ato logo
Search Suggestion:

Risk review and audit processes

Generally, when we identify a compliance risk we will review your tax affairs which may result in an audit.

Last updated 23 October 2018

Generally, when we identify a compliance risk we will review your tax affairs. We may decide to conduct an audit if we identify areas of concern that need closer examination.

We're guided by the facts and won't necessarily follow every step of the typical tax assurance process. For example, during a risk review you may make a voluntary disclosure that resolves the issue.

We review all large businesses at a high level using our risk filtering processes. We use a cooperative compliance approach to identify and assess risks as they arise.

In some instances, the nature of transactions and our knowledge of the compliance risks mean that we will proceed directly to an audit after we analyse the risks. This may happen if we consider your business or particular arrangement is higher risk, involves carrying forward a previous audit or is time sensitive, or we think there may be a risk that revenue may not be able to be collected.

Risk review

When we conduct a risk review we will determine if there are any compliance issues that need a more in-depth investigation and response. Risk reviews give us an opportunity to resolve our concerns about compliance issues and in most cases mean we do not need to conduct an audit.

We focus on understanding your business context and environment and the processes you have in place to manage and oversee tax risk. Generally we will ask for information from you first, but we may also seek information from third parties (such as your intermediaries) if we need to.

Comprehensive risk review

A comprehensive risk review has a broad scope and involves ongoing dialogue and information gathering to assess and treat identified tax risks.

This allows us to develop an in-depth understanding of your business operations and how effectively your tax governance processes identify and deal with tax risks in your industry and business operations.

Specific review

A specific review occurs when we examine one or more specific risks we have identified. We concentrate on the identified risks to minimise the impact on your business.


At the end of a risk review we will discuss the outcomes with you, advising if we are satisfied with your compliance or consider further action is needed.

If the risks are not deemed to be significant, we would usually not proceed further unless there were other concerns raised.

If an audit is necessary, we will keep you informed about our plans. Depending on the nature of the risks, the discussions may also cover possible mitigation strategies, which you might choose to apply to reduce the likelihood of an audit, or to mitigate any potentially adverse effects.

See also:


Audits are more comprehensive than risk reviews and involve intensive case examination where material underpayment of income tax, GST or excise is a risk. They provide a means for us to:

  • check the appropriate tax has been paid in cases where we identified risk – including gathering evidence or proof as needed
  • understand the causes of non-compliance and address them for the past and the future
  • identify areas where the law may need clarification or where our processes can be improved.

An audit typically follows a risk review and will test the review's conclusions. Refining the scope of the audit may include (but is not limited to):

  • eliminating issues
  • adding new issues
  • determining which income tax years will be the subject of the audit.

If we identify additional risks during the audit, we may broaden its scope. This requires approval from a panel of senior officers, and the decision will be communicated to the taxpayer.

In most cases, an audit involves agreeing on a plan to collect detailed information and undertake analysis. During the information collection phase, auditors will have more contact with you and may spend time at your premises examining documents and processes and discussing issues with your key personnel. After the audit, we will provide you with our view.

We endeavour to complete most income tax audits within 18 months. The timeframe and scope of each audit is determined following discussions with you at the beginning of the case. This depends on the number of specific issues, level of complexity and other circumstances we encounter.

Complex cases may extend beyond the 18 month timeframe, such as those requiring consideration of Part IVA, input from external Counsel and tax treaty partners on transfer pricing matters. In those cases we will keep you informed of the progress of the case and expected completion date.

Each case will have a case manager assigned to it to ensure it's completed within the agreed timeframe. We seek to gather information in an informal approach; however where we experience unreasonable delays in our information gathering process we will then use formal powers.

Next step: