Record-keeping obligations in Australia are set by the ATO, ASIC, and Fair Work, and each has its own rules on what to keep and for how long. This guide covers what applies to small businesses in Melbourne, the baseline five-year rule, the categories that run longer, and how to handle digital records under current ATO guidance.
If you run a business in Australia, you’re legally required to keep records of every transaction that relates to tax, super, and registration. The baseline retention period is five years from when a record was prepared, or a transaction was completed, whichever is later. Some categories, employee files, company records, and CGT assets, have longer retention periods, set out below. Digital records are acceptable to the ATO under the same rules as paper.
Key takeaways
- Most ATO records: 5 years from prep date or transaction completion (whichever is later)
- Company records under ASIC: 7 years
- Employee records under Fair Work: 7 years from the end of employment
- Super contribution records: 5 years from the date of the contribution
- CGT asset records: 5 years after the asset is sold or disposed of
- Depreciating assets: life of the asset + 5 years
- Records must be in English, unaltered, and accessible if the ATO asks
What actually counts as a “record”
A record is any document that shows a transaction took place or explains how a number on your tax return or BAS was calculated. Invoices, receipts, bank statements, payroll reports, signed contracts, Xero or MYOB reports, expense claims, and motor vehicle logbooks. The working papers behind a GST adjustment. The calculation sheet behind a depreciation claim. The email chain in which a supplier confirmed a price variation.
The minimum information on any record needs to cover:
- Date, amount, and description (sale, purchase, wages, rent)
- GST information, where applicable
- The purpose of the transaction
- The parties involved, where that matters
A supplier invoice showing nothing but a total and “services rendered” isn’t enough on its own. Neither is a bank line that reads “EFTPOS. MELBOURNE” with no receipt attached. In both cases, the ATO would reasonably ask what the transaction was for, and without context, there’s no defensible answer.
The five record-keeping rules every business has to follow
These come directly from ATO guidance and tax law. They apply to most records you’re required to keep.
- Keep everything tied to tax, super, and registration. That covers starting, running, changing, selling, or closing the business. If an expense is part business, part personal, a laptop, a phone plan, a car, you need documentation showing how you split it.
- Records can’t be altered. Whatever system holds your records needs to protect the data from being changed after the fact. This becomes a live issue during accounting software migrations, because the transaction history in the new system is a re-import rather than the original data. The ATO’s position is that you need to be able to produce the pre-migration records if asked. In practice, that means keeping a backup of the old system, or at a minimum, a full export, for the remainder of the five-year retention period after the switch.
- Keep most records for 5 years. The clock starts from when you prepared the record, or completed the transaction, whichever is later. Some records have different start dates. FBT records run from when you lodge the return. Super contribution records run from the date of the contribution.
- Be able to produce them. If the ATO asks, you need to hand them over. Digital records need to be extractable into a standard format like Excel or CSV. Encrypted or password-protected files need to come with access information.
- Keep them in English. Or in a format that can easily be converted to English.
None of these are difficult if you set up a bookkeeping system properly from the start. Where it becomes painful is when records are spread across a shoebox, three email accounts, an old laptop, and whatever the previous bookkeeper set up two software changes ago.
How long to keep different records
Five years is the baseline for most records, but the categories below don’t all run on the same clock. A handful have different start dates, and a few sit outside the ATO’s rules entirely (under ASIC or Fair Work). The table covers the common ones; for anything unusual, check the specific ATO ruling for that record type.
A practical example. If you bought a work vehicle in 2023, used it in the business for six years, and sold it in 2029, you’d need to keep the original purchase and depreciation records until 2034, the life of the asset plus five years after disposal. Most people don’t realise that until they try to throw out “old” paperwork.
For CGT assets like property, shares, or business goodwill, the five-year clock only starts at disposal, not purchase. That can mean holding onto purchase contracts for a decade or more.
Digital vs paper: what the ATO actually accepts
The ATO accepts both and actively recommends digital.
The ATO accepts scanned and photographed receipts, and for most businesses, that’s the simpler option. The standard is whether the digital copy is legible enough that the date, supplier, amount, and GST details can all be read without guessing. Blurry phone shots of faded thermal receipts don’t meet that standard. A photo taken in reasonable light, captured through a receipt-scanning app that attaches it to the corresponding transaction in the ledger, does. Once the image is saved and backed up, the original paper can go.
Digital records have obvious advantages. Faster search. Easier backup. No physical storage. And they don’t fade the way thermal receipts do after twelve months in a drawer.
Cloud accounting software handles most of the storage and backup side automatically. The part that catches people out is the mix of systems most small businesses actually run. Sales data lives in a POS. Payroll runs through a separate platform. Bank feeds come in through the accounting software, but the underlying statements sit with the bank. If any one of those subscriptions lapses, or the provider changes hands, or a login is tied to a former employee’s email address, the records you thought were safe become awkward to retrieve.
The other overlooked rule is access. If your records are encrypted or password-protected, you have to be able to supply the access details if the ATO requests them. This catches out businesses where the previous bookkeeper set up the file and left without a clean handover, the data still exists, but nobody currently in the business can open it.
What happens if you don’t keep proper records
Most articles on this topic go straight to worst-case scenarios. The more useful framing is that the penalties exist, but the real cost is almost always the lost deductions and the time spent reconstructing.
The direct penalties include:
- Administrative penalties of up to 20 penalty units (currently around $6,600 for individuals, higher for companies)
- Potential directed record-keeping courses from the ATO
- Denied deductions where you can’t substantiate the expense
- Fair Work penalties for missing or incomplete employee records
- ASIC penalties for company record failures
What we typically see isn’t the fine, though. It’s the client who can’t find the purchase documents for a piece of equipment, loses the depreciation claim, and ends up paying more tax than they needed to. Or the sole trader who can’t substantiate three years of motor vehicle expenses because the logbook stopped being maintained halfway through 2022.
Messy records aren’t just a compliance problem. They mean you don’t actually know whether the business is profitable until tax time, when it’s too late to do anything about it.
Common mistakes we see in Melbourne SMEs
A short list of the patterns that come up most often:
- Keeping everything in one person’s email. When that person leaves, so does half the business’s financial history.
- Mixing personal and business transactions. Very common for sole traders. It makes BAS preparation twice as slow and creates audit risk.
- Not keeping a version history of customer terms or supplier agreements. When a dispute arises, you need the version that applied at the time, not the current one.
- Throwing out “old” records at the five-year mark without checking whether they relate to an asset still in use, or a CGT asset that hasn’t been sold.
- Relying on cloud software as the record-keeping system, without any export or backup plan. If the subscription lapses or the provider has an outage, the records still need to be accessible.
The underlying fix for most of these is operational rather than technical. Pick one system that everything runs through, usually the cloud accounting software. Make sure bank feeds, receipt capture, and payroll either sit inside that system or export to it cleanly. Review the file monthly rather than letting it accumulate until BAS is due. Most of the record-keeping problems we see aren’t caused by businesses using the wrong software; they’re caused by outsourced bookkeeping being fragmented across five different places, with no single person clear on which one is the authoritative copy.
A practical checklist for getting records in order
Seven things that make the difference between a record-keeping system that works and one that falls apart at BAS time:
- Use Xero, MYOB, or QuickBooks as the main accounting system. Xero dominates the Australian SME market; MYOB is still common among businesses with longer-standing accountant relationships; QuickBooks sits behind both but integrates well with US-based tools
- Connect bank feeds so transactions flow in automatically instead of being keyed by hand
- Use a receipt-capture tool like Hubdoc or Dext so photos of receipts attach to the right transaction at the time of the expense, not at EOFY
- Run the business through a dedicated business account and card, with no personal spending on it
- Keep employee records for seven years from the end of employment, not five; this is a Fair Work requirement, separate from the ATO’s five-year rule
- Keep asset purchase records for the life of the asset plus five years after disposal (the mistake we see most often is clients throwing out purchase documents for equipment they’re still depreciating)
- Save a dated copy of any terms of trade, privacy policy, or contract template every time you update one; the version that applied at the time of the transaction is the version that matters if a dispute arises
If your records are something you keep meaning to sort out, that’s usually the clearest sign it’s time to have a conversation. We work with Melbourne small businesses to get record-keeping systems set up properly, cleaned up where needed, and kept running without you having to think about them.
