ATO record keeping rules for small business, in plain English

The ATO's record keeping requirements have a reputation for complexity they don't quite deserve. The core of it fits in a sentence: keep the records that explain your tax affairs for at least five years, in a form you can actually produce when asked. Nearly everything else is detail on three questions: which records, when the clock starts, and what "keep" really means.

This article walks through all three for Australian small businesses, plus the places where five years becomes seven, and a modern trap: records that exist perfectly well inside a subscription you might one day stop paying for.

One thing before we start: this is general information. Your accountant knows your situation; the ATO's own pages are the source of truth.

The five-year rule

For most business records, the ATO requires retention for at least five years, counted from when you prepared or obtained the record, or completed the transaction or acts the record relates to, whichever is later.

That "whichever is later" carries more weight than it looks. A contract signed in 2022 for a project completed in 2024 starts its five years in 2024. A practical habit that keeps you safe without a spreadsheet of countdown timers: treat five years from lodging the relevant return as your floor, and you'll rarely be early.

The records covered are the ones that evidence your tax position:

• Income: the invoices you issued, sales records, cash register tapes if you have them
• Expenses: supplier bills, receipts, and the tax invoices supporting GST credits
• Payments to workers: wages, super contributions, PAYG withholding
• Assets: purchase documents, depreciation schedules
• The connective tissue: bank statements, contracts, stocktake records, loan documents

If a number on your BAS or tax return traces back to it, it's a record, and the five years apply.

One invoice, worked through

Say you issue INV-0412 in March 2024 for a job finished the same month, the customer pays in April, and the income lands in your 2023-24 return, lodged in November 2024. When can the invoice go?

The rule says five years from preparation or transaction completion, whichever is later: April 2029 at the earliest. The cautious habit says five years from lodgement: November 2029. And if that year's return is ever amended or disputed, the date moves again. Which is why nobody sensible actually diarises destruction dates per document; they set a blanket policy long enough to swallow every case, and keep everything.

The start line moves, and sometimes the finish line does too

Five years is the base case, and several ordinary situations extend it:

A dispute with the ATO. Records connected to an objection, review, or audit need to survive until the matter is fully resolved, even if the five years lapse mid-fight.

Carried-forward losses. Records substantiating a loss stay relevant until well after the loss is finally used, because the ATO can ask how the figure arose.

Capital assets. CGT records span the entire ownership of the asset plus the years after its disposal is reported. For premises bought in 2015 and sold in 2030, "five years" describes almost none of the retention period.

The pattern: the retention clock follows the tax consequence, not the calendar. When in doubt, the record outlives the question it might answer.

When five becomes seven

Two other rulebooks sit alongside the ATO's, and both say seven:

• Companies: the Corporations Act requires financial records to be kept for seven years. If you run a Pty Ltd, this, not the ATO's five, is your real number.
• Employers: employee records (time, wages, leave, super) must be kept for seven years under Fair Work rules.

Which produces the simplest retention policy a small business can adopt: keep everything seven years, prune nothing. Storage costs cents; distinguishing which regime covers which document costs attention you could spend elsewhere.

Quick reference, by record type

Read the table once, then apply the blanket policy: seven years for everything, longer for assets and anything contested.

What "keep" actually means

This is where businesses that genuinely kept everything still fail. The ATO's requirements aren't only about existence:

• In English, or easily convertible to it
• True, complete, and unaltered (corrections documented, not overwritten)
• Accessible and readable for the entire period

Digital records are explicitly fine, and have been for years. Scans of paper receipts, PDFs of invoices, CSVs of transactions: all acceptable, provided they pass the test that matters, which we'd phrase as: could you hand it over this week? A record that exists somewhere you can't reach, in a format you can't open, on a platform you can't log into, fails that test just as surely as a shoebox lost in a flood.

The cloud accounting wrinkle

The retention rules were written before a subscription became the filing cabinet, and this is where that shows.

Your records inside Xero are digital, complete, and beautifully organised, and their accessibility depends entirely on your subscription's standing. Cancel, and the data is archived where nobody can read it. Let a card lapse at the wrong moment, and access pauses with it. And Xero's own terms of use place responsibility for maintaining copies of your data squarely on you, while excluding liability for "legal, tax or accounting compliance issues" arising from data loss.

None of that makes cloud accounting non-compliant; it makes cloud-only record keeping fragile. "Accessible and readable for five to seven years" is a promise about your future access, and a subscription is not a seven-year guarantee of anything. The fix is unglamorous: copies of the actual documents, in storage you control, kept current. The complete backup guide covers every way to get there.

Penalties, and the cost that's worse than penalties

The ATO can penalise a failure to keep records, and the amounts run into the thousands of dollars. But the direct penalty is rarely the expensive part. The expensive part is what missing records do to everything else: deductions denied because they couldn't be substantiated, GST credits clawed back for want of a tax invoice, audits that drag because every question needs an archaeology project, and disputes lost by default because the evidence was on a platform nobody could open.

Record keeping is asymmetric. Done well it's nearly free, and its value appears precisely when everything else is going wrong.

A compliance-grade setup, one afternoon

Actionable version, start to finish:

1. Create the home. One folder tree in storage the business owns (Google Drive, Dropbox, OneDrive), organised by financial year. Not an employee's personal account.
2. Automate the documents. Invoices, quotes, and purchase orders as individual PDFs, delivered daily. This is what Ziroo does over a read-only Xero connection, into your inbox and your own storage.
3. Add the yearly layer. Each July, export the financial reports for the closed year (P&L, balance sheet, general ledger) into that year's folder.
4. Keep source documents at the door. Receipts and supplier bills go into your storage as they arrive, not only into the accounting platform, because attachments are the hardest thing to get back out.
5. Check readability quarterly. Open a few random files. Ninety seconds, and your compliance posture goes from assumed to verified.
6. Retain seven years minimum. Prune nothing. Storage is cheaper than any conversation that starts with "we deleted that."

Ziroo is in early access. Add me to the waiting list and step two runs itself from tomorrow morning.

The record that counts is the one you can produce

Five years, sometimes seven, always producible. That's the whole game. The businesses that pass audits without drama aren't the ones with heroic memories; they're the ones whose filing ran on rails.

Add me to the waiting list and the rails get laid tomorrow morning.

This article is general information only, not tax, legal, or accounting advice; retention rules vary with circumstances, so confirm your obligations with your accountant or at ato.gov.au. Ziroo is an independent archive service and is not affiliated with the ATO or Xero Limited.