The ATO Already Knows Your Clients' Numbers. What It Wants Now Is Your File.

The review now starts with their data, not your working papers

Over ten days in August 2026, four separate stories crossed the Australian trade and legal press. Read together, they describe the same shift: the regulator no longer arrives asking whether the work was done.‍

Instead, the regulator now arrives with its own version of the numbers. What it wants is for the firm to explain them.

The clearest example is payments data.

Through the Taxable Payments Reporting System, the ATO had visibility of more than $451 billion in gross payments from almost 177,000 businesses to almost 1.3 million contractors in 2023-24.

It estimates more than $1 billion in contractor income was left off returns this year. Data matching means your client's return is checked against what has already been reported about them, before anyone picks up the phone.

"Leaving income out of your tax return doesn't make it invisible to the ATO." - Tony Goding, ATO assistant commissioner

Which changes what a review actually is. It is no longer a request for your numbers. It is a request for the story behind a number they already hold.

When your client's records are thin, the law assumes the worst

Now follow that logic into the hardest corner of advisory work: a client company in trouble.

Under section 588E(4) of the Corporations Act, a company that fails to keep or retain adequate financial records is presumed to have been insolvent for the deficient period.

The director carries the burden of disproving it, and the courts require the fullest and best evidence to do so. Bare assertions from the director will not be enough.

Sit with what that means for the accountant advising them:

A gap in the records is not treated as a gap. It is treated as proof against your client, and the only thing that can push back is the file that was kept while the work happened.

The same posture runs through AFSA's latest regulatory statement: of 278 insolvency proposals it reviewed in 2025-26, 46 were escalated and 24 needed supplementary reports before creditors could make an informed decision.‍

Reporting that is "unclear, incomplete or inaccurate" is now a named harm.

One client's audit can now land on your practice

The sharpest of the four stories is a letter. Accountants Daily reported an ATO audit outcome letter, sent to a tax agent about their clients' returns, that closed with a sentence agents have not seen before:

"As a result of our findings, we'll be referring your practice to the Tax Practitioners' Board."

Vincent Licciardi, a partner at HWL Ebsworth, said he had not seen such an overt letter, and his practical advice to agents is a documentation instruction: explain your position at the time you lodge, not when the letter arrives two years later.

The exposure has stopped ending at the client. The quality of the file behind a lodgement is now a professional risk carried by the practice that lodged it.

The question to ask of any client file: what can it produce in an hour?

Most firms already do the thinking well. The vulnerable part is where the thinking lives.

• The client confirmed a treatment on a February phone call... and the note is in someone's notebook.
• The director approved the accounts... in an email that sits in one preparer's inbox.
• The final working paper is one of three files... named final, final v2 and final v2 AMENDED.

A file that exists as someone's recollection of a phone call is not a file.

The practical test is retrieval.

For any client, within the hour, could your team produce: the position and reasoning as recorded at lodgement, the client's confirmation captured against their record, each approval timestamped with the exact version approved, and the version history intact?

If yes, a review is an exchange of documents.

If no, it is a fortnight of archaeology done under the regulator's clock.

The firms that cope make the file build itself

Nobody passes that one-hour test on discipline alone.

Filing effort collapses exactly when volume peaks – at your busiest moment – which is why the firms that cope are the ones where the evidence is a by-product of doing the work, not a separate job done afterwards.

You can see the difference at compliance volume:

‍Cantor Carnevale, an Australian firm running 400 to 600 BAS and tax returns a year, used to move every outgoing document through three separate steps – up to three minutes per document, before it reached the client, and the status of a sent document was anyone's guess.

"Before, we had more systems and more clicks just to get a document out the door." Laura Carnevale, director and principal, Cantor Carnevale

Collapsing those steps into one flow, where the document travels from preparation to signature and files itself against the client, did not just save the minutes.

It meant the evidence trail existed the moment each return went out, which means the day the ATO asks, the file is already the answer.

If your practice runs on Access Practice Management, the spine already exists

Here is the encouraging part for firms on Access Practice Management: the hardest ingredient of a review-ready file is a clean, single client structure, and your practice already maintains one.

What most APM firms are missing is not organisation. It is the evidence layer attached to it, so documents, emails, approvals and signatures build against those same client records automatically.

That layer is what Workiro's integration with Access Practice Management adds, and none of it asks your team to work differently. To be clear about what it does and does not do: it will not prevent a review. It decides what the review finds.

Dave Burke leads Workiro's team in Australia and New Zealand. Workiro is document management for accounting and professional-services firms, and it connects directly to Access Practice Management, so the complete client file builds against the Access records your practice already keeps. To see what that looks like on one of your own clients, book a walkthrough with his team.