ATO’s 2026 Top 100 and Top 1,000 findings reports: what large business needs to know

On 17 September 2026 the Australian Taxation Office (ATO) released its findings reports for the Top 100 and Top 1,000 income tax and goods and services tax (GST) assurance programs. Both cover reviews completed to 30 June 2026.

The results are positive with 82% of taxpayers in the Top 100 program having high or medium assurance for income tax and 98% for GST. In the Top 1,000, 89% hold high or medium assurance for income tax and 95% for GST.

Four things are new in this year's reports:

1. The ATO has published a three-tier risk model (the PMB 3TM) and mapped its assurance work to it.
2. The lighter-touch review is now conditional on the taxpayer’s previous assurance rating.
3. The Supplementary annual GST return is starting to reduce the scope and intensity of GST reviews.
4. For the first time, the ATO has published figures showing assurance and governance ratings can fall.

The ATO says it has embedded justified trust across both income tax and GST, assured the majority of both populations, and driven a significant uplift in governance. It adds that a level of non-compliance remains, which it continues to address robustly. Accordingly, the shift is from taxpayers obtaining assurance to keeping it. The onus is on taxpayers to show that their tax controls continue to be operating effectively at each review.

Top 100 Program

The Top 100 program covers Australia's largest public and multinational businesses and APRA-regulated superannuation funds.

Real-time engagement is now the current Top 100 operating model. Reviews are in progress with 95% of the population, and 80% have no outstanding prior-year reviews.

• Top 100 income tax: 82% hold high or medium assurance, made up of 62% high and 20% medium. Low assurance increased from 13% in the prior year to 15%.
• Top 100 GST: 98% hold high or medium assurance. High assurance rose from 38% to 43%, and high assurance for correct reporting rose from 58% to 65%.
  
  A high assurance rating is more than a positive outcome. It reflects the ATO’s view that the correct amount of GST was reported for the period or issue reviewed. In practical terms, it provides a level of certainty that the ATO will generally not undertake further review or audit activity on those matters for that period, except where further work has been identified in a future assurance plan or in limited exceptional circumstances.
  
  Additionally, in the Top 100, eligible high assurance GST reporters will now have an assurance check-in every fourth year instead of a full refresh review. In practice we expect the ATO to rely on independent control testing results, the application of the GST analytical tool (GAT) and the Supplementary annual GST return (SAGR) responses to maintain assurance. However, any material new transactions or GST risks identified by the ATO will likely be included in the check-in.
• Top 100 tax governance: Stage 3 for income tax rose from 41% to 49%, taking 76% of the population to a stage 2 or 3 governance rating, and 61% now hold stage 2 or 3 for GST with 39% having attained only Stage 1 for GST.

Top 1,000 Program

The Top 1,000 covers the next largest taxpayers, generally those with turnover exceeding $350 million. For income tax, Top 1,000 taxpayers are categorised into either:

• the significant pool, which broadly includes taxpayers with turnover above $1 billion, or $5 billion for superannuation funds, and comprises around one third of the population, or

• the general pool, which includes all other taxpayers in the population.

In the Top 1,000 program, the ATO has completed 1,943 income tax reviews covering 1,341 taxpayers since 2016, including 197 during 2025-26. Some 83% of the population has been reviewed at least once, with a further 4% currently under review.

• Top 1,000 income tax: 30% hold high assurance and 59% medium at their latest review. Of the 197 taxpayers reviewed during the year, 41% achieved high assurance.

• Top 1,000 GST: 46% hold high assurance and 49% medium. Of the 141 reviews conducted during the year, 54% achieved high assurance.

• Governance is where the movement is: Across the population there has been a significant uplift in tax governance with most Top 1,000 taxpayers evidencing enhanced tax control frameworks for income tax and GST, with an increasing number independently verified as operationally effective.
  
  In the Top 1,000, 59% of the population holds stage 2 or 3 for income tax, rising to 73% for reviews completed during the year.

• Escalation is the exception: 3% of Top 1,000 reviews in the 2025-26 financial year were escalated for ATO next action for income tax matters and around 1% for GST, while 24% of income tax assurance reviews resulted in specific follow up action for the taxpayer, and 16% for GST reviews.

Lower intensity reviews and impact of Supplementary Annual GST Returns

Reviews of taxpayers who lodged Supplementary annual GST return were lower intensity, with shorter information requests. This underlines the importance of providing comprehensive and complete disclosures in the Supplementary annual GST return as it is a document looked at closely by the ATO when considering future engagement.  A Supplementary annual GST return had been lodged in only 8% of reviews completed, so the benefit should broaden. The ATO also expects that in some cases the responses will allow previous GST ratings to be retained without a further review. This is expected where:

• the taxpayer holds a high or medium overall GST assurance rating and a stage 2 or 3 GST governance rating

• previous ATO and client next actions have been addressed, and there have been no significant changes to the business or systems, and

• the responses assure the ATO that GST continues to be correctly reported, supported by a reconciliation of financial statements to activity statement reporting.

A parallel differentiation applies for income tax. General pool taxpayers have the last year of the review period assured, with new and significant transactions reviewed across the other years. Significant pool taxpayers have all four years assured by default – but where they hold both a high or medium assurance rating and a stage 2 or 3 governance rating, the ATO will take a lighter touch and focus on the last year’s evidence plus any significant transactions, events or risks in the other years. Where a significant pool taxpayer has a low assurance or stage 1 rating, the full four-year scope stands.

GST Analytical Tool

The ATO observed that for the Top 1,000 population the majority of taxpayers are achieving a high assurance rating.  For the Top 100 GST reviews completed during the year where the GST analytical tool was applied, 45% received a Stage 3 rating, being able to explain with objective evidence why accounting and GST results vary. A further 43% attained a Stage 2 rating for the GST analytical tool.  The key factors which would bridge the gap between a Stage 2 and Stage 3 rating are being able to provide objective evidence for differences between accounting outcomes and GST results and having the process and procedures in place to perform the BAS to financial statement reconciliation fully documented.

Why some ratings have gone backwards

For the first time the ATO has published figures on falling ratings. In the Top 1,000, around 5% of taxpayers moved from high or medium assurance to low.

The recurring theme is where evidence did not keep pace with business changes. Taxpayers must keep providing contemporaneous evidence to hold high or medium assurance, including for new business changes and significant transactions. Governance downgrades from stage 2 to stage 1 occurred where agreed improvement actions were not completed, or documentation was no longer current. Downgrades on the alignment of tax and accounting outcomes were mainly due to insufficient information supporting the tax reconciliation.

In the ATO's words, assurance is not set-and-forget. In practice, a rating is earned again at every review.

A new lens on ATO risk: the three-tier model

Both reports introduce the new public and multinational business three-tier model. It builds on the OECD's four pillars of tax compliance, plus a fifth pillar of third-party reporting and payments. Tier 1 sets out the behaviours driving tax performance, tier 2 the visible events, and tier 3 the focus areas where the ATO intervenes. For the first time, the assurance areas are grouped under this framework.

The five tier 1 behaviours are international related party dealings, cross-border investment structures, domestic tax positions and structures, administrative compliance obligations, and actions that support tax compliance. Between them, the tier 3 focus areas cover transfer pricing, intangibles and royalties, the quantum and pricing of debt, debt creation, interest withholding tax, the third-party debt test, hybrid arrangements, profit attribution, loss use and allocable cost amount (ACA) calculations. From a GST perspective, the tier 3 focus areas include financial supplies, GST classification of food and health products, real property transactions and accommodation and GST reporting of low value goods and digital supplies by offshore entities.

Mapping a taxpayer’s profile against the tier 3 focus areas is worthwhile. It should predict the likely scope of ATO reviews better than the ratings tables alone.

Common areas of concern and ATO focus

The reviews consistently identify several areas that attract close scrutiny. These are summarised below.

Income tax

• Transfer pricing: the most common assurance area in the Top 1,000 program, featuring in around two thirds of Top 1,000 reviews. Inadequate contemporaneous documentation remains the leading cause. The ATO is also alert to methodology changes made without any change in functional characterisation.
• Related party financing: assurance remains mixed, particularly in the Top 1,000 cohort. In the Top 100, more than 80% of review outcomes were high or medium assurance, while the Top 1,000 recorded 70% high or medium assurance and 30% low or red flag.  The problem arrangements are interest bearing related party loans, and to a lesser extent, cash pooling, guarantee fees and outbound interest free loans. The ATO continues to apply its published risk assessment framework for cross-border related party financing.
• Inbound distribution and offshore hubs: these remain the more challenging areas to obtain assurance in the Top 100 program. Inbound distribution recorded one of the lowest ratings with 36% of taxpayers receiving a low or red flag rating. Offshore hubs and commodity pricing fared slightly better but still had 24% of taxpayers receiving a low or red flag rating.

• Thin capitalisation and debt deduction creation: The new thin capitalisation and debt deduction creation rules will continue to be a key focus area. The ATO is now also testing whether the quantum of debt is arm's length, not just its pricing, in line with the recent law change.

• Hybrid mismatch arrangements: outcomes improved in both programs, with around half now at high assurance. Inability to evidence the processes supporting compliance with the imported hybrid mismatch rule remains the most common reason for a lower rating.

• Royalties and intangibles: scrutiny is intensifying where cross-border payments may be mischaracterised as being for goods or services rather than rights to intellectual property. Software, intermediation and distribution arrangements are squarely in the ATO’s focus.

• Other areas: Loss utilisation, consolidation and capital allowances rated comparatively well in the Top 1,000. The causes of lower ratings relate to documentation: unsupported ACA calculations, acquisition costs treated as blackhole expenditure, assets more appropriately classified as goodwill, weak evidence for the business continuity test, and unsupported effective lives. In the Top 100, research and development is the weakest domestic area.

GST

• GST governance and tax control frameworks: this remains the most significant focus area. The way systems create, capture, collate and report GST determines whether it is reported correctly. A stage 1 rating is the single biggest barrier to high assurance.

• GST classification errors: around a third of Top 1,000 ratings for food and health product classification were low or red flag, although Top 100 outcomes improved. Drivers include weak controls over new product onboarding, no regular review of the product master list, incorrect interpretation of the law and reliance on a supplier's classification.
• Financial supplies: concerns centre on the financial acquisitions threshold for mergers, demergers, acquisitions and initial public offerings. Other areas of concern include reduced input tax credits claimed without assessing eligibility, including under IT outsourcing contracts, and failure to reverse charge services from overseas branches or related entities.

• Agency arrangements: a newly prominent area, and one of the weaker GST results this year. The cause is inadequate documentation supporting the application of Subdivision 153-B of the A New Tax System (Goods and Services Tax) Act 1999 ('GST Act') to arrangements, incorrect application of Subdivision 153-B to agency arrangements as well as incorrect claiming of input tax credits. These arrangements should be documented having regard to the requirements under the law and reviewed periodically.

• Real property and accommodation: a persistent source of low and red flag ratings. Focus areas include the margin scheme, GST-free farmland and the claiming of credits on residential accommodation supplied to employees. Other areas of focus for the ATO include short term accommodation, build-to-rent activities, apportionment methodologies for mixed use developments, and the classification of supplies and acquisitions for retirement villages.

• Staff expenses: consistent with prior years there continues to be errors identified in the GST treatment of post-tax employee contributions and non-deductible entertainment expenses. Both have flow-on effects for fringe benefits tax and income tax.

• Recipient created tax invoices: this area is improving and now among the better GST results. The recurring failures relate to not having a valid agreement and no monitoring of the supplier's GST registration.

Governance and controls testing

Governance remains central to a high assurance rating, and expectations have moved again. The emphasis has shifted from designing controls, to testing them, to continuing to test them.

• Stage 3 must now be maintained: once stage 3 is attained, the ATO applies a monitoring approach. Taxpayers must keep testing in line with their periodic testing program and provide the results to the Board. All controls should be tested at least once every three to five years.

• Periodic internal controls testing must be independent: the tester must be suitably qualified and independent of the control owner. Internal audit qualifies where it sits outside the tax function with separate reporting lines.

• Advisers can disqualify themselves: the ATO will consider whether the third party independent tester has designed any of the tax controls or prepared the income tax return or business activity statement. If the tester is not independent, stage 3 requirements will not have been met.

• Documented testing plans: with respect to the periodic testing of tax controls, factors preventing a Stage 2 rating included: a sufficiently detailed testing plan that covered all justified trust controls and specified an appropriate methodology was not provided, the frequency of ongoing testing was not documented, and there was no evidence that the testing program had been endorsed by the Board or a delegated committee. For Top 100 taxpayers, the ATO invites taxpayers to discuss a proposed plan before testing begins.

Governance is the most significant reason preventing taxpayers from achieving an overall high assurance for GST.  For reviews completed in the 2025-26 financial year, 92% of taxpayers that achieved an overall medium assurance rating had not yet achieved a Stage 2 or 3 governance rating.  In around half of those cases, governance was the only reason high assurance was not achieved.

Governance over third-party data

The ATO has established a dedicated assurance program for superannuation funds and collective investment vehicles, centred on third-party data governance. For investment industry entities, this has moved from guidance to consequence. The ATO has completed 56 Top 1,000 reviews, with approximately 59% of those rated achieving stage 2.

• Third party data governance may affect the overall assurance rating: the ATO will consider this on a case-by-case basis, having regard to the industry, whether the third-party data governance framework is fit for purpose, and how significant the data is to the activity assured. Where a significant share of activity depends on third-party data, an entity may be prevented from attaining overall high assurance without an effectively designed framework.

• In-house teams are not exempt: expectations apply equally to entities performing investment management and fund administration internally.

• Evidence must cover tax controls: a GS007 or ASAE 3402 report that does not contain sufficient tax control objectives will not satisfy the design effectiveness criteria. Entities must also show they have reviewed the findings, reported exceptions to the Board, and have a remediation strategy if exceptions are identified. Board reporting should explain how any service provider breach was rectified.

A justified trust rating is a position to hold, not a milestone to reach. The ATO has now published figures showing ratings can fall, and the reasons sit within taxpayer control: evidence that is not contemporaneous, governance commitments that are not met, new transactions that cannot be assured, and reconciliations that cannot be supported.

Governance now drives the cost of engagement, not just the rating. Reaching Stage 2 or 3 unlocks a lighter-touch review, and for GST, it often represents the key distinction between a medium and a high assurance outcome. With a significant proportion of GST reporters still rated Stage 1, the immediate opportunity is achieving Stage 2. For many taxpayers this requires enhanced or additional source documentation to evidence that a GST control framework (encompassing both common and fundamental GST controls) exists and are designed effectively.

It is recommended that businesses review their testing plans to ensure they cover all justified trust controls, clearly state the methodology and testing frequency, have Board endorsement, and are executed by a genuinely independent tester. Taxpayers that hold a Stage 3 tax governance rating need to continue testing to maintain it. Typically, documentation, rather than the tax position itself, is what differentiates a medium rating from a high one.