Show download pdf controls
  • Top 100 GST assurance program

    This program seeks greater assurance that top 100 taxpayers are reporting the right amount of goods and services tax (GST). This supports and expands on existing compliance approaches, including justified trust reviews for income tax, further enhancing confidence in these taxpayers.

    Under the program, GST and income tax teams work collaboratively to deliver justified trust assurance reviews across both taxes. The extent to which the assurance reviews are integrated varies. It depends on:

    • the overall assurance rating in the most recent income tax assurance review
    • whether our current engagement approach is seeking to obtain, refresh or maintain justified trust with the taxpayer.

    See also:

    On this page:

    How we tailor our approach

    We gain assurance or identify areas of GST risk by engaging with the taxpayer through a 12-month GST assurance review.

    We will notify the taxpayer before we commence a review and provide time for them to consider making a voluntary disclosure of any tax shortfalls.

    During a review we apply our justified trust methodology and tailor our compliance activities to the taxpayer's circumstances, including:

    • the overall GST performance
    • the type and size of business activities
    • the tax control framework for GST purposes
    • our understanding from prior engagements including income tax assurance reviews.

    In a GST assurance review we look for evidence that:

    • GST controls within your tax control framework exist (Stage 1), are designed effectively (Stage 2), and are operating in practice (Stage 3). This includes the design of business systems to create, capture and report transactions correctly for GST purposes
    • none of the GST risks we have flagged to the market are present
    • the GST outcomes of atypical, new or large transactions are appropriate
    • we can understand and explain the various streams of economic activity and how they are treated for GST, which will include applying the GST analytical tool (GAT) (other than for taxpayers with predominantly input taxed supplies).

    A GST assurance review will generally focus on the last complete financial year.

    We also undertake data and transaction testing on three consecutive BAS periods within the financial year of review, to determine whether GST outcomes are appropriate.

    When reviewing your tax control framework for GST purposes, we apply the GST Governance, Data Testing and Transaction Testing Guide. We consider three GST controls (board-level control 4, managerial control 4 and managerial control 6) to be fundamental. The design of these controls directly influences the likelihood that the right amount of GST is reported.

    The fundamental controls are:

    1. Periodic internal controls testing (BLC4 – see below)
    2. Data controls (MLC4)
    3. Your documented GST control framework (MLC6).

    These controls, as well as the other five common controls across income tax and GST forming our areas of focus, will be reviewed.

    Find out about:

    Board-level control (BLC) 4: Periodic internal controls testing

    To attain a Stage 2 rating for this control, your testing needs to be:

    • documented
    • approved
    • independent.

    Regarding testing frequency and scope, we require a periodic (three- to five-year) rotating testing plan. This should cover all the controls, including any common controls with income tax (BLC3, MLC 1, 3, 4, 6, 7).

    These core requirements are consistent with our income tax approach.

    In addition, you should provide a sufficient level of evidence about:

    • who is conducting the testing (independent reviewer), and
    • the testing methodology (refer to section 4.3.2 of the GST Governance, Data Testing and Transaction Testing Guide for details).  

    Our view of a best practice (optimal) periodic controls testing program is as follows.

    • MLC4 and MLC6 should be tested regularly for GST, given the importance of these controls for accurate GST reporting, and that there are 12 monthly BAS returns annually. We state in the GST Governance, Data Testing and Transaction Testing Guide that the test frequency is ideally annually, but this is not a core requirement.
    • MLC4 and MLC6 to be front loaded in the testing plan (ideally within the first two years).
    • MLC7 is a common control, but likely to require some intensity of review for GST separately to income tax. This is because the procedures to explain significant differences between accounting figures and the BAS / income tax return are designed differently and operate separately.
    • The frequency is to be determined by the independent reviewer, subject to the principles set out in the GST Governance, Data Testing and Transaction Testing Guide.

    Once each control has been tested, the independent reviewer should consider the following in determining the timing of re-testing:

    • the outcome of that testing including the extent of any remediation action required
    • changes in business/reporting/accounting systems
    • significant business acquisitions/disposals
    • changes in the taxpayer’s tax profile
    • changes in design of governance controls or control owners.

    Once it has been established that the framework is designed and operating effectively and tested successfully (that is, post the initial testing), we would expect that all controls be retested within a rolling three- to five-year period. Best practice is every three years.

    We would also expect controls to be retested where there have been any material changes to the controls – for example, new enterprise resource planning systems, new subsystems, or business structure changes. 

    How to prepare

    The GST Governance, Data Testing and Transaction Testing Guide contains detailed guidance on how the justified trust methodology is applied to help conduct a self-review of your tax control framework for GST purposes. This guidance also explains how to undertake data and transaction testing to ensure your business systems are creating, capturing and correctly reporting GST.

    You should review your GST systems and records to check you have not made any mistakes before the GST assurance review, and let us know if you wish to make any voluntary disclosures.

    For a copy of the GAT Guide, Top 100 GAT example and method statement we use to complete our GAT calculations, email or

    What to expect following a review

    Following a top 100 GST assurance review we will share our findings with you, including:

    • discussing the areas where we have assurance you reported the right amount of GST
    • any identified GST risks.

    We may recommend specific actions to gain greater assurance in particular areas. We will follow up on these recommendations as part of the annual compliance arrangement (ACA) and pre-lodgement compliance review (PCR) processes.

    If we identify concerns or areas of GST risk, we will work with you to address these issues and gain greater assurance. There may be circumstances where we will then undertake further compliance activity, like an audit.

    See also:

    More information

    To learn more about the top 100 GST assurance program, email us at

    We welcome feedback as we continue to integrate our approaches for justified trust across income tax and GST.

    Last modified: 03 May 2021QC 60473