That letter from the Australian Taxation Office sitting in your inbox? It's got your stomach doing the same thing as feedback through a badly wired amp - loud, unsettling, and impossible to ignore. Whether you're a freelance creative, a small business owner in Penrith, or running a growing enterprise across Greater Sydney, correspondence from the ATO tends to land like a dropped drumstick mid-set: disruptive, jarring, and demanding immediate attention.
But here's the thing - not all ATO correspondence signals the same level of scrutiny. There's a significant difference between an ATO review and an ATO audit, and understanding that difference could mean the difference between a minor key adjustment and a full-scale performance review of your financial affairs. This guide breaks it down clearly, so you know exactly what you're dealing with and what your next move should be.
An ATO review - also referred to as a risk review - is the ATO's way of checking whether a specific compliance concern warrants further investigation. Think of it as the ATO tapping you on the shoulder and saying, "Hey, this part of your tax affairs looks a bit off-key. Can you help us understand it?"
The ATO initiates a review when it identifies a potential compliance risk. According to the ATO's official guidance, "Generally, when we identify a compliance risk we will review your tax affairs." The review serves to check for errors, help taxpayers correct them, collect information about particular industries, and determine whether a full audit is necessary.
This broader-scope review involves ongoing dialogue with the taxpayer to assess identified tax risks. It gives the ATO a deeper understanding of how a business operates and how effectively its tax governance processes manage risk. It's the full soundcheck - not just the mic levels, but the entire stage setup.
This is far more targeted, focusing on one or more specific identified risks to minimise disruption to the business. Think of it as the ATO checking one instrument in the band rather than the whole ensemble.
Reviews tend to be narrower in focus and are often handled via correspondence - the ATO might ask for receipts or documentation related to a single claim, such as a work-from-home deduction, a rental property expense, or a specific BAS period. They're generally less formal, with a compliance officer assessing whether your claims are substantiated. Most reviews can close quickly if you provide solid supporting evidence.
An ATO audit is a different beast entirely. It's the ATO's comprehensive, formal investigation of your financial affairs - the equivalent of a full album review rather than a quick listen to one track. According to the ATO's own guidance, "Audits are more comprehensive than risk reviews and involve intensive case examination where material underpayment of income tax, GST or excise is a risk."
While most audits develop from unresolved reviews, the ATO can also proceed directly to audit - bypassing the review stage altogether - where fraud or tax evasion is suspected, where high-risk arrangements or transactions are involved, or where there is a risk that revenue may not be collected.
An audit is far more structured and formalised than a review. The ATO will:
The ATO can also exercise significantly broader formal powers during an audit - including issuing formal notices requiring document production, accessing business premises, and seeking information from third parties such as banks, employers, and business associates.
The ATO endeavours to complete most income tax audits within 18 months, though complex matters - such as those involving Part IVA, external counsel, or transfer pricing - can extend beyond that timeframe.
Here's where the contrast becomes crystal clear. While both are compliance mechanisms, they operate at very different levels of intensity, formality, and consequence. The table below draws on official ATO guidance to compare the two side by side.
| Aspect | ATO Review | ATO Audit |
|---|---|---|
| Intensity | Low to Moderate | High |
| Scope | Single item or specific area | Comprehensive, multiple years |
| Typical Duration | 1–3 months | 6–18 months |
| Case Officer | Compliance officer | Dedicated case officer |
| Formality | Less formal | Highly formal and structured |
| Initial Approach | Seeks information from taxpayer | Formal management plan and initial meeting |
| Information Requirements | Often informal requests | May include formal notices |
| Third-Party Contact | May contact intermediaries if needed | Often contacts third parties |
| Escalation Risk | Medium if ignored | Escalation to legal proceedings possible |
| Outcome | May close or escalate to audit | Final amended assessment, penalties and/or interest |
The most critical takeaway from this comparison: a review can escalate to an audit. If the ATO isn't satisfied with your responses, or if new concerns emerge from the information you provide, the review will move up the compliance ladder. Ignoring or poorly responding to a review is arguably the single biggest mistake a taxpayer can make.
The ATO doesn't select taxpayers for review or audit at random. It uses sophisticated data-matching and industry benchmarking tools to identify compliance risks. In 2024–25 alone, the ATO raised $4.11 billion in total income tax liabilities through compliance activities - comprising $2.62 billion in tax liabilities, $331 million in interest, and $1.16 billion in penalties. Another $385 million in GST liabilities was also raised. These aren't small numbers.
The ATO's data-matching capabilities are extensive. It cross-references information from banks, payment platforms (including Square, Stripe, and PayPal), Single Touch Payroll (STP) reporting, and property registries. Common risk flags that can attract attention include:
For creative professionals and small businesses - think studios, agencies, freelancers, and production companies - the ATO pays particular attention to home office claims, equipment deductions, professional development expenses, and the classification of workers as contractors versus employees.
According to ATO research, the net small business income tax gap is estimated at 11.5%, or approximately $11.1 billion per annum, with around 4% of small businesses deliberately engaging in shadow economy behaviour. This concentration of non-compliance means the ATO's focus on small business is both sustained and data-driven.
If a review or audit uncovers underpaid tax, you won't just be asked to pay the shortfall. The ATO applies two types of charges on top of the primary tax liability:
Shortfall Interest Charge (SIC) applies where a tax assessment is amended to increase payable tax. It compounds daily and is backdated to when the original assessment was due.
General Interest Charge (GIC) applies where tax isn't paid by the due date, also calculated on a daily compounding basis. Notably, from 1 July 2025, GIC can no longer be claimed as a tax deduction - regardless of which income year the debt relates to.
Beyond interest charges, penalties are imposed based on the taxpayer's behaviour. The more culpable the conduct, the steeper the penalty:
| Behaviour | Base Penalty Amount (BPA) | With Early Voluntary Disclosure |
|---|---|---|
| Intentional disregard for the law | 75% of shortfall | 15% of shortfall |
| Recklessness | 50% of shortfall | 10% of shortfall |
| Failure to take reasonable care | 25% of shortfall | 5% of shortfall |
| Case not reasonably arguable | 25% of shortfall | 5% of shortfall |
The contrast between the "intentional disregard" column and the "voluntary disclosure" column tells a powerful story: early transparency with the ATO isn't just good practice - it's financially strategic.
Voluntary disclosure is one of the most important - and underutilised - tools available to Australian taxpayers navigating compliance concerns. It's an acknowledgment of a mistake or omission in a lodgement: income not disclosed, deductions incorrectly claimed, or credits not legitimately entitled to.
The timing of your voluntary disclosure dramatically impacts the outcome:
Before the ATO notifies you of a review or audit - this is when the maximum penalty reduction is available. If you realise you've hit a wrong note in your tax affairs, coming forward before the ATO comes knocking delivers the greatest benefit.
During a risk review - a voluntary disclosure made at this stage still provides a meaningful penalty reduction, particularly where it saves the Commissioner significant time or resources.
After audit notification - while still possible, penalty reduction is more limited and requires demonstrating genuine time or resource savings for the ATO.
Voluntary disclosure must be made in an approved form. During a review or audit, this means using the formal Voluntary Disclosure Form (NAT 75342) or making disclosure via phone or face-to-face with your tax officer. The disclosure must include sufficient detail for the ATO to assess the error without requesting further information.
Understanding the difference between an ATO review and an ATO audit isn't just academic knowledge - it's a practical toolkit for protecting your business and your livelihood. A review is a targeted, relatively contained process that can resolve quickly with the right response. An audit is a serious, resource-intensive investigation that demands professional support and meticulous documentation.
The taxpayers who navigate these processes most effectively share a common approach: they maintain clean, contemporaneous records; they understand where their numbers sit relative to industry benchmarks; and they don't wait for the ATO to make the first move when something doesn't look right in their accounts.
Whether you're a graphic designer in Penrith, a music producer in Western Sydney, or a creative agency scaling across New South Wales, keeping your tax affairs in tune isn't optional - it's fundamental to building a business that lasts.
Ready to crank your finances up to 11? Let's chat about how we can amplify your profits and simplify your paperwork - contact us today.
Sign up to receive relevant advice for your business.
