Small Business Compliance Checklist Australia: GST, Super, Fair Work & WHS

Systematising Your ATO and Tax Compliance

For most businesses turning over $1M-$50M, tax compliance feels like a frantic quarterly scramble to get the Business Activity Statement (BAS) lodged. This reactive posture creates cash flow volatility and masks serious risks. A systematic approach is essential.

GST: It's Never Your Money

The single most common and dangerous mistake is treating GST collected as working capital. It's not. It is the ATO's money, which you are holding in trust. When cash flow gets tight, dipping into the 'GST account' (even if it's not a separate bank account) is a siren song that leads directly to a high-risk debt position with the ATO.

Actionable System:

1. Open a separate bank account. Name it "GST & PAYG Holding".
2. Automate a transfer. Set up a recurring transfer to move 1/11th of every deposit or a weekly sales estimate into this holding account.
3. Pay your BAS from this account. When your BAS is due, the money is there. This simple discipline transforms cash flow management and eliminates the primary source of ATO debt for many SMEs. For more on this, read our guide to Cash Flow Management for Australian Small Business: Why Profitable Businesses Still Go Broke.

BAS, PAYG, and Single Touch Payroll (STP)

Single Touch Payroll (STP) Phase 2 means the ATO now has granular, real-time data on what you pay your employees. They know the breakdown of ordinary time earnings, overtime, allowances, and more. This data is cross-matched against award conditions and superannuation payments. The days of "getting away with it" are over; data-matching algorithms will find discrepancies.

Your bookkeeping software (like Xero, MYOB, or QuickBooks) is your compliance engine. It must be set up correctly.

• Regular Reconciliation: Reconcile accounts weekly, not quarterly. This flags issues early.
• Accurate Payroll Categories: Ensure every payment type (allowances, bonuses, leave) is mapped correctly for tax and super purposes.
• Lodge on Time, Every Time: Set calendar alerts a week before the due date, not on the day. Missing deadlines is the fastest way to attract ATO scrutiny.

Note: These are the standard deadlines. Your accountant or BAS agent may have different lodgement schedules.

Superannuation: The Unforgiving Compliance Trap

No area of compliance has less flexibility and more severe penalties than the Superannuation Guarantee (SG). The ATO has dramatically increased its audit activity here because it's a direct hit to an individual's retirement savings.

If you pay super even one day late, you are liable for the Superannuation Guarantee Charge (SGC). The SGC includes:

1. The super shortfall amount.
2. Interest on that amount (currently 10% p.a.).
3. A $20 administration fee per employee, per quarter.

Crucially, SGC payments are not tax-deductible, unlike on-time SG contributions. This can turn a $10,000 super bill into a $15,000+ hit to your net profit once the lost deduction is factored in.

The Contractor vs. Employee Minefield

One of the biggest superannuation risks is misclassifying workers. The ATO and Fair Work use a multi-factor test to determine if a worker is a true independent contractor or an employee for tax and super purposes, regardless of what an ABN or a written agreement says. If you direct their hours, provide the tools, and they work exclusively for you, they are likely an employee in the eyes of the law.

The Risk: You engage a 'contractor' for two years, paying them $90,000 annually. The ATO audits you and deems them to have been an employee. You are now retrospectively liable for two years of super, plus the SGC penalties. That's over $20,000 in super, plus interest and admin fees, and none of it is tax-deductible. This is one of the most common hidden profit leaks that can cripple an Australian business.

Use the ATO's employee/contractor decision tool for every new engagement and review existing arrangements annually.

Navigating the Fair Work Maze: Awards, Pay Rates & Records

Underpayment claims are now a common feature of the Australian business landscape, often originating from simple, unintentional errors that compound over years. The Fair Work Ombudsman has strong enforcement powers, and the onus of proof always rests with the employer.

Misclassifying Staff: The Million-Dollar Mistake

Every industry award has different levels or classifications based on duties, experience, and qualifications. Placing an employee on 'Level 2' of the Clerks Award when their duties actually match 'Level 4' is a compliance breach.

Worked Example:

• An admin employee is paid at Level 2 for 3 years ($25/hour).
• Their actual duties (managing accounts, complex problem solving) align with Level 4 ($29/hour).
• The difference is $4/hour. Over 3 years (approx. 5,800 hours), that's a $23,200 underpayment for one employee.
• Now multiply that by every employee in a similar role. The liability can easily reach six or seven figures.

Actionable System:

1. Document a Position Description (PD) for every single role before you hire.
2. Map the PD to the relevant modern award. Use the Fair Work Ombudsman's Find my award tool.
3. Document the classification decision and the reasoning behind it.
4. Review classifications annually or whenever a role's duties change significantly.

Time and Wage Records: Your Only Defence

If an employee makes an underpayment claim, and you don't have perfect records, Fair Work will likely accept the employee's version of events. By law, you must keep time and wage records for 7 years. These must show:

• The employer's and employee's name and ABN.
• The award or agreement they are covered by.
• Their employment status (full-time, part-time, casual) and classification.
• Pay rate.
• Hours worked (start/finish times and unpaid breaks for non-salaried staff).
• Loadings, allowances, and penalty rates.
• Superannuation contributions.
• Any deductions from pay.

Digital time-tracking and payroll systems (like Deputy, Tanda, or the payroll modules in Xero) are essential tools for maintaining these records accurately.

Work Health and Safety (WHS): Beyond the Policy Document

Having a WHS policy filed away in a drawer is not compliance. WHS is a proactive duty of care that requires ongoing action, consultation, and record-keeping. In the event of a serious incident, regulators will scrutinise your actions, not just your paperwork.

The Risk Register: A Living Document

Your primary WHS tool should be a risk register that identifies potential hazards in your workplace, assesses their risk level, and documents the control measures you have put in place.

Example Risk Register Entry:

Key WHS Obligations

• Consultation: You have a legal duty to consult with your workers on WHS matters. This means regular safety meetings (toolbox talks), having Health and Safety Representatives, and a documented process for staff to report hazards.
• Safe Work Method Statements (SWMS): If your business undertakes any of the 19 'high-risk construction work' activities, you are legally required to have a SWMS for that task. This is non-negotiable for trades and construction businesses.
• Training and Induction: You must keep records of every worker's induction, training, and licenses (e.g., forklift licence, White Card). This includes subcontractors working on your site.
• Incident Reporting: Have a clear process for reporting all incidents and near-misses. Notifiable 'serious incidents' must be immediately reported to your state's WHS regulator (e.g., SafeWork NSW, WorkSafe VIC).

From Reactive Scramble to Proactive System

Compliance isn't a list of tasks to be checked off; it's an operational system that needs to be built and maintained. The cost of failure is too high to be left to memory and good intentions.

1. Audit Your Position: You can't fix what you can't see. Start with a thorough review of your current state across these four areas. A formal What Is a Business Operations Audit? (And Why Every Australian Operator Needs One) is the most robust way to do this.
2. Assign Ownership: Who is explicitly responsible for checking award rates each July? Who ensures super is paid a week before the deadline? Who reviews the WHS risk register quarterly? Give each compliance function a clear owner.
3. Build a Compliance Calendar: Map out every key compliance date for the year—BAS, super, insurance renewals, award rate reviews. Use a shared digital calendar with automated reminders.
4. Systematise with SOPs: Document the process for each key task, from onboarding a new employee correctly to lodging the BAS. This is how you get compliance out of one person's head and build it into the fabric of your business. Our guide to SOPs for Small Business shows you how to start.

Frequently asked questions

What's the first step to fixing our business compliance?

Start with an honest, structured audit. Use a comprehensive checklist to review your current practices in tax, super, employment, and WHS. This initial diagnosis will reveal your biggest areas of risk and allow you to prioritise your efforts, rather than trying to fix everything at once. Focus on the issues with the biggest financial or legal consequences first, like superannuation and award classification.

How often should I review our compliance systems?

Some items require constant vigilance, while others are periodic. Payroll and GST/BAS processes should be checked weekly or monthly. A full review of award classifications and pay rates should happen at least annually (especially around 1 July when rates change). WHS risk registers should be reviewed quarterly or whenever a new process or piece of equipment is introduced. Schedule these reviews in a compliance calendar.

Are directors personally liable for compliance breaches?

Yes. Company directors can be held personally liable for certain compliance failures, most notably unpaid PAYG withholding and superannuation guarantees. The ATO can issue a Director Penalty Notice (DPN), making you personally responsible for the company's debt. For serious WHS breaches, directors can also face significant personal fines and, in extreme cases, imprisonment. The corporate veil offers limited protection for core compliance duties.

What's the key difference between a contractor and an employee?

The core difference is control. Generally, an employee works in your business under your direction, while a contractor runs their own business and provides a service to you. Key indicators of an employee relationship include you controlling their work hours, providing the tools, and them working exclusively for you. A true contractor dictates their own process, can delegate work, and bears the commercial risk. Always use the ATO's decision tool.

Getting compliance wrong is one of the fastest ways to destroy profit and enterprise value. But building a robust compliance system isn't just about avoiding fines; it's about creating a stable, professional, and scalable operation. It's the foundation for sustainable growth.

If you're unsure where your risks lie, the first step is to get an objective measure of your business's operational health. Take our free business health audit to get a 10-minute snapshot of your compliance exposure and other operational vulnerabilities.