ATO audits follow a deliberate selection process. The Australian Taxation Office uses automated data matching, algorithmic risk scoring, and industry benchmarking to assess every lodgement before a human auditor ever sees it. Selection is driven by data inconsistencies, statistical outliers, and behavioural patterns. Understanding these mechanics is the first step to managing your exposure.
We have spent years on both sides of this process. Our founder, Nitin Saby, worked inside the ATO as a Tax Counsel Network Law Interpretation Specialist and Tax Specialist Executive before becoming a Tax Principal at a top-10 CAANZ firm. What follows is a practitioner’s account of how the system actually operates, drawn from direct experience inside and outside the ATO.
How the ATO Selects Returns for Audit
Most SME owners and sole traders picture an ATO audit as something that happens to other people, or as a random event, like a lightning strike. Neither picture is accurate.
Every single tax return and Business Activity Statement (BAS) lodged in Australia is automatically risk-assessed the moment it enters the ATO’s systems.[1] The process is largely invisible to the person lodging, and that invisibility is precisely why it catches so many people off guard.
The ATO’s selection system rests on four interlocking mechanisms: automated data matching, algorithmic risk scoring, statistical industry benchmarking, and cross-system consistency checks. Each one feeds into the others. A return that clears one gate can still be flagged by another.
Automated Data Matching: The ATO Knows More Than You Declare
The ATO receives financial data from thousands of third-party institutions, banks, digital platforms, state registries, and government agencies, and cross-references that data against what you report.[2]
The process runs automated, near-instantaneous, and comprehensive. By 2026, the data pipelines feeding the ATO’s matching system include:
- Gig economy and digital platforms: Uber, Airbnb, Stayz, eBay, and Etsy all supply direct transaction data to the ATO. Revenue you earn through these platforms is pre-populated into your tax profile before you lodge.[2]
- Banks and financial institutions: Interest income, dividends, and managed fund distributions are reported automatically. If your declared income does not reconcile with your bank data, a discrepancy flag is generated.
- Cryptocurrency exchanges: The ATO runs specialised data-matching protocols capturing disposals, swaps, and capital gains events on crypto exchanges operating in Australia.[1]
- State registries and insurance bodies: Land title offices, rental bond authorities, and vehicle registries report property transactions and luxury asset acquisitions. Buying a property or a prestige vehicle while declaring minimal income is a direct trigger.
When a mismatch appears between what third parties report and what you declare, the system generates a discrepancy flag. That flag feeds into the risk score that determines whether an audit follows.
The Algorithmic Risk Score: Where the Decision Is Made
Once a discrepancy or an unusual entry is identified, the ATO’s analytics engine assigns a risk score to the return.[1] This is where the audit selection decision is effectively made, long before any human auditor is involved.
Low-risk scores typically produce automated “nudge” letters or simple amendment requests. High-risk scores, generated by large recurring gaps, indicators of systemic non-compliance, or patterns consistent with known avoidance behaviour, escalate the return to a case management system for manual review and formal audit.
For founder-led businesses and privately owned groups, the ATO’s risk score draws on patterns across multiple years and across related entities. A single-year anomaly reads differently from a recurring pattern, and the system is calibrated to distinguish between the two.
Industry Benchmarking: When Your Numbers Fall Outside the Norm
The ATO holds decades of data across thousands of occupations and industries. From that data, it establishes statistical limits for what is considered normal within a specific profession or business type.[3]
For individuals, this means your deduction claims are compared against the average for your exact occupation. Claiming $8,000 in vehicle expenses when the benchmark for your profession is $1,200 places your return in the outlier category automatically. The algorithm flags the deduction, and the risk score rises.
For SMEs and sole traders, the benchmarks are more granular. The ATO monitors wages-to-turnover ratios, gross profit margins, and cost-of-goods-sold ratios by industry and business size.[3] Businesses operating outside these norms, particularly in cash-intensive sectors like hospitality, construction, and trades, attract sustained attention.
This is one of the most misunderstood aspects of the selection process. Many small business owners believe their records are clean because they have not done anything wrong. Clean records and benchmark-compliant figures are two different things. You can have every receipt in order and still trigger a review because your gross margin sits 15 percentage points below the industry average for your sector.
Cross-System Consistency: BAS, STP, and Income Tax Must Align
For business entities and sole traders, the ATO tracks internal consistency across different tax obligations.[2] A rapid path to a formal audit is a mismatch between your BAS, your Single Touch Payroll (STP) reporting, and your annual income tax return.
Declaring different total wage expenses on your income tax return than what was reported through payroll is a textbook discrepancy. Reporting GST-exclusive turnover on your BAS that does not reconcile with your declared income is another. The system cross-references these figures automatically, and the gaps it finds are not treated as clerical errors until you demonstrate otherwise.
For privately owned groups operating multiple entities, this consistency check extends across the group. Related-party transactions, intercompany loans, and trust distributions all create additional data points the ATO can reconcile against lodgements across the group structure. Our article on ATO audit review and objection processes explains what happens once the ATO moves from data analysis to formal contact.
Behavioural and Community Triggers: The Human Element
Beyond the automated systems, the ATO receives direct intelligence from human sources, and this intelligence can initiate a targeted audit regardless of what the risk score says.[1]
Superannuation Guarantee complaints: If an employee reports to the ATO that Superannuation Guarantee (SG) contributions have not been paid or have been delayed, the ATO initiates a super review. These reviews frequently escalate into wider audits covering GST, Pay As You Go (PAYG) withholding, and income tax. The SG complaint is the entry point; the broader audit is the consequence.
Tip-offs: The ATO’s tip-off hotline receives tens of thousands of reports annually from former employees, business competitors, and ex-partners.[1] A credible tip-off from someone with inside knowledge of your business operations can trigger a targeted audit that bypasses the standard risk-scoring process entirely. Our audience research confirms this fear is widespread and well-founded, the ATO does act on tip-offs, and it does not require the tip-off to be verified before opening a review.
Lifestyle-to-income mismatches: Reporting minimal taxable income while acquiring investment properties, making overseas trips, or purchasing luxury vehicles creates an immediate asset-to-income risk profile. The ATO cross-references lifestyle indicators against declared income, and a sustained mismatch is treated as a signal of undeclared revenue.
What Happens After the Flag Is Raised
Understanding what triggers an ATO audit is useful. Understanding what happens next is where the stakes get real.
The ATO’s contact sequence typically begins with a review rather than a formal audit. A review is a targeted information request focused on a specific claim or period. If the ATO’s questions are not answered satisfactorily, or if the review uncovers additional concerns, it escalates to a formal audit. A formal audit can extend across multiple years and multiple tax obligations simultaneously.
For company directors, an audit that uncovers unpaid GST or PAYG withholding obligations can lead to Director Penalty Notices (DPNs), which transfer the company’s tax debt to the director personally. Timing is the critical variable: depending on when the ATO issues the DPN and whether lodgments were made on time, the penalty may be remittable or it locks in as a personal liability with no exit. Our detailed guide on Director Penalty Notices covers those timing rules in full.
The six stages of a tax dispute, from initial contact through to objection and appeal, are mapped in our six stages of a tax dispute guide. Knowing where you sit in that sequence determines what options remain open to you.
Reducing Your Audit Risk: What the Data Tells Us
The ATO’s selection system is sophisticated, but it is also legible. The triggers are knowable. The benchmarks are published. The data pipelines are documented. That means audit risk is manageable with the right structure and record-keeping discipline.
For SMEs and sole traders, the practical priorities are:
- Reconcile your BAS, STP, and income tax figures before lodgement. Internal inconsistencies are the most avoidable trigger in the system.
- Understand where your figures sit relative to ATO industry benchmarks. If your gross margin or expense ratios fall outside the published ranges, document the commercial reason before the ATO asks.
- Declare all income from digital platforms. The ATO receives this data directly. Omissions are detected automatically through data-matching, before any auditor is involved.
- Maintain substantiation for every deduction. Receipts, logbooks, and contracts are your defence against a benchmark-based challenge.
- Address SG obligations on time, every time. A single employee complaint can open a review that extends well beyond superannuation.
If you are already under ATO scrutiny, or if you have received a review or audit notice, the window for managing the outcome narrows quickly. Our page on the ATO audit process sets out what to expect and where representation makes the difference.
We work with SME owners, sole traders, high wealth individuals, and privately owned groups who need specialist representation in ATO disputes, audits, and objections. If you have received ATO correspondence or want to assess your current exposure, contact us to discuss your position.
Frequently Asked Questions
Are ATO audits random?
ATO audits are not random. Every lodgement is automatically risk-assessed using data matching, algorithmic risk scoring, and industry benchmarking. Returns are selected for review because they display specific risk patterns, data mismatches, statistical outliers, or cross-system inconsistencies, rather than by chance.
How far back can the ATO audit my tax returns?
For most individuals and SMEs, the ATO can amend assessments up to two years after the original assessment date. For more complex matters, or where the ATO suspects fraud or evasion, the review period extends to four years and has no statutory limit in cases of intentional disregard of the law. The applicable period depends on your entity type and the nature of the issue under review.
What is the difference between an ATO review and an ATO audit?
An ATO review is typically a targeted information request focused on a specific claim, period, or discrepancy. It is the ATO’s first formal contact and may resolve without escalating. An ATO audit is a more comprehensive examination of your financial records across multiple obligations and periods. A review that produces unsatisfactory answers, or that uncovers additional concerns, commonly escalates to a full audit.
Can a tip-off trigger an ATO audit?
A tip-off can initiate a targeted audit directly, bypassing the standard automated risk-scoring process. The ATO operates a dedicated tip-off hotline that receives tens of thousands of reports annually. A credible report from a former employee, business partner, or competitor with inside knowledge of your operations can open a review regardless of your risk score.
What should I do if I receive an ATO audit notice?
Seek specialist representation before responding. The way you respond to the ATO’s initial contact shapes the entire trajectory of the audit. Providing documents without understanding what the ATO is looking for can expand the scope of the review. A tax dispute specialist who understands how the ATO frames and escalates cases can help you respond precisely, protect your position, and avoid inadvertently widening the audit’s scope.
[1] Australian Taxation Office, “How we undertake data matching,” https://www.ato.gov.au/about-ato/commitments-and-reporting/in-detail/privacy-and-information-gathering/how-we-use-data-matching
[2] Nanak Accountants, “ATO Data Matching in 2026: How Businesses Get Flagged,” https://nanakaccountants.com.au/blog/ato-data-matching-2026/
[3] Grow Advisory Group, “What Triggers an ATO Audit? Red Flags for Small Business Owners,” https://growadvisorygroup.com.au/tax/what-triggers-ato-audit/