Inside the ATO’s Top 1000: Compliance risks and opportunities for Australia’s largest public and multinational groups

 

The Australian Taxation Office (ATO) has just released its seventh findings report for the Top 1,000 income tax and GST assurance programs, detailing the outcomes of combined assurance reviews (CAR) undertaken with Top 1,000 taxpayers. The data in the 2025 findings report covers CARs finalised in the year ended 30 June 2025. 

While the latest report does not include reviews performed under the differentiated approach, which was announced by the ATO in March 2024, the ATO does provide assurance ratings by population pool, i.e. significant taxpayers (those taxpayers with turnover of over $1 billion, or $5 billion for superannuation funds) and general pool taxpayers (the remaining taxpayers in the Top 1000 population).

Under the differentiated approach, the ATO will focus on the most recent year of the review period and limit deep dives to new, significant or flagged risks for taxpayers that have previously achieved high or medium assurance and stage 2 or stage 3 governance rating,

The lighter-touch reviews of the differentiated approach incentivise investment in tax control frameworks and proactive risk management.

This article provides an overview of the findings and key commentary, the risk areas attracting the ATO’s attention and changes as compared to prior years. We also share our observations on what this means for the large taxpayer population.

Origins of the Top 1000 findings

The Top 1000 population is made up of the largest 1000 publicly listed and multinational corporate taxpayers and APRA-regulated superannuation funds, excluding those covered by the Top 100 Program. The Top 1000 Program is part of the ATO’s Tax Avoidance Taskforce, which seeks to engage with large businesses to ensure they are paying the right amount of tax. The ATO applies the justified trust methodology and seeks to obtain assurance across four focus areas:

• Tax governance frameworks: Ensuring robust tax risk management and governance frameworks exists and are applied in practice
• Tax risks flagged to the market: Identifying high-risk areas of concern and ensuring none of these are present
• Significant transactions: Reviewing the tax outcomes of atypical, new or significant transactions to ensure they are appropriate
• Differences between accounting and tax results: Understanding why these results vary.

The goal is to provide the ATO with greater visibility and assurance that these taxpayers are complying with their obligations, identifying areas of non-compliance or risk, and providing recommendations to taxpayers on how to improve and what actions should be taken. Matters may also be escalated for further investigation by the ATO.

CARs are more than just a compliance check. They’re a strategic opportunity to build trust and transparency in your tax affairs.

Income tax findings

Assurance ratings

The following assurance ratings summarise how the ATO evaluates the tax positions of Australia’s largest public and multinational groups:

• In 2025, 89 per cent of taxpayers achieved either high or medium assurance ratings for income tax, with 26 per cent reaching high assurance — a notable improvement from prior years
• Second reviews showed significant improvement, with a 10 per cent increase in high assurance ratings
• This significant improvement was driven by taxpayers implementing next actions identified by the ATO in previous reviews and enhancements made to tax governance frameworks
• Significant taxpayers have a higher prevalence of high assurance (32 per cent) than general pool taxpayers (24 per cent)
• Only 9 per cent of income tax reviews and 2 per cent of GST reviews were escalated for further ATO action, showing a decline in serious compliance concerns.

Tax risk management and governance findings

Tax risk management and governance continues to be a key focus area. While the ATO’s expectations are rising in terms of tax governance, there continues to be improvement in the governance ratings.

59 per cent of taxpayers were rated at Stage 2 or Stage 3 for tax risk management and governance. This increase in governance ratings is a trend that has been observed since the introduction of the Supplementary Guide with many taxpayers now having a board-endorsed commitment to conduct periodic internal controls testing, which is required to obtain a Stage 2 rating. However, 41 per cent remain at Stage 1, suggesting there is room for improvement in formalising governance practices.

Undertaking independent testing of internal tax controls is the single most effective way to uplift governance ratings.

In terms of reviewing the outcomes of the testing, the ATO needs to be provided with the following:

• The scope of testing
• The testing methodology and sample size selected
• The source documents relied upon
• The testing results
• Documentation of actions taken to address any exceptions identified during testing
• Board reporting of test results
• Remediation of any failings in the course of testing.

Independence is a recurring theme we are hearing from the ATO, which has been highlighted in its latest findings report.

Determining whether a third party is independent for the purposes of undertaking internal control testing will be a question of fact and degree. It is relevant to consider whether the third party has undertaken any of the responsibilities of the control owners, including where the third party has undertaken the design of any of the tax controls, or the third party has undertaken the income tax preparation work. 

Governance over third party data continues to be a focus area for investment industry entities. Since 1 July 2024, the ATO started providing a rating for governance over third party data to relevant investment industry entities. The ATO expects a Stage 2 rating to be industry standard. In its first year of assessing governance over third party data, 70 per cent of those reviewed achieved the Stage 2 rating.

GST findings

Assurance ratings

The 2025 Top 1000 Findings Report reveals notable progress in GST assurance ratings among Australia’s largest taxpayers, highlighting improvements in compliance and the impact of recent ATO initiatives:

• As at 2025, 95 per cent of taxpayers have achieved either high or medium assurance ratings for GST, with 45 per cent of those reviewed in 2025 reaching high assurance, a notable improvement from prior years
• Second reviews showed substantial improvement, with a 29 per cent increase in high assurance ratings
• With the introduction of the Supplementary Annual GST return, the ATO anticipates there will be a reduction in the intensity and number of assurance reviews being undertaken. This is driven by taxpayers implementing Next Actions identified by the ATO in previous reviews and enhancements made to tax governance frameworks.

Tax risk management and governance findings

Tax risk management and governance continues to be a key focus area for GST. Within GST, the focus is on BLC 4, MLC 4, MLC 6 and MLC 7 as these controls directly impact the correct reporting of GST.

49 per cent of taxpayers were rated at Stage 2 or Stage 3 for tax risk management and governance. This increase in governance ratings is generally as a result of many taxpayers now having a board-endorsed commitment to conduct periodic internal controls testing, which is required to obtain a Stage 2 rating. However, 51 per cent remain at Stage 1, suggesting there is room for improvement in formalising governance practices.

The ATO identified the following concerns with respect to GST governance:

• The design elements of the common controls (BLC 1, BLC 3, MLC 1, MLC 3 and MLC 7) do not extend to GST
• Significant transactions are not defined with a quantitative threshold, only qualitatively
• Taxpayers not following through on their commitments to undertake periodic internal tax controls testing
• In respect of controls in place for data, there is a lack of, or incomplete, documented procedures in place for addressing manual adjustments that are outside the usual ledgers
• The documented procedures regarding the implementation and maintenance of customer, vendor and product master files are incomplete
• Most taxpayers do not undertake an annual reconciliation between the business activity statements (BAS) outcomes and the audited financial statements.

Improving your tax governance findings

The gaps in Stage 3 rating for tax governance highlight the importance of a fit-for-purpose tax risk management and governance framework, that is applied in practice and tested regularly to ensure it is operating as intended.

The new differentiated approach recognises good governance and builds trust from the ATO to the boardroom. A Stage 2 or Stage 3 rating for governance can result in a lighter touch in subsequent reviews, typically less intensive and less costly, so you can spend more time on the business. From a board perspective, you increase their confidence that your tax risks are being identified and managed appropriately and that the company is acting in accordance with its intent.

To move from Stage 1 to Stage 2 or 3 governance maturity, and to improve overall assurance outcomes, consider the following:

1. Elevate board-level oversight:
Ensure tax risk is regularly reported to the board or audit committee Document the board’s tax risk appetite and align it with corporate strategy Board reporting templates must include the minimum matters to be considered by the board or its delegate.
2. Formalise tax control frameworks:
Implement and document a tax control framework that covers income tax and GST Income tax procedures manuals often do not provide sufficient detail to support the preparation or review of the income tax return, for example, internal steps taken to prepare information submitted to an adviser or steps taken when the adviser provides the return for review and sign off Include controls for annual reconciliation between the BAS outcomes and the audited financial statements. Also include the reporting of outcomes of the reconciliation in the supplementary annual GST return.
3. Undertake tax controls testing:
Undertake periodic internal controls testing for income tax and GST by a suitably qualified reviewer Ensure the reviewer of the internal tax controls is independent of the control owner and designer of the relevant control The results of the testing should be presented to the board or its delegate and actions taken to remediate any adverse findings or issues.
4. Periodic internal reviews:
Embed regular self-review processes of tax positions Use findings to make voluntary disclosures proactively and strengthen compliance, rather than wait for ATO engagement.
5. Focus on implementing any next steps identified by the ATO in their previous reviews

In addition, with Public Country by Country (CbC) Reporting now in effect for income years commencing on or after 1 July 2024, large corporates should reassess their tax transparency strategies. You should consider integrating public CbC reporting processes into your existing tax control framework. This may include:

• Board-level oversight of tax strategy narrative and data
• Ensure reconciliation between different disclosure regimes, Public CbC Reporting, Voluntary Tax Transparency Code and financial statements
• Expand testing to cover tax controls in place for CbC data.

How BDO can help

The ATO’s evolving assurance landscape, combined with new transparency requirements like Public Country-by-Country Reporting signals a shift from reactive compliance to proactive governance. For Top 1000 taxpayers, now is the time to align tax governance and transparency reporting to build trust, reduce risk, and lead with confidence.

If you’d like to explore how your organisation can strengthen its governance framework or prepare for upcoming reporting obligations, contact one of our experts from the corporate & international tax team for expert support and guidance.