The ATO’s latest Top 1,000 findings report, released on 17 September, reads like a program that has settled in. Of the 819 taxpayers the ATO has assured so far, 89% hold a high or medium rating for income tax.
Split that 89% and the picture changes. 30% are rated high. 59% are rated medium. For most of the Top 1,000, medium is where justified trust lands.
Medium is a respectable result. The report is unusually plain about what keeps taxpayers there.
The gap is governance
The first blocker the ATO lists is “not demonstrating their governance framework is effectively designed.” The others are tax risks flagged to the market that remain unassured, and significant transactions that need more information before the ATO can assure the outcome.
The governance ratings show the scale of it. Across the Top 1,000, 39% of taxpayers are at Stage 1 for income tax governance: a framework exists, but it hasn’t been shown to be designed effectively. Only 7% have reached Stage 3, against 49% in the Top 100. Among the largest, typically those with turnover above $1 billion, it’s 13%. Among the rest, 3%.
The trend is good. In reviews completed in 2025–26, 73% of taxpayers reached Stage 2 or 3, against 59% across all reviews.
For GST, governance is often the only reason
GST sharpens the point. 95% of taxpayers assured for GST hold high or medium assurance, and the ATO is direct about what separates the two: “A stage 1 rating for governance is the most significant reason preventing taxpayers from achieving overall high assurance for GST.”
90% of taxpayers rated medium for GST had not reached Stage 2 or 3 governance. In about 55% of those cases, governance was the only reason they missed high assurance.
The report also found that most taxpayers don’t reconcile their BAS outcomes to their audited financial statements each year. That matters. In the ATO’s words, “The transactional nature of GST means that undetected errors can compound to material amounts unless identified and addressed.”
What Stage 3 is worth
Stage 3 changes how a tax function is seen. The ATO notices first, then the board, the CFO and the market.
The ATO steps back. It says achieving Stage 3 “provides a strong foundation for our level of confidence and supports less intense future engagements.” The review rules point the same way. For the largest Top 1,000 taxpayers, generally those with turnover above $1 billion, every review covers four income years. Hold high or medium assurance and at least Stage 2 governance, and the ATO takes a lighter touch, focusing on objective evidence from the last year plus any significant transactions or events in the other three.
The board gets independent assurance. Stage 3 testing is meant to give “an independent level of assurance to the audit committee and the Board.” Kirsten Fish, an ATO Second Commissioner, told the Australian Financial Review’s CFO Live conference in 2024 that the ATO’s assessments let CFOs “have influential conversations with their board”. That affirmation, she said, can help demonstrate an organisation’s social licence.
The CFO gets cheaper certainty. Fish called the justified trust report and assurance rating “the simplest way to understand your entity’s tax risk profile”, and said taxpayers that have demonstrated high levels of assurance “should see the ongoing costs of certainty through justified trust fall.”
The market can see it. Ratings appear in tax transparency reports too. ASX, a Top 1,000 taxpayer, says in its 2026 report that it “has maintained a high assurance rating since its first Streamlined Assurance Review in 2017.” It also reports that an independent auditor’s governance review of its income tax and GST environment concluded that key controls “are designed and operating effectively.” Designed and operating effectively is the Stage 3 standard, here in a report written for shareholders. In Wesfarmers’ 2025 report, the CFO cites the high assurance rating the group has maintained as a reflection of its commitment to tax compliance.
What Stage 3 asks for
Stage 3 means the framework is designed and operating effectively, and the report is specific about the proof. “Periodic internal control testing must be undertaken by a suitably qualified reviewer who is independent of the tax control owner.” The ATO then wants the testing methodology and sample size, the source documents the tester relied on, the results, the steps taken to address any issues, and acknowledgement from the board or its delegate of the results and the actions taken.
“To achieve a stage 3 rating a taxpayer must have completed the testing and have addressed any issues identified.”
Every item on that list is a record. An independent tester can only sample what the system kept.
The workpaper problem
On the alignment of accounting and tax results, 91% of taxpayers are rated high. For the rest, the ATO says, “the concerns continue to be due to the inability to provide detailed workpapers to support the permanent and timing differences.”
It also says what works: “The provision of detailed statements of taxable income has enabled us to obtain assurance over the adjustments from accounting results to calculate the taxable income and tax payable figures.”
What it costs to get there
The ATO doesn’t pretend governance is free. “We understand that appropriate risk management, governance and controls require funding that may be contestable within an organisation,” Fish said in the same speech. For most tax functions, the cost comes in two parts.
The first is the review itself. An initial combined assurance review covers four income years for income tax, and the ATO is clear that the responses set the pace. Timely, complete answers can mean “shorter reviews” and “less intensive engagements”. Answers that fall short are likely to bring “detailed questions” and “a longer more intensive review process.” When UNSW’s Dr Rodney Brown interviewed 22 senior tax professionals at large corporates in 2021, half had engaged external advisers to prepare for reviews or answer ATO information requests. More than a third had hired additional staff.
The second cost is harder to see. Plenty of tax functions run a sound process on disconnected tools. The provision sits in one workbook and the return in another. The BAS comes out of the ERP. Approvals live in email. The process works, but it doesn’t keep its own evidence. So every information request becomes a retrieval job: find the right version, rebuild the trail, explain the gaps. Then the independent tester, from internal audit or an external firm, arrives and asks for the same records again.
Neither cost ends at Stage 3. The ATO expects a testing program that looks three to five years ahead, and every review opens with a request for information. When the technology doesn’t do the heavy lifting, the tax team does.
A Top 100 standard on a Top 1,000 team
The Top 1,000 is rated on the same governance stages as the Top 100, and usually meets them with a much smaller tax team. That is where a system earns its place, and it’s the problem we built TaxTime to solve.
Every difference has its workpaper. In a tax ledger, each difference between accounting and tax, permanent or timing, is recorded against the account, the rule and the workpaper that produced it. The statement of taxable income is a view of that ledger, from the financial report down to the workpaper, not a document rebuilt each year.
Testing samples the record. Maker-checker workflow and an audit log that can’t be edited capture every review and approval: who, what and when. Those are the source documents an independent tester relies on, kept as the work happens.
Board reporting comes from the ledger. The pack draws on the same ledger that computed the numbers, with positions and evidence attached.
The same principle applies to GST. Reconciling the BAS to the financial statements is easiest when both come from the same data. Run it every period and errors surface while they are still small.
Before the review starts
A controller asks: is medium good enough? A CFO asks: what would it take to reach high, and stay there?
The ATO encourages taxpayers “not to wait for ATO engagement reviews to commence to undertake a review of their GST reporting.” The same holds for governance. If a combined assurance review is coming, start with your governance rating. For each control, ask whether an independent tester could find the evidence today.
Off the Tax Treadmill. On to Impact.
