The ATO does not pick tax returns to review at random. It matches what you lodge against data it already holds from employers, banks, share registries, crypto exchanges, property records, insurers and other government agencies, and it scores each return against what people in your occupation and income band typically claim. A return that does not fit the pattern gets a closer look.
This guide explains what triggers an ATO review or audit in 2026, drawing on the ATO’s own tax-time focus areas announced in April 2026, its published data-matching programs, the difference between a review and an audit, how far back the ATO can go, what the penalties are, and the practical habits that keep you off the list. Every figure is taken from ATO pages and the ATO Legal Database.
If you have already received a letter, go straight to our guide on what to do when you get an ATO audit letter, and for the review process itself see ATO reviewing your tax return. This article is about staying out of that position in the first place.
Key takeaways
- The ATO’s 2026 focus: work-related expenses, working-from-home records and undeclared income – side hustles, cash jobs, interest and rental income – plus a warning about acting on tax “hacks” from social media and AI.
- Data matching is the engine. Programs cover property, rental bonds, crypto, share transactions, online selling, lifestyle assets, novated leases, visas and passenger movements, Medicare entitlement statements and more.
- A review is a targeted check; an audit is an intensive examination. Most individuals never get past a review if they can produce records.
- Time limits: two years for most individuals, four years for those in business and other taxpayers, no limit for fraud or evasion.
- Penalties of 25%, 50% or 75% of the shortfall, plus interest. Voluntary disclosure cuts them sharply.
- Records win reviews. Receipts, a real hours log for working from home, a car logbook and declared income are what the ATO asks for first.
ATO review triggers at a glance
| Trigger | Why it is flagged | How to avoid it |
|---|---|---|
| Deductions out of line with your occupation and income | Risk scoring compares your claims with similar taxpayers | Claim what you spent and can prove – nothing more |
| Working-from-home claim without an hours record | The 70c fixed rate requires actual hours worked from home; estimates are not accepted | Keep a timesheet, roster or diary for the whole year |
| Income missing from pre-fill | Employer, bank, dividend, Centrelink, health fund and crypto data is matched automatically | Wait for pre-fill and add anything the ATO has not received |
| Side hustle, gig or cash income not declared | Sharing economy reporting, online selling and payment data | Declare every source and claim the matching deductions |
| Rental property claims | Property management, rental bond, landlord insurance and loan data-matching; high error rates | Separate repairs from improvements; apportion interest |
| Crypto and share disposals not reported | Crypto asset and share transaction data-matching programs | Report every disposal, even at a loss |
| Lifestyle out of step with income | Lifestyle assets program (vehicles, boats, aircraft, art, thoroughbreds via insurers) | Be able to explain the source of funds |
| Late or inconsistent lodgment (business) | Missed BAS, PAYG withholding and super obligations visible through STP | Lodge and pay on time; fix errors promptly |
Source: ATO media release 27 April 2026; ATO how we use data matching (updated 21 September 2026); ATO fixed rate method. Checked 7 October 2026.
What is the ATO looking at this tax time?
Each year the ATO announces where it will concentrate its checks. For the 2025-26 returns being lodged now, Assistant Commissioner Anita Challen’s release of 27 April 2026 names work-related deductions and expenses, and undeclared income. The ATO’s message on deductions is unchanged: “Work-related expenses must relate to earning your income, you must have spent the money yourself and not have been reimbursed, and you have to be able to support your claim with records such as a receipt, invoice or logbook.” It adds a pointed warning that if you “intentionally claim a little more than you are entitled to”, it will not “fly under the radar”, and that if you have overclaimed in earlier years you should lodge an amendment.
On income, the ATO reminds taxpayers “to declare all sources of income on their tax return including side-hustles, cash jobs, interest and rental income”, noting that each source carries its own deductions. The 2026 release also takes aim at misinformation: tax “hacks” circulating on social media and advice generated by AI tools that “often draws from broad and inconsistent sources”. The ATO’s position is blunt – “Taxpayers remain accountable for ensuring the information they or their agents provide to the ATO is accurate.”
The themes are consistent with earlier years. The 2024 release listed incorrectly claimed work-related expenses, inflated rental property claims and omitted income, and warned that “copying and pasting your working from home claim from last year” would likely earn “a ‘please explain'”. The 2025 release introduced the “pub test” for deductions and singled out ride-sourcing and app-based income. The ATO’s guidance to its own staff on work-related expenses risk shows the same priorities from the agent side.
How the ATO finds returns to review: data matching
The ATO’s data-matching page explains that “matching external data with our own helps us to ensure that people and businesses comply with their tax and super obligations” and detect fraud. The protocols currently published include:
- Property: real property transactions, property management (rental income and expenses from agents), rental bonds, residential investment property loans and landlord insurance.
- Investments: share transactions and crypto assets (data from Australian designated service providers).
- Income and employment: government payments, Single Touch Payroll, income protection insurance, novated leases, officeholder data and Commonwealth electoral roll.
- Gig and online economy: sharing economy accommodation, online selling (marketplace sellers with annual trading of $12,000 or more), specialised payment systems and offshore merchant data.
- Lifestyle and residency: lifestyle assets (insured caravans, motor vehicles, boats, aircraft, fine art and thoroughbreds), motor vehicle registries (vehicles of $10,000 or more), Department of Home Affairs visa and passenger movement data.
- Health and other: private health insurance statements and Medicare entitlement statements (relevant to Medicare levy exemption claims), AUSTRAC transaction reports and the Australian Financial Crimes Exchange.
The practical consequence is that the ATO usually knows about the income before you lodge. A return that leaves out bank interest, a dividend, a rental property or a crypto disposal is flagged automatically, not by a person reading it. The property management program alone was justified by rental expense errors contributing an estimated $1.2 billion to the individuals tax gap in a single year.
The triggers in detail
Work-related expenses that do not fit your profile
The ATO benchmarks claims by occupation and income. A $15,000 deduction claim on a $50,000 salary, a 100% work-use claim on a phone or car, or a sudden jump in claims from one year to the next are the classic flags. The rules have not changed: you must have incurred the expense, it must relate to earning your income, you cannot have been reimbursed, and you must be able to prove it. Our guide to work-related tax deductions covers what is and is not claimable, and how much you can claim without receipts explains the narrow exceptions to the records rule.
Working from home without records
The fixed rate method is 70 cents per hour for 2024-25 and 2025-26 and covers energy, internet, phone, stationery and computer consumables. The ATO requires “a record of the number of actual hours you work from home during the entire income year – for example, a timesheet, roster, diary or other similar document (an estimate of your hours won’t be acceptable)”, plus at least one bill or receipt for each type of running cost. Claiming the same hours as last year, or a round number, is exactly what the ATO has said it will question. See our working-from-home guide and the home office deductions guide for business owners.
Income the ATO already knows about
Pre-fill is not a courtesy; it is the ATO showing you what it has matched. Interest, dividends, managed fund distributions, Centrelink payments, private health cover, share and crypto disposals, rental income reported by property managers and gig platform payments all arrive from third parties. Lodging before pre-fill is complete, or deleting a pre-filled amount, is one of the fastest ways to be reviewed.
Rental properties
Rental claims have been on every ATO focus list for years. The common errors are claiming initial repairs and renovations as immediate repairs rather than capital works, claiming interest on the private portion of a loan or on redraws used for personal spending, and claiming full-year deductions for a property that was only available for rent part of the year. The property management and rental bond programs give the ATO the income side; landlord insurance and loan data give it the expense side.
Businesses: cash, GST and super
For sole traders and small companies the triggers are different: income reported through payment platforms that does not appear in the return, GST refunds or input tax credits that do not fit turnover, BAS and PAYG withholding lodged late or not at all, and superannuation guarantee paid late (visible through STP, and from 1 July 2026 under Payday Super). The ATO’s guidance for the supplementary annual GST return sets out what it treats as low-assurance areas and red flags on the GST side, and its approach to audits of privately owned groups shows how larger reviews run. If your BAS and GST lodgements are late or inconsistent, fix that before anything else.
Other patterns
- Lifestyle out of step with income – insured assets, vehicles and property that a declared income could not support.
- Continuous business losses offset against salary without meeting the non-commercial loss rules.
- Personal costs claimed as business expenses – family meals, holidays, clothing.
- Large donations to organisations that are not deductible gift recipients, or without receipts.
- Trust distributions and related-party loans that look designed to shift income rather than reflect a business purpose.
- Workers treated as contractors to avoid super and withholding.
- Undeclared foreign income – the ATO receives financial account data from other countries and visa and travel data from Home Affairs.
Review versus audit: what actually happens
The ATO distinguishes a risk review from an audit. In its Taxpayers’ Charter guidance on reviews and audits, a risk review is used to “determine if there are any compliance issues that need a more in-depth investigation”, while “audits are more comprehensive than risk reviews and involve intensive case examination where material underpayment of income tax, GST or excise is a risk.” Its information-gathering guidance adds that an audit “will involve more detailed verification of the facts to make sustainable decisions at law based on the evidence we have”. The ATO says it prefers to gather information simply by asking for it, that it discusses the timeframe and scope of an audit with you at the start, and that it aims to complete most income tax audits within 18 months.
| Risk review | Audit | |
|---|---|---|
| Scope | Specific items or a specific risk | Whole return or significant parts, often several years |
| Typical trigger | Data mismatch, claim outside the benchmark | Review found a material issue, or serious risk indicators |
| What you are asked for | Receipts, logbooks, explanations for particular claims | Comprehensive records, bank statements, third-party information |
| Outcome | No change, an adjusted assessment, or escalation to audit | Amended assessments, penalties and interest where warranted |
Your rights under the ATO Charter include being treated as honest unless there is reason to think otherwise, having decisions explained, being kept informed, and having the ATO work with a representative you choose, such as your tax agent. Contact comes through your myGov inbox, a letter or a phone call. The ATO’s scam-safety page is explicit that it may text or email asking you to contact it but “will never send an unsolicited message with a link asking you to return personal information or log in to our online services” – if a message does that, it is not the ATO.
How far back can the ATO go, and what does it cost?
Under the ATO’s time limits on amendments, individuals generally have two years to amend an assessment, running from the day after the notice of assessment is sent, and the ATO is bound by the same two-year window unless you request an amendment. Individuals in business, trustees and most other taxpayers have four years, and sole traders moved to four years from 2024-25. The ATO “may amend your tax return outside the time limit in exceptional circumstances, such as when evasion or fraud has occurred” – in those cases there is no time limit at all.
If a review or audit finds a shortfall, the penalties for false or misleading statements are a percentage of the shortfall: 25% for failure to take reasonable care, 50% for recklessness and 75% for intentional disregard. The penalty can be increased by 20% where you obstruct the ATO, fail to tell it about a shortfall you become aware of, or have been penalised for the same thing before, and reduced by 20%, 80% or to nil for voluntary disclosure, depending on when you make it. General interest charge applies to the unpaid tax on top. Where a statement is false but produces no shortfall, penalties are set in penalty units, currently $364 each from 1 July 2026. A safe harbour removes the penalty where you gave your registered tax agent all the relevant information and the error was the agent’s failure to take reasonable care – which is one of the real benefits of using one.
Rule of thumb
The ATO is not hunting for honest mistakes made by people with records; it is looking for claims that cannot be explained and income that was left out. If every deduction has a receipt or a log behind it and every pre-filled amount is in your return, a review is an inconvenience, not a bill.
Worked examples
Simran, rideshare driver. Simran claimed 80% business use of her car with no logbook. Her claim sat well above the benchmark for her occupation, the ATO’s ride-sourcing and platform data showed her income, and a review asked for the logbook she did not have. The deduction was reduced to what she could substantiate and a 25% shortfall penalty applied for failing to take reasonable care.
David, IT employee. David claimed 1,200 hours working from home at 70 cents, plus phone and internet separately. He had no hours record, and the fixed rate already covers phone and internet, so he had also double-claimed. The review disallowed the hours claim and the duplicated expenses. Had he kept a diary and claimed only the fixed rate, the ATO would have had nothing to adjust.
Pre-fill mismatch. A taxpayer lodged on 2 July before her bank interest and a managed fund distribution were pre-filled. The ATO’s system matched the third-party data a few weeks later and amended her assessment, with a small shortfall penalty. Lodging after pre-fill was complete would have avoided both.
Ten habits that keep you off the list
- Wait until late July or August for pre-fill to complete, then check it against your own records before lodging.
- Keep every receipt, invoice and logbook for five years from the date you lodge – digital copies in the ATO app’s myDeductions are fine.
- Record your actual working-from-home hours for the whole year; never carry last year’s figure forward.
- Use a logbook for car claims above the 5,000 km cents-per-kilometre cap, and never claim 100% business use on a car you also drive privately.
- Declare every source of income: interest, dividends, side hustles, platform income, crypto and share disposals, foreign income and rent.
- For rental properties, separate repairs from improvements and apportion interest on mixed-purpose loans.
- Do not claim expenses your employer reimbursed, and do not claim the same cost twice under different methods.
- Lodge BAS, PAYG withholding and super on time if you run a business.
- If you find an error after lodging, amend it yourself – voluntary disclosure can reduce penalties to nil.
- Use a registered tax agent and give them complete information, which also brings the penalty safe harbour into play.
FAQ about ATO audits and reviews
What are the chances of being audited by the ATO?
Low for a wage earner with simple affairs and claims in line with their occupation, because the ATO selects returns by data matching and risk scoring rather than at random. The risk rises sharply if your deductions are high relative to your income, your return omits income the ATO already holds (interest, dividends, side-hustle or crypto data), you have rental property claims, or you work in a sector the ATO has named as a focus area.
How will I know if the ATO is reviewing my return?
Your return status in ATO online services changes to “In progress – Under review” or “Information pending”, and the ATO contacts you or your tax agent – by letter to your myGov inbox, or by phone. The ATO says it may use SMS or email to ask you to contact it, but it will never send an unsolicited message with a link asking for personal information or a login. If in doubt, hang up and call the ATO back on a published number.
What is the difference between an ATO review and an audit?
A review (the ATO calls it a risk review) is a check of specific items to see whether there is a compliance issue worth investigating. An audit is more comprehensive – in the ATO’s words, it involves “more detailed verification of the facts” and an “intensive examination”. Most individual matters start and finish as reviews; an audit follows only if the review finds something material.
How far back can the ATO audit me?
For most individuals the ATO can amend an assessment within two years from the day after the notice of assessment issued; for individuals in business and most other taxpayers it is four years. From 2024-25, sole traders have a four-year period. There is no time limit where the ATO forms the view there has been fraud or evasion.
What penalties apply if the ATO finds an error?
Penalties for false or misleading statements are a percentage of the tax shortfall: 25% for failing to take reasonable care, 50% for recklessness and 75% for intentional disregard, plus interest on the unpaid tax. Penalties can be increased by 20% if you obstruct the ATO or have been penalised before, and reduced by 20%, 80% or to nil if you make a voluntary disclosure. There is a safe harbour where you gave your registered tax agent all the relevant information and the error was the agent’s failure to take reasonable care.
Talk to specialist before it costs you
15-minute discovery call. No obligation, no jargon.
Talk to a registered tax agent
Most ATO reviews are won or lost on records, and the time to get those in order is before you lodge. Nanak Accountants prepares returns for employees, investors and businesses across Australia, checks claims against the ATO’s current focus areas, and represents clients in reviews and audits. Call 1300 626 258 or book a free 15-minute consultation.
This article is general information only and is not personal tax advice. Focus areas, data-matching programs, review and audit definitions, amendment periods, penalty rates and the working-from-home rules were checked against ATO pages and media releases on 7 October 2026.
