Guarantee (Administration) Act 1992
• STP finalisation records matching your Xero payroll reports to what was submitted to the ATO

Missed SG payments trigger the superannuation guarantee charge (SGC), which is not tax-deductible and includes nominal interest plus an administration fee — a costly outcome that's entirely avoidable with a proper payroll calendar.

Digital Records and Xero

You don't need a filing cabinet full of paper. The ATO explicitly accepts electronic records, including scanned receipts and photos of tax invoices, provided they're a true and clear copy of the original and retrievable in a readable format when requested. This is where Xero earns its keep for Melbourne small businesses:

• Attach source documents directly to each bank transaction so the invoice sits with the entry it supports
• Use Hubdoc or Xero's built-in capture to photograph receipts on the spot rather than losing them in a glovebox or apron pocket
• Run monthly reconciliations so discrepancies are caught within weeks, not discovered years later during a review
• Keep a locked audit trail — Xero's transaction history shows who entered and edited each record, which supports your position if the ATO questions timing

Digital record-keeping done properly is faster to search than any filing cabinet, and it's exactly what an ATO auditor wants to see when they ask for evidence.

What Happens During an Audit

ATO reviews typically start with a written request for specific documents relating to a period or issue. You'll usually get a reasonable window to respond — often 28 days. From there:

• The ATO assesses whether your records substantiate the figures in your BAS or tax return
• If gaps are found, they may issue an amended assessment, adding tax, the general interest charge (GIC), and administrative penalties under Schedule 1 of the Taxation Administration Act 1953
• Penalties scale with culpability — from a lower rate for a reasonably arguable position, up to 75% of the shortfall for reckless or intentional disregard of the law
• You have objection and review rights if you disagree with the outcome, but the burden of proof sits with you, not the ATO

This is why organisation matters more than perfection. A business with 95% of records in order and a clear explanation for gaps fares far better than one that scrambles to reconstruct everything after the fact.

Getting Audit-Ready Now

You don't need to wait for a letter from the ATO to fix your record-keeping. Start with three things this month: attach source documents to every Xero transaction going forward, run a five-year retention check on major purchases and disposals, and confirm your SG payments actually landed by their quarterly due dates. If your business has been running loose for a while, a registered BAS agent can help reconstruct and organise historical records before they ever need to be produced under pressure. Good record-keeping isn't about fearing the ATO — it's about knowing your numbers are true, whether anyone ever asks to see them or not.