TPB Risk management

Our risk management framework aligns with our legal responsibilities under the PGPA Act and the Commonwealth Risk Management Policy. We take a balanced approach to risk appetite, focusing on the most significant risks while avoiding unnecessary red tape for tax practitioners and ensuring resource requirements remain proportionate.

Recognising our operational independence, we operate within the ATO’s Risk Framework, ensuring alignment and improved cooperation in managing enterprise or higher priority risks that are shared across the tax profession and tax system. This cooperative risk management approach recognises controls or mitigation strategies can be mutually beneficial, and addresses community expectations and requirements regarding delivery of efficient, effective, economic and ethical public services.

Risks and management strategies
Enterprise risk	Risk description	Risk management strategy
Tax and superannuation performance adversely influenced by tax practitioners	There is a risk that tax practitioners adversely influence the tax system because regulation is ineffective, including lowered standards and tax practitioners operating outside the system or outside their professional and ethical obligations. This would result in reduced performance of the tax and superannuation systems and diminished community confidence in the tax profession, the tax system, the ATO, and the TPB.	We are managing this risk through supervision and compliance that is fair and proportionate to risks. We use analytics and intelligence to assess risks in our regulated population and a range of compliance treatment responses including preventative early warning messaging, nudges, enquiries, investigations, sanctions and litigation. In 2026–27, we will encourage a level playing field, cooperation and transparency and supporting voluntary compliance by providing guidance and publishing our compliance priorities.
Registration integrity	There is a risk that the TPB’s registration process lacks integrity because individuals and entities are registered despite not meeting eligibility requirements such as education, experience, or ethical standards. This adversely impacts tax and superannuation outcomes for clients and the community, creates an unlevel playing field, and undermines confidence in the TPB, the tax system, and the profession. There is also a risk misconduct is not identified or addressed through timely regulatory action against unregistered preparers and unregistered advisers.	We are managing this risk through improvements to our support over the tax practitioner lifecycle, including proof of identity, risk assessments (disqualified entities, significant breach reports, personal tax obligations), an annual renewal process, ATO coordination in fraud detection and our compliance improvements.
Collaboration with stakeholders, other government agencies, and partners	There is a risk that the TPB does not collaborate effectively with stakeholders, other government agencies, and partners. This would result in missed opportunities to support the tax practitioner profession and positively influence and shape the tax practitioner regulatory environment, including areas of law reform, guidance and compliance strategies.	We are managing this risk by providing advice to the Treasury and Government and working closely with the ATO. Our views on policy, law, guidance and administration are shaped by consultation and collaboration with stakeholders, especially the community, tax profession, professional associations and education providers.
Client services	There is a risk that the TPB does not deliver efficient and effective services and support to tax practitioners. This could result in missed opportunities to strengthen the tax system, increased costs, unnecessary regulatory burdens, and confusion about regulatory obligations.	We are managing this risk by understanding tax practitioner needs and their professional 'lifecycle' to maximise our support with community awareness, registration standards (education, experience, ethics), practical guidance products, continuing professional education, appropriate supervision and leveraged compliance strategies.
Technology and systems	There is a risk that the TPB is unable to develop and maintain reliable, secure, and contemporary technology systems. This includes risks relating to cybersecurity, the use of AI, and the reliability and availability of systems. This could result in reduced service delivery capability, security vulnerabilities, and disruption to TPB operations.	We are managing this risk by understanding the technological needs of our staff, tax practitioners and the public and prioritising investment in technology to service those needs. We will respond to system incidents in an effective and timely manner and make enhancements.
Data use and governance	There is a risk that the TPB does not use or manage data lawfully and ethically. This could result from weaknesses in data governance, management, or oversight. Weaknesses in these areas could lead to missed opportunities to harness the benefits of data or unlawful or unethical data use, causing material reputational damage to the TPB and the APS.	We are managing this risk by prioritising strong data governance and assurance to ensure data is used lawfully and transparently. We support responsible data use to ensure data is secure, accurate and used in conformance with law.
Workforce, capability and culture	There is a risk that the size and skill set of the TPB’s workforce do not meet the demands of its regulatory role. This would negatively impact staff health, wellbeing and organisational culture, reduce the performance of the TPB, and undermine trust in the TPB.	We manage this risk through a targeted People and Culture strategy that outlines clear areas of focus and goals to build workforce capability, support wellbeing, and shape our organisational culture. This approach is further supported by annual People and Culture Strategy implementation plans that reviews and sets where efforts will be made. The plan is supported by leveraging the exemplary systems and processes put in place by the ATO to manage regulatory requirements as well as uphold expected standards of behaviour and organisational performance. This process aims to ensure strong controls over workforce planning, recruitment, training, and wellbeing programs.