The ATO continues to increase its focus on governance over data sourced from outsourced service providers (OSPs), including custodians, administrators, registries and technology platforms. This data is critical to income tax returns and investor distribution statements, and the ATO has been clear that outsourcing does not transfer legal responsibility for tax outcomes.
In 2022, the ATO released its Supplementary Guide on Governance over Third Party Data (TPD Guide), setting out expectations for how superannuation funds, investment managers, insurers and similar entities should govern third party data used for tax reporting. The guide builds on earlier ATO governance guidance and utilises the establishes three stage maturity model: Stage 1 – Controls exist; Stage 2 – Controls are effectively designed; Stage 3 – Controls operate effectively and are independently tested.
From 1 July 2024, the ATO commenced formal reviews of third party data governance. Of the first 19 funds reviewed, 70% achieved a Stage 2 rating, with the remainder not rated due to fund wind ups. The ATO has indicated that Stage 2 is now the expected industry standard, with a further 22 funds to be reviewed in both 2026 and 2027.
Key ATO Observations
Board oversight
Boards are expected to receive regular, meaningful reporting on OSPs performance, including material service level breaches, remediation actions and preventative controls. High level reporting without insight into root causes or corrective action was viewed unfavourably. Reliance on assurance reports GS 007 and ASAE 3402 reports were often considered insufficient, particularly where tax control objectives were limited. The ATO reiterated that responsibility for tax data accuracy remains with the entity, not the OSPs.
Management level controls
Insufficient oversight of OSPs system changes and process improvements impacting tax data. Inconsistent identification and escalation of significant or complex transactions. Robust tax due diligence at investment entry, but there was limited focus on exits or post closure reviews. Gaps in documented controls for data migration events, including changes in OSPs, platform migrations and successor fund transfers. Increased scrutiny of international investments, particularly where custodians provide downstream tax reporting.
Practical Steps for Entities
Based on our experience assisting clients through these reviews, entities should prioritise: Mapping outsourcing arrangements to identify all material OSPs involved in tax data production. Documenting third party tax data flows, including manual interventions and review points. Gathering existing governance and control documentation and mapping it to the TPD Guide’s principles and controls. Performing a structured gap analysis, ideally with independent input. Implementing a risk based control framework with clear ownership, escalation criteria and board reporting. Establishing a periodic, independent testing of third party data tax controls will assist progress to a stage 3 rating.
